Debugging performance issues, memory issues and crashes in .net applications rev
Download as pptx, pdf0 likes541 views
This document summarizes tools and techniques for debugging performance issues, memory issues, and crashes in .NET applications. It discusses gathering memory dumps, using SOS.dll to analyze dumps, setting symbols, identifying high CPU vs waiting issues, tracking exceptions, finding memory leaks, and garbage collection. The goal is to provide resources for debugging various common .NET problems.
1 of 18
Download to read offline
Ad
Recommended
Common asp.net production issues rev
Common asp.net production issues revTess Ferrandez This document discusses common ASP.NET production issues including performance issues, crashes, exceptions, and high memory usage. It provides recommendations for troubleshooting each type of issue such as getting memory dumps, looking at threads and stacks, and using debugging tools. The key tools mentioned are BuggyBits, Debugging Tools for Windows, SOS.dll, Task Manager, Visual Studio Team System Test, TinyGet, and Performance Monitor.
.Net debugging 2017
.Net debugging 2017Tess Ferrandez This document discusses techniques for debugging .NET applications using memory dumps. It describes how to generate memory dumps using Task Manager, ProcDump, and Debug Diagnostics. It then explains how to analyze dumps using WinDbg, Debug Diagnostics, and Visual Studio. Specific issues covered include crashes, performance problems, and memory leaks. Automated analysis of dumps is demonstrated using CLRMD.
Perf by design
Perf by designTess Ferrandez This document contains summaries from two Microsoft architects, Rico Mariani and Vance Morrison. Rico Mariani provides contact information and links to his blog and other resources. Vance Morrison discusses techniques for measuring performance, analyzing memory usage, and leveraging parallelism and concurrency. He provides examples using Stopwatch, Process Explorer, tasks, futures, Parallel.For, and PLINQ. Related sessions at the conference on diagnostics, performance, memory profiling, and parallel programming are also listed.
C# to python
C# to pythonTess Ferrandez The document outlines key lessons learned by a software engineer transitioning from C# to Python, emphasizing the importance of code reuse, readability, maintainability, and utilizing Python's flexible coding paradigms. It covers best practices in structuring projects, adopting a clean development environment, and employing testing frameworks like pytest. Additionally, it highlights the significance of argument parsing with click and provides examples of using Python for machine learning and data processing tasks.
Memory Dump
Memory Dumpniteshitimpulse This document provides information about memory dumps in Windows, including where they are located, common causes of crashes that result in dumps, and basic analysis of dumps. Memory dumps contain crash information that can help determine why Windows crashed. There are different types of dumps, with full dumps containing the most information and mini dumps being default. Symbol files are needed to map addresses in dumps to function and variable names. Manual dumps can be generated by adding a registry key and pressing Ctrl+Scroll Lock at startup.
Crash dump analysis - experience sharing
Crash dump analysis - experience sharingJames Hsieh The automatic analysis fails because it cannot find the correct symbols. Let's try to reconstruct the crash context manually.
Windows Crash Dump Analysis
Windows Crash Dump AnalysisMicrosoft TechNet - Belgium and Luxembourg This document provides an overview of analyzing Windows crashes. It discusses introducing the Driver Verifier tool to identify code defects in drivers, using kernel debuggers to view crash dumps and perform basic crash analysis, and advanced debugging techniques like attaching a kernel debugger for debugging initialization failures. The document also covers the author's experience of 7 years at Microsoft and 3 years at Digital Equipment Corporation, as well as instructor experience with David Solomon.
Writing malware while the blue team is staring at you
Writing malware while the blue team is staring at youRob Fuller The document discusses strategies for writing malware in the context of the Collegiate Cyber Defense Competition (CCDC), where student teams defend networks against professional red team attacks. It covers the tactics for achieving persistence, evading detection by blue teams, and manipulating network communications, emphasizing the importance of speed and stealth. Tools and methods for creating malware, as well as considerations for both offensive and defensive teams during the competition, are outlined throughout the text.
44CON 2014 - Breaking AV Software
44CON 2014 - Breaking AV Software44CON The document discusses breaking and attacking antivirus software. It begins by introducing common features of antivirus engines like being written in C/C++ and supporting various file formats. It then discusses how installing antivirus software increases a system's attack surface and how antivirus engines can contain vulnerabilities. Specific examples of vulnerabilities found in antivirus products from Panda, ClamAV, and others are then presented, including multiple local privilege escalation issues found in Panda Global Protection 2013. Exploitation techniques for antivirus engines are also covered.
