Software Diagnostics Institute

The following direct links can be used to order the book now:

Buy Kindle or Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

Available for SkillSoft Books24x7 subscribers

This is a transcript of Software Diagnostics Services seminar about different pattern categories for effective and efficient abnormal software behaviour diagnostics: the foundation of scalable and cost-effective pattern-driven software support.

• Title: Pattern-Driven Software Diagnostics: An Introduction
• Authors: Dmitry Vostokov, Software Diagnostics Services
• Publisher: OpenTask (April 2013)
• Language: English
• Product Dimensions: 28.0 x 21.6
• Paperback: 32 pages
• ISBN-13: 978-1908043382

Interpreting hardware signals as messages and messages as signals allows us to apply Software Narratology and software trace analysis patterns to the domain of hardware diagnostics:

Generalized trace analysis patterns and narrative extends the view of hardware-software traces and logs as temporarily ordered event sequences. The time domain is generalized to any arbitrary set such as a list of indexes or pointers or even memory itself. This gives a unification of memory and log analysis and application of Computer Narratology ^(*) to memory dump analysis as well.

(*) We call the application of methods of literary narratology to computer trace and log analysis and computer-related stories in general as Hardware-Software Narratology or simply Computer Narratology as it was originally done in Memory Dump Analysis Anthology, Volume 3 when we first introduced Software Narratology.

Software diagnostics is used whenever there is a fault that triggers some kind of an artefact such as a memory dump or a software trace. It is also used proactively in software and network monitoring. We combine all these uses with our pattern-oriented approach to anticipate faults before their occurrence:

Such preventive software diagnostics consists from 4 interrelated parts:

• General software structure and behaviour pattern catalogues
• Domain, vendor and product specific problem catalogues
• Live monitoring
• Pre-mortem analysis

Pre-mortem here means preventive memory dump analysis. It is similar to post-mortem analysis but artefacts are collected and analysed proactively before any actual problem. In some sense pre-mortem analysis is a part of live monitoring but we confine the latter to software trace and log analysis.

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback or Hardcover from Amazon

Buy Paperback or Hardcover from Barnes & Noble

Buy Paperback or Hardcover from Book Depository

Also available in PDF format from Software Diagnostics Services

Contains revised, edited, cross-referenced, and thematically organized selected DumpAnalysis.org blog posts about memory dump and software trace analysis, software troubleshooting and debugging written in November 2010 - October 2011 for software engineers developing and maintaining products on Windows platforms, quality assurance engineers testing software on Windows platforms, technical support and escalation engineers dealing with complex software issues, and security researchers, malware analysts and reverse engineers. The sixth volume features:

- 56 new crash dump analysis patterns including 14 new .NET memory dump analysis patterns
- 4 new pattern interaction case studies
- 11 new trace analysis patterns
- New Debugware pattern
- Introduction to UI problem analysis patterns
- Introduction to intelligence analysis patterns
- Introduction to unified debugging pattern language
- Introduction to generative debugging, metadefect template library and DNA of software behavior
- The new school of debugging
- .NET memory dump analysis checklist
- Software trace analysis checklist
- Introduction to close and deconstructive readings of a software trace
- Memory dump analysis compass
- Computical and Stack Trace Art
- The abductive reasoning of Philip Marlowe
- Orbifold memory space and cloud computing
- Memory worldview
- Interpretation of cyberspace
- Relationship of memory dumps to religion
- Fully cross-referenced with Volume 1, Volume 2, Volume 3, Volume 4, and Volume 5

Product information:

• Title: Memory Dump Analysis Anthology, Volume 6
• Author: Dmitry Vostokov
• Language: English
• Product Dimensions: 22.86 x 15.24

• Paperback: 306 pages
• Publisher: Opentask (January 2013)
• ISBN-13: 978-1-908043-19-1

• Hardcover: 306 pages
• Publisher: Opentask (January 2013)
• ISBN-13: 978-1-908043-20-7

Table of Contents
Errata

Back cover features 3d memory space visualization image created with ParaView.

consists of two main parts:

• Pattern-Driven process of finding patterns from existing pattern catalogs
• Pattern-Based evolution of pattern catalogs and pattern relationships

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

Available for SkillSoft Books24x7 subscribers

Also available in PDF format + recording from Software Diagnostics Services.

