Скачать или смотреть WINDBG Kernel&User Mode Debugging (EPROCESS, ETHREAD, TEB, PEB...)

In this video I will be covering usage of WINDBG for Kernel and User mode debugging. I will be walking through System structures like EPROCESS, KPROCESS, ETHREAD, KTHREAD, TEB, PEB. You will get some information about these system structures, differences and their using.

I will show you how shellcodes and some malware are dynamically resolving API function addresses (Parsing TEB and PEB structure).

You will learn basic usage of WINDBG as Kernel/User Mode debugger and also usage of XNTSV tool to learn easily about Windows OS system related structures.

Walk-Through documentation for this video is available on my Github page:
https://github.com/Dump-GUY/Malware-a...

Some of information related to this video are available in awesome FREE course made be excellent RE "Hasherezade":
https://github.com/hasherezade/malwar...

Enjoy and remember to LOVE what you do :)