Everybody loves "live debugging" with Visual Studio when the source code and symbols are available. Take off symbols and/or source and you cannot do much with Visual Studio, especially if you have only the crash dump file, which records the snapshot of the process state by the time it was taken. It is fair to say that I make my living of debugging Microsoft and third-party's applications running on Windows. I fought as long as I could against using WinDBG, because it is not intuitive, the GUI is awful and it needs a lot of commands to do nesting analysis, nonetheless it was a lost battle. It is impossible to do serious post-mortem analysis without it.
I feel very comfortable now with this powerful tool, but I never forget how painful the learning curve was. I have discovered "Windows Debugging Notebook" just a few weeks ago and my first question was "where was this book when I needed it most"? Reading the book, though, showed me that I still have tricks to learn about using WinDBG and this is where the book strength is, it is a notebook from people who use WinDBG as a way of living. Even before the book was released, I have heard of Roberto Farah as the guy who wrote the tool to control WinDBG via powershell with meta-commands and he is sharing some of his experience in this book.
Things covered in this book (via commands and examples):
- Native memory analysis
- Breakpoints
- Data corruption analysis
- Symbols
- Stacks
- Heaps
- Threads
Things not covered in this book:
- Thorough dump analysis
- Managed debugging
- Advanced dump capture
- Kernel analysis
- Other WinDBG tools
You should buy this book if:
- You are a professional developer/tester with products deployed in the market that needs support
- You are an infrastructure engineer supporting third-party applications in your enterprise
- You are a security consultant looking for security wholes in applications
- You are a support engineer in general
- You plan to interview for an escalation support position at Microsoft
You should not buy this book if:
- You have had no exposure to WinDBG yet
- You are faint of heart