The full transcript of Software Diagnostics Services training. Feel frustrated when opening a software trace with millions of messages from hundreds of software components, threads and processes? Go beyond simple CPU and disk hog monitoring or searching for errors in a text and learn how to efficiently and effectively analyze software traces and logs from complex software environments. Covered popular software logs and trace formats from Microsoft and Citrix products and tools including Event Tracing for Windows (ETW) and Citrix Common Diagnostics Format (CDF). This course teaches using pioneering and innovative pattern-driven and pattern-based analysis of abnormal software behavior incidents developed by Software Diagnostics Institute.

• Title: Accelerated Windows Software Trace Analysis: Training Course Transcript
• Authors: Dmitry Vostokov, Software Diagnostics Services
• Publisher: OpenTask (January 2013)
• Language: English
• Product Dimensions: 28.0 x 21.6
• Paperback: 130 pages
• ISBN-13: 978-1908043429

Table of Contents

Software log analysis patterns from Software Diagnostics Institute are independent from any OS, platform or product because they are based on viewing software logs as stories of computation and were discovered by application of narratological analysis (software narratology). In addition to these patterns there exist domain specific problem patterns such as wrong hotfix level or specific product error code during software installation or execution. Typical examples of support for such platform and product specific type of patterns include Microsoft Windows Problem Reporting and Citrix Auto Support.

Let’s define software diagnostics as a discipline studying abnormal software structure and behavior in software execution artifacts (such as memory dumps, software and network traces and logs) using pattern-driven, systemic and pattern-based analysis methodologies.

Pattern-driven software post-construction problem solving involves using preexisting pattern languages and pattern catalogs for software diagnostics, troubleshooting and debugging. Pattern-based software post-construction problem solving addresses PLS (Pattern Life Cycle) - from the discovery of a new pattern through its integration into an existing catalog and language, testing, packaging and delivering to pattern consumers with subsequent usage, refactoring and writing case studies:

The first software diagnostics certification in memory dump analysis starts this September and will be administered by Software Diagnostics Services:

http://www.patterndiagnostics.com/memory-dump-analysis-certification-out...

We also plan a beta software trace analysis certification.

For companies there is also available Software Diagnostics Maturity enterprise certification:

http://www.patterndiagnostics.com/software-diagnostics-maturity

Welcome to the project CARE!

We now also accept GDB logs and crash reports from Mac OS X and iOS.

CARE means Crash Analysis Report Environment. It includes a pattern-driven debugger log analyzer and standards for structured audience-driven reports. The system architecture is described here.

Please help to populate the database of stack traces by submitting your WinDbg and GDB output logs including Mac OS X and iOS crash reports. For Windows you can use VBScript / WinDbg script to process all .DMP files on your hard drives: DebuggerLogs.zip. The archive contains VBScript file for x64 WinDbg (DebuggerLogs64.vbs) and for x86 WinDbg (DebuggerLogs.vbs) plus the very simple mode-independent WinDbg script (DebuggerLogs.wds). The WinDbg output is stored in dbgeng.log file.

Note: Please do not submit your crash or core dumps because the file size is limited to 2 MB and CARE system is currently being designed to analyze debugger logs and crash reports only. If your log is bigger you can submit a zip file. If you have any problems please contact the administrator. Please do not expect any crash analysis response for your logs or reports. The submittal is currently for internal CARE database population only and not for the pattern analysis of your computer memory.

Under inscription...