44CON London 2015 - 15-Minute Linux Incident Response Live Analysis
44CON London 2015 - 15-Minute Linux Incident Response Live Analysis44CON This document summarizes a talk on conducting a 15-minute Linux live analysis to determine if a system has been hacked with minimal disturbance. The talk discusses opening a case, collecting key system data like processes and users through scripted network listeners, and analyzing the data to look for signs of compromise. It also covers next steps like dead analysis if evidence of hacking is found. The goal is to quickly identify breaches while preserving evidence through an automated and mostly non-invasive process.
Crash (or) Hang dump analysis using WinDbg in Windows platform by K.S.Shanmug...
Crash (or) Hang dump analysis using WinDbg in Windows platform by K.S.Shanmug...Shanmuga KS The document discusses crash dump analysis using WinDbg, detailing the types of dump files, their creation, and the terminologies involved in analyzing them. It covers the impact of bugs on applications, methods for resolving crashes or hangs, and the use of WinDbg commands for debugging. Additionally, the document outlines the setup for postmortem debugging and provides case studies for practical application.
Audit
AuditMark Ellzey Thomas This document summarizes the Linux audit system and proposes improvements. It begins with an overview of auditd and how audit messages are generated and processed in the kernel. Issues with auditd's performance, output format, and filtering are discussed. An alternative approach is proposed that uses libmnl for netlink handling, groups related audit messages into JSON objects, applies Lua-based filtering, and supports multiple output types like ZeroMQ and syslog. Benchmark results show this rewrite reduces CPU usage compared to auditd. The document advocates for continued abstraction and integration of additional data sources while avoiding feature creep.
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationMichael Boman This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers -
[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers - Zoltan Balazs The document discusses the challenges of protecting against malware on web browsers through client-side solutions alone. It describes how the author was able to bypass protections in various internet security suites and anti-malware products by creating malicious browser extensions. While some vendors were able to address the issues, the document argues that client-side only solutions are fundamentally limited. It suggests focusing on server-side protections instead of seeking a "client-side elixir" for fully preventing malware.
Debugging ZFS: From Illumos to Linux
Debugging ZFS: From Illumos to LinuxSerapheim-Nikolaos Dimitropoulos The document discusses the transition of Delphix's product from illumos to Linux and the implications for debugging processes related to ZFS, highlighting challenges in postmortem debugging on Linux. It details the importance of crash dumps for understanding system failures and describes the functionalities and advantages of the SDB debugger. The document also compares different debugging tools available for Linux and emphasizes the need for a robust, extensible debugger capable of analyzing both live and crash state effectively.
How to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman This document discusses techniques that malware authors use to frustrate malware analysts, including inserting breakpoints, manipulating timing functions, exploiting Windows internals like debug flags and objects, anti-dumping methods, VM detection, and debugger-specific tricks. The author also announces a public malware repository and API called VXCage for sharing samples.
Introducing PS>Attack: An offensive PowerShell toolkit
Introducing PS>Attack: An offensive PowerShell toolkitjaredhaight The document discusses PowerShell, highlighting its use in system administration, automation, and information security. It introduces ps>attack, a tool designed to simplify offensive PowerShell usage with built-in commands for various tasks, and mentions its development tool for easy updates. The author encourages community contributions and feedback on future enhancements for the tool.
Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)
Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)Rob Fuller This document provides suggestions for free or low-cost defenses that can frustrate attackers, including enabling EMET, blocking Java user agents at the proxy, port forwarding honeypots, authenticated splash proxies, and deploying "evil canaries" to detect intruders on the network. It emphasizes logging, vulnerability scanning, and getting penetration testers and the help desk involved in security efforts. The document aims to demonstrate mostly free techniques that can significantly improve the security of an organization.
Экспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware TriagePositive Hack Days The document outlines a workshop on crowdsourced malware triage, detailing methods to analyze and manage malware threats using various online tools and strategies. It emphasizes the importance of effective triage in responding to malware detection and provides a step-by-step workflow for initial interaction, exploit analysis, payload extraction, and building indicators of compromise (IOCs). Participants are warned about the risks of sharing data and are encouraged to engage in collaborative feedback within the community.
Red Gate .NET Reflector 8.2.0.7
Red Gate .NET Reflector 8.2.0.7WendyLogan6 This document discusses Red Gate .NET Reflector 8.2.0.7, a program used to decompile and analyze .NET assemblies. It provides download links and instructions for installing the program, noting the default installation directories. It also contains references to using Reflector as a Visual Studio add-in and decompiling third party .NET code.
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationCTruncer The document discusses data exfiltration and the Egress-Assess framework, developed by Christopher Truncer and Steve Borosh, which simulates data exfiltration to enhance security assessments. It focuses on various tunneling protocols like ICMP, DNS, HTTP, and FTP for transferring data and includes methodologies for both red and blue team exercises. The goal is to prepare organizations against real-world threats by emulating attackers' strategies in a controlled environment.
