{"id":16712924,"url":"https://github.com/hugsy/defcon_27_windbg_workshop","last_synced_at":"2025-04-13T07:49:56.857Z","repository":{"id":54517394,"uuid":"197041315","full_name":"hugsy/defcon_27_windbg_workshop","owner":"hugsy","description":"DEFCON 27 workshop - Modern Debugging with WinDbg Preview","archived":false,"fork":false,"pushed_at":"2024-11-01T23:28:15.000Z","size":79955,"stargazers_count":720,"open_issues_count":0,"forks_count":129,"subscribers_count":29,"default_branch":"main","last_synced_at":"2025-04-13T07:49:46.943Z","etag":null,"topics":["debugging","windbg","windbg-scripts","windbgx","windows"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hugsy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-07-15T17:14:18.000Z","updated_at":"2025-04-01T06:38:48.000Z","dependencies_parsed_at":"2022-08-13T18:21:02.361Z","dependency_job_id":"889f5e32-1f93-4c2c-9aea-bac620b11441","html_url":"https://github.com/hugsy/defcon_27_windbg_workshop","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hugsy%2Fdefcon_27_windbg_workshop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hugsy%2Fdefcon_27_windbg_workshop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hugsy%2Fdefcon_27_windbg_workshop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hugsy%2Fdefcon_27_windbg_workshop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hugsy","download_url":"https://codeload.github.com/hugsy/defcon_27_windbg_workshop/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248681494,"owners_count":21144700,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["debugging","windbg","windbg-scripts","windbgx","windows"],"created_at":"2024-10-12T20:44:41.885Z","updated_at":"2025-04-13T07:49:56.829Z","avatar_url":"https://github.com/hugsy.png","language":"Python","funding_links":[],"categories":["***Windows Kernel***","\u003ca id=\"37eea2c2e8885eb435987ccf3f467122\"\u003e\u003c/a\u003e插件\u0026\u0026脚本"],"sub_categories":["***Debugging***","\u003ca id=\"2ef75ae7852daa9862b2217dca252cc3\"\u003e\u003c/a\u003e新添加的"],"readme":"# \"Modern Debugging with WinDbg Preview\" DEFCON 27 workshop\n\nThis repository contains the materials for the [DEFCON 27](https://defcon.org/html/defcon-27/dc-27-index.html) [workshop](https://defcon.org/html/defcon-27/dc-27-workshops.html#alladoum)\n\n\n## Overview\n\n### Abstract\n\nIt's 2019 and yet too many Windows developers and hackers alike rely on (useful but rather) old school tools for debugging Windows binaries (OllyDbg, Immunity Debugger). What they don't realize is that they are missing out on invaluable tools and functionalities that come with Microsoft newest WinDbg Preview edition. This hands-on workshop will attempt to level the field, by practically showing how WinDbg has changed to a point where it should be the first tool to be installed on any Windows (10) for binary analysis machine: after a brief intro to the most basic (legacy) commands, this workshop will focus around debugging modern software (vulnerability exploitation, malware reversing, DKOM-based rootkit, JS engine) using modern techniques provided by WinDbg Preview (spoiler alert to name a few, JavaScript, LINQ, TTD). By the end of this workshop, trainees will have their WinDbg-fu skilled up.\n\n\n### Where/when?\n\nSaturday August 10th 2019, 1430-1830\nFlamingo, Lake Mead II\n\n\n### Skill Level\n\nIntermediate\n\n\n### Prerequisites\n\nFamiliarity with Windows platform and kernel debugging\nWorking knowledge of debuggers (pref. WinDbg)\nWorking knowledge of JavaScript\n\n### Materials\n\nAny modern laptop running Windows 10 + a hypervisor with one Windows 10 VM guest (for example with remote debugging via `kdnet `, but can work out with `lkd`). Also need Internet access.\n\n\n## Quick Links\n\n  * [WindDbg CheatSheet](windbg_cheatsheet.md)\n\n\n## Acknowledgment\n\nThis workshop was originally produced as part of my (`hugsy`) work at [**@SophosLabs**](https://github.com/sophoslabs) in the Offensive Security Team.\n\n\n## Authors\n\n * `hugsy` \n   * [![twitter](https://i.imgur.com/BIbG3EG.png)](https://twitter.com/_hugsy_) [![gh](https://i.imgur.com/TFRgRGW.png)](https://github.com/hugsy)\n   \n * `0vercl0k` \n   * [![twitter](https://i.imgur.com/BIbG3EG.png)](https://twitter.com/0vercl0k) [![gh](https://i.imgur.com/TFRgRGW.png)](https://github.com/0vercl0k)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhugsy%2Fdefcon_27_windbg_workshop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhugsy%2Fdefcon_27_windbg_workshop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhugsy%2Fdefcon_27_windbg_workshop/lists"}