The name for this table was suggested by Joshua J. Drake and first propagated to me by @jcran

Action                      | GDB                 | WinDbg
----------------------------------------------------------------
Start the process           | run                 | g
Exit                        | (q)uit              | q
Disassemble (forward)       | (disas)semble       | uf, u
Disassemble N instructions  | x/<N>i              | -
Disassemble (backward)      | disas <a-o> <a>     | ub
Stack trace                 | backtrace (bt)      | k
Full stack trace            | bt full             | kv
Stack trace with parameters | bt full             | kP
Partial trace (innermost)   | bt <N>              | k <N>
Partial trace (outermost)   | bt -<N>             | -
Stack trace for all threads | thread apply all bt | ~*k
Breakpoint                  | break               | bp
Frame numbers               | any bt command      | kn
Select frame                | frame               | .frame
Display parameters          | info args           | dv /t /i /V
Display locals              | info locals         | dv /t /i /V
Dump byte char array        | x/<N>bc             | db
Switch to thread            | thread <N>          | ~<N>s
Sections/regions            | maint info sections | !address
Load symbol file            | add-symbol-file     | .reload
CPU registers               | i(nfo) r            | r

The current version is from April 30th, 2012:
http://www.dumpanalysis.org/blog/index.php/2012/04/30/gdb-for-windbg-users-part-8/

To Do:

- Split rows by categories
- Add links to command descriptions, examples, relevant patterns

The following direct links can be used to order the book now:

Buy Kindle or Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

This is a transcript of Memory Dump Analysis Services seminar about Software Narratology: an exciting new discipline and a field of research founded by DumpAnalysis.org. When software executes it gives us its stories in the form of UI events, software traces and logs. Such stories can be analyzed for their structure and patterns for troubleshooting, debugging and problem resolution purposes. Topics also include software narremes and their types, anticipatory software construction and software diagnostics.

• Title: Software Narratology: An Introduction to the Applied Science of Software Stories
• Authors: Dmitry Vostokov, Memory Dump Analysis Services
• Publisher: OpenTask (April 2012)
• Language: English
• Product Dimensions: 28.0 x 21.6
• Paperback: 26 pages
• ISBN-13: 978-1908043078

This newly expanded field studies all types of narratives in software construction and post-construction.

For details please visit our blog:

http://www.dumpanalysis.org/blog/index.php/2012/03/11/software-narratolo...
http://www.dumpanalysis.org/blog/index.php/2012/03/11/software-narrative...
http://www.dumpanalysis.org/blog/index.php/2012/02/02/narremes-in-softwa...

One of sources of Memoretics is Narratology to which the former contributes back by providing structural and behavioral analysis patterns and frameworks.

For the full story please visit our blog: http://www.dumpanalysis.org/blog/index.php/2012/02/13/software-narratolo...

A software problem incident is described using software problem description language. Its program interpretation or compilation results in a published software problem solving tool. Tools can be reused, parameterized, aggregated and organized into hierarchical catalogs. Welcome to the TaaS of the future!

We have conducted research and our internal case studies show that pattern-driven approach to memory analysis significantly decreases learning time: up to 10 times faster than before if not more. Whereas in the past it could take several years to master crash and hang dump analysis - today it takes a few months.

Software Diagnostics Services provides the first accelerated pattern-driven analysis training to decrease learning time even more while simultaneously lowering the steep learning curve:

Accelerated Windows Memory Dump Analysis Training

Accelerated .NET Memory Dump Analysis Training

Also available:

Advanced Windows Memory Dump Analysis with Data Structures

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback or Hardcover from Amazon

Buy Paperback or Hardcover from Barnes & Noble

Buy Paperback or Hardcover from Book Depository

Written by the founder of DumpAnalysis.org this book is not about bugs or debugging techniques but about background knowledge everyone needs to start experimenting with WinDbg, learn from practical experience and read other advanced debugging books. Solid understanding of fundamentals like pointers is needed to analyze stack traces beyond !analyze -v and lmv WinDbg commands. This is the book to help technical support and escalation engineers and Windows software testers without the knowledge of assembly language to master necessary prerequisites to understand and start debugging and crash dump analysis on Windows platforms. It doesn't require any specific knowledge, fills the gap and lowers the learning curve. The book is also useful for software engineers coming from managed code or Java background, engineers coming from non-Wintel environments, Windows C/C++ software engineers without assembly language background, security researchers and beginners learning Windows software disassembling and reverse engineering techniques. This book can also be used as Intel assembly language and Windows debugging supplement for relevant undergraduate level courses.