6.Temp & Rand
6.Temp & Randphanleson This document discusses temporary files and randomness. It outlines issues with creating temporary files in insecure directories like /tmp, including name collisions and race conditions. It recommends using OS functions like mktemp, mkstemp, and mkdtemp to generate unique, unpredictable temporary file names. It also discusses the need for cryptographically secure random numbers and recommends using OS devices like /dev/urandom as sources of randomness.
Csi dot net (Hardcore .NET production debugging)
Csi dot net (Hardcore .NET production debugging)Jonne Kats This document discusses various debugging scenarios for .NET applications including hangs, memory leaks, and high CPU usage. It provides tips on diagnosing issues using performance counters, process dumps, and tools like SOS to analyze threads and memory. The key is to recreate the problem, collect a process dump, and investigate the dump to find the root cause.
Metasploit magic the dark coners of the framework
Metasploit magic the dark coners of the frameworkRob Fuller The document discusses installing and using the Metasploit framework. It describes the directory structure of Metasploit and provides examples of using resource scripts to automate attacks across multiple targets using the psexec module and Ruby scripts. Additional tips mentioned include using the gui and color options in Metasploit.
.NET Debugging Tips and Techniques
.NET Debugging Tips and TechniquesBala Subra Debugging is an important part of the software development process that helps developers write more reliable code. There are several tools available for debugging .NET applications, including Visual Studio and Debugging Tools for Windows. Some basic debugging tasks involve setting breakpoints, stepping through code, examining variables and call stacks, and understanding memory usage and threads. Postmortem debugging techniques like dump file analysis can help debug problems that occur in production environments where live debugging is not possible.
.Net Debugging Techniques
.Net Debugging TechniquesBala Subra The document discusses various .NET debugging techniques, including:
1. The importance of debugging and the tools available for debugging .NET applications, such as Visual Studio and Debugging Tools for Windows.
2. Basic debugging tasks like setting breakpoints, stepping through code, and examining variables and call stacks.
3. Advanced techniques like debugging managed code, threads, and memory issues.
Interview Question of Aspdotnet
Interview Question of AspdotnetMohitKumar1985 The CLR is the runtime that converts MSIL code to native machine code. It provides services like memory management, security, and exception handling. A CLR host loads the CLR into a process and creates application domains to execute user code. The CTS defines a common type system that facilitates cross-language integration and type safety. The CLS specifies rules for language integration so code written in different .NET languages can interoperate.
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting ClassRob Fuller The talk at DerbyCon 2011 by Chris Gates and Rob Fuller covers critical insights and practical strategies for penetration testing that aren't typically taught in formal classes. It discusses effective goal setting focused on client needs rather than merely achieving technical milestones like domain admin access, emphasizing the importance of testing the client's detection and response capabilities. The presenters also highlight the significance of post-exploitation tactics and tools, sharing practical advice to enhance efficiency and effectiveness in pentesting operations.
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...DevOpsDays Tel Aviv The document describes BrightSource Energy's process for analyzing crash dumps from their solar power plant control software. Originally, crashes were analyzed manually using debuggers like Visual Studio, which could take 10 minutes per dump and there were often dozens of dumps per day. They developed an automatic analysis workflow using the ClrMD NuGet package to analyze dumps. The script uses ClrMD to find the exception, call stack, and faulty component in each dump. It then alerts the relevant owner and creates a ticket in Redmine. This reduced analysis time from hours to seconds and allowed them to analyze around 1000 dumps in a single day.
Bsides Tampa Blue Team’s tool dump.
Bsides Tampa Blue Team’s tool dump.Alexander Kot This document provides an overview of various cybersecurity tools and concepts. It begins by explaining security information and event management (SIEM) tools and what logs they can ingest. It then discusses intrusion detection systems (IDS) versus intrusion prevention systems (IPS) and how they work. Next, it covers endpoint detection and response (EDR) tools, open source alternatives, and how they can provide threat hunting capabilities. The document concludes by discussing the importance of vulnerability assessment and patching systems to reduce risk.
More Related Content
What's hot (16)
44CON 2014 - Breaking AV Software
44CON 2014 - Breaking AV Software44CON The document discusses breaking and attacking antivirus software. It begins by introducing common features of antivirus engines like being written in C/C++ and supporting various file formats. It then discusses how installing antivirus software increases a system's attack surface and how antivirus engines can contain vulnerabilities. Specific examples of vulnerabilities found in antivirus products from Panda, ClamAV, and others are then presented, including multiple local privilege escalation issues found in Panda Global Protection 2013. Exploitation techniques for antivirus engines are also covered.