Product details:

• Title: Windows Debugging: Practical Foundations
• Author: Dmitry Vostokov
• Language: English
• Product Dimensions: 22.86 x 15.24

• Paperback: 200 pages
• ISBN-13: 978-1-906717-10-0
• Publisher: Opentask (01 February 2009)

• Hardback: 200 pages
• ISBN-13: 978-1-906717-67-4
• Publisher: Opentask (23 March 2009)

Table of Contents
Errata

Praise for the book:

I am a C++/Windows developer and have been a Windows debugging enthusiast for quite a long time now. However, I have never been able to get a good and credible source of information with regards to the internals of debugging using WinDbg. Over the years, I have laid my hands on various sources that deal with Windows Debugging tools and debugging techniques. Every time I purchased a book or went through an online source, I was limited to confusing information that lead me to give up on this topic. Even reliable books that claimed to be the best in the market were nothing less than a colossal disappointment. However, recently when I came across "Windows Debugging: Practical Foundation" that was purchased by a friend of mine, I was sceptic but, nonetheless, decided to give it a chance. Trust me, although not perfect, the book has helped me a lot in learning more about windows internals and debugging techniques. I would like to extend my complements for writing a book that divulges details in a very concise yet clear manner.

Sriram Sarma

Book reviews:

Amazon reviews
Amazon UK reviews

Memoretics views Cyber Space as Memory Space + Memory Data. Here Memory Space consists of many different memory spaces. Although data is private property memory space where it is located is not:

We propose private property on memory spaces and their partitions as a solution to various Cyber problems such as Cyber Crime and Cyber War:

The following direct links can be used to order the book now:

Buy Kindle or Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

The full transcript of Memory Dump Analysis Services seminar on pattern-driven software troubleshooting, debugging and maintenance. Topics include: A Short History of DumpAnalysis.org; Memory Dump Analysis Patterns; Troubleshooting and Debugging Tools (Debugware) Patterns; Software Trace Analysis Patterns; From Software Defects to Software Behavior; Workaround Patterns; Structural Memory Patterns; Memory Analysis Domain Pattern Hierarchy; New Directions.

• Title: Introduction to Pattern-Driven Software Problem Solving
• Authors: Dmitry Vostokov, Memory Dump Analysis Services
• Publisher: OpenTask (June 2011)
• Language: English
• Product Dimensions: 28.0 x 21.6
• Paperback: 24 pages
• ISBN-13: 978-1908043177

Memoretics as a science of memory snapshots borrows many ideas from the following disciplines (the list is not exhaustive):

• Troubleshooting and Debugging
• Intelligence Analysis
• Critical Thinking
• Forensics
• Linguistics
• Archaeology
• Psychoanalysis
• History
• Mathematics: Sets and Categories
• Literary Criticism and Narratology

It also contributes many ideas back. The following diagram depicts such an interaction:

Memoretics promotes pattern-driven memory dump and software trace analysis which has many uses but not limited to:

• Software and site reliability
• Software Debugging
• QA and Software Testing
• Computer Security
• Software Troubleshooting
• Malware Research and Analysis
• Tools as a Service (TaaS)
• Supportability
• Software Diagnostics

The founding text of Memoretics is Memory Dump Analysis Anthology.

We consider memory dump and software trace analysis patterns as units of software behavioral genome. This work started in 2006 and we plan to continue with the publication of volumes 6 - 10 of Memory Dump Analysis Anthology. The release of volume 6 is planned for November-December, 2011.

The image was generated using 3D memory visualization techniques.

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

This is a supplemental volume of selected articles with 170 full color illustrations from Memory Dump Analysis Anthology: revised, edited, cross-referenced and thematically organized volumes of selected DumpAnalysis.org blog posts about debugging, modern crash dump and software trace analysis, conceptual physicalist and memory space art, speculative metaphysics of memory dump worldview (memoidealism) written in July 2009 - October 2010 for software engineers developing and maintaining products on Windows platforms, quality assurance engineers testing software on Windows platforms, technical support and escalation engineers dealing with complex software issues, security and defect researchers, reverse engineers and malware analysts, computer security and cyber warfare intelligence professionals, computer scientists, conceptual digital artists and philosophers. Unique in its breadth, depth, and scope it offers unprecedented insight into the world of software behavior and draws profound engineering, scientific, artistic and metaphysical implications.

• Title: Memory Dump Analysis Anthology: Color Supplement for Volumes 4-5
• Author: Dmitry Vostokov
• Publisher: OpenTask (June 2011)
• Language: English
• Product Dimensions: 21.6 x 14.0
• Paperback: 232 pages
• ISBN-13: 978-1908043047

Table of Contents

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

This is a reference book for technical support and escalation engineers troubleshooting and debugging complex software issues. The book is also invaluable for software maintenance and development engineers debugging Windows applications and services.

• Title: Windows Debugging Notebook: Essential User Space WinDbg Commands
• Authors: Roberto Alexis Farah, Mario Hewardt (Foreword), Dmitry Vostokov (Editor)
• Language: English
• Product Dimensions: 19.8 x 12.9 cm

• ISBN-13: 978-1-906717-00-1
• Publisher: OpenTask (15 May 2011)
• Paperback: 256 pages

Table of Contents
Book review
Errata

The following direct links can be used to order the book now:

Buy Paperback or Kindle Edition from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

Written by a veteran in mission-critical computer system problem resolution, problem prevention, and system recovery, this book discusses solving problems on their FIRST occurrence while emphasizing software supportability and serviceability.

• Title: First Fault Software Problem Solving: A Guide for Engineers, Managers and Users
• Author: Dan Skwire
• Publisher: Opentask (1 December 2009)
• Language: English
• Product Dimensions: 22.86 x 15.24
• ISBN: 1906717427
• ISBN-13: 978-1906717421
• Paperback: 180 pages

Table of Contents
Amazon reviews
c’t – Magazin für Computertechnik review
Alan Radding's DancingDinosaur and bottomlineIT reviews

Who should read this book?

• Software professional engineers and managers
• End-users, system administrators and their managers
• Software engineering students

What will the readers of this book learn?

• How to optimize use of pre-existing software problem solving features
• How to choose the best products to improve first fault problem-solving
• How to get the best results when problems occur on outsourced and cloud-placed work
• How to choose amongst first-fault tools, second-fault tools, and manual problem solving methods to best advantage for difficult problems
• How to be an educated consumer or creator of future problem-solving software

What is the business value of reading this book?

• Saving money on problem solving resources (servers, storage, network, software, power, space, cooling, personnel)
• Keeping customers happier since their issues are resolved sooner
• Reducing the durations of computer service outages that affect external clients
• Decreasing operational overhead and encouraging sustainable, higher-performing organizations and enterprises through best problem-solving practices

What else is special about this book?

• 21 original illustrations to feed the soul and tickle the funny-bone
• 21 thought-provoking quotes to feed the intellect and the spirit
• An extensive bibliography to aid in clarification and personal growth

The new founded school integrates traditional multidisciplinary debugging approaches and methodologies with:

- multiplatform pattern-driven software problem solving
- unified debugging patterns
- generative debugging
- best practices in memory dump analysis and software tracing
- computer security
- humanities and social sciences including archaeology and economics
- new emerging trends

• Increased complexity of software will bring more methods from biological, social sciences and humanities in addition to existing methods of automated debugging and computer science techniques
• Focus on first fault software problem solving (when aspect)
• Focus on pattern-driven software problem solving (how aspect)
• Fusion of debugging and malware analysis into a unified structural and behavioral pattern framework
• Visual debugging, memory and software trace visualization techniques
• Software maintenance certification
• Focus on domain-driven troubleshooting and debugging tools as a service (debugware TaaS)
• Focus on security issues related to memory dumps and software traces
• New scripting languages and programming language extensions for debugging
• The maturation of the science of memory snapshots and software traces (memoretics)

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

This is a supplemental volume of selected articles with 68 full color illustrations from Memory Dump Analysis Anthology: revised, edited, cross-referenced and thematically organized volumes of selected DumpAnalysis.org blog posts about modern crash dump analysis and debugging written in August 2006 - June 2009 for software engineers developing and maintaining products on Windows platforms, quality assurance engineers testing software on Windows platforms, technical support and escalation engineers dealing with complex software issues, security and defect researchers, computer scientists and philosophers. Unique in its breadth, depth, and scope it offers unprecedented insight into the world of Windows software and draws profound scientific and metaphysical implications.

• Title: Memory Dump Analysis Anthology: Color Supplement for Volumes 1-3
• Author: Dmitry Vostokov
• Publisher: OpenTask (May 2010)
• Language: English
• Product Dimensions: 21.6 x 14.0
• Paperback: 110 pages
• ISBN-13: 978-1906717698

Table of Contents

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback or Hardcover from Amazon

Buy Paperback or Hardcover from Barnes & Noble

Buy Paperback or Hardcover from Book Depository

Written by the founder of DumpAnalysis.org this book is not about bugs or debugging techniques but about background knowledge everyone needs to start experimenting with x64 WinDbg, learn from practical experience and read other advanced debugging books. Solid understanding of fundamentals like pointers is needed to analyze stack traces beyond !analyze -v and lmv WinDbg commands. This is the book to help technical support and escalation engineers and Windows software testers without the knowledge of assembly language to master necessary prerequisites to understand and start debugging and crash dump analysis on x64 Windows platforms. It doesn't require any specific knowledge, fills the gap and lowers the learning curve. The book is also useful for software engineers coming from managed code or Java background, engineers coming from non-Wintel environments, Windows C/C++ software engineers without assembly language background, security researchers and beginners learning x64 Windows software disassembling and reverse engineering techniques. This book can also be used as AMD64 and Intel EM64T assembly language and x64 Windows debugging supplement for relevant undergraduate level courses. For someone, who wants to learn these foundations in the context of 32-bit Windows environments there is a separate x86 book (ISBN: 978-1-906717-10-0). However, this book is completely independent from that earlier book and almost every illustration was recreated to reflect x64 architecture and x64 Windows ILP 32-32-64 model (Integer-Long-Pointer).

Product details:

• Title: x64 Windows Debugging: Practical Foundations
• Author: Dmitry Vostokov
• Language: English
• Product Dimensions: 22.86 x 15.24

• Paperback: 194 pages
• Publisher: Opentask (17 August 2009)
• ISBN-13: 978-1-906717-56-8

• Hardcover: 194 pages
• Publisher: Opentask (15 March 2010)
• ISBN-13: 978-1-906717-92-6

Table of Contents

The following direct links can be used to order the book now:

Buy Kindle or Paperback or Hardcover from Amazon

Buy Paperback or Hardcover from Barnes & Noble

Buy Paperback or Hardcover from Book Depository

Also available in PDF format from Software Diagnostics Services

This is a revised, edited, cross-referenced and thematically organized volume of selected DumpAnalysis.org blog posts about crash dump analysis and debugging written in October 2008 - June 2009 for software engineers developing and maintaining products on Windows platforms, quality assurance engineers testing software on Windows platforms and technical support and escalation engineers dealing with complex software issues. The third volume features:

- 15 new crash dump analysis patterns
- 29 new pattern interaction case studies
- Trace analysis patterns
- Updated checklist
- Fully cross-referenced with Volume 1 and Volume 2
- New appendixes

Product information:

• Title: Memory Dump Analysis Anthology, Volume 3
• Author: Dmitry Vostokov
• Language: English
• Product Dimensions: 22.86 x 15.24

• Paperback: 404 pages
• Publisher: Opentask (20 December 2009)
• ISBN-13: 978-1-906717-43-8

• Hardcover: 404 pages
• Publisher: Opentask (15 March 2010)
• ISBN-13: 978-1-906717-44-5

Table of Contents
Errata

Back cover features 3D computer memory visualization image.