44CON London 2015 - 15-Minute Linux Incident Response Live Analysis
44CON London 2015 - 15-Minute Linux Incident Response Live Analysis44CON This document summarizes a talk on conducting a 15-minute Linux live analysis to determine if a system has been hacked with minimal disturbance. The talk discusses opening a case, collecting key system data like processes and users through scripted network listeners, and analyzing the data to look for signs of compromise. It also covers next steps like dead analysis if evidence of hacking is found. The goal is to quickly identify breaches while preserving evidence through an automated and mostly non-invasive process.
Crash (or) Hang dump analysis using WinDbg in Windows platform by K.S.Shanmug...
Crash (or) Hang dump analysis using WinDbg in Windows platform by K.S.Shanmug...Shanmuga KS The document discusses crash dump analysis using WinDbg, detailing the types of dump files, their creation, and the terminologies involved in analyzing them. It covers the impact of bugs on applications, methods for resolving crashes or hangs, and the use of WinDbg commands for debugging. Additionally, the document outlines the setup for postmortem debugging and provides case studies for practical application.
Audit
AuditMark Ellzey Thomas This document summarizes the Linux audit system and proposes improvements. It begins with an overview of auditd and how audit messages are generated and processed in the kernel. Issues with auditd's performance, output format, and filtering are discussed. An alternative approach is proposed that uses libmnl for netlink handling, groups related audit messages into JSON objects, applies Lua-based filtering, and supports multiple output types like ZeroMQ and syslog. Benchmark results show this rewrite reduces CPU usage compared to auditd. The document advocates for continued abstraction and integration of additional data sources while avoiding feature creep.
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationMichael Boman This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers -
[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers - Zoltan Balazs The document discusses the challenges of protecting against malware on web browsers through client-side solutions alone. It describes how the author was able to bypass protections in various internet security suites and anti-malware products by creating malicious browser extensions. While some vendors were able to address the issues, the document argues that client-side only solutions are fundamentally limited. It suggests focusing on server-side protections instead of seeking a "client-side elixir" for fully preventing malware.
Debugging ZFS: From Illumos to Linux
Debugging ZFS: From Illumos to LinuxSerapheim-Nikolaos Dimitropoulos The document discusses the transition of Delphix's product from illumos to Linux and the implications for debugging processes related to ZFS, highlighting challenges in postmortem debugging on Linux. It details the importance of crash dumps for understanding system failures and describes the functionalities and advantages of the SDB debugger. The document also compares different debugging tools available for Linux and emphasizes the need for a robust, extensible debugger capable of analyzing both live and crash state effectively.
How to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman This document discusses techniques that malware authors use to frustrate malware analysts, including inserting breakpoints, manipulating timing functions, exploiting Windows internals like debug flags and objects, anti-dumping methods, VM detection, and debugger-specific tricks. The author also announces a public malware repository and API called VXCage for sharing samples.
Introducing PS>Attack: An offensive PowerShell toolkit
Introducing PS>Attack: An offensive PowerShell toolkitjaredhaight The document discusses PowerShell, highlighting its use in system administration, automation, and information security. It introduces ps>attack, a tool designed to simplify offensive PowerShell usage with built-in commands for various tasks, and mentions its development tool for easy updates. The author encourages community contributions and feedback on future enhancements for the tool.
Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)
Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)Rob Fuller This document provides suggestions for free or low-cost defenses that can frustrate attackers, including enabling EMET, blocking Java user agents at the proxy, port forwarding honeypots, authenticated splash proxies, and deploying "evil canaries" to detect intruders on the network. It emphasizes logging, vulnerability scanning, and getting penetration testers and the help desk involved in security efforts. The document aims to demonstrate mostly free techniques that can significantly improve the security of an organization.
Экспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware TriagePositive Hack Days The document outlines a workshop on crowdsourced malware triage, detailing methods to analyze and manage malware threats using various online tools and strategies. It emphasizes the importance of effective triage in responding to malware detection and provides a step-by-step workflow for initial interaction, exploit analysis, payload extraction, and building indicators of compromise (IOCs). Participants are warned about the risks of sharing data and are encouraged to engage in collaborative feedback within the community.
Red Gate .NET Reflector 8.2.0.7
Red Gate .NET Reflector 8.2.0.7WendyLogan6 This document discusses Red Gate .NET Reflector 8.2.0.7, a program used to decompile and analyze .NET assemblies. It provides download links and instructions for installing the program, noting the default installation directories. It also contains references to using Reflector as a Visual Studio add-in and decompiling third party .NET code.
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationCTruncer The document discusses data exfiltration and the Egress-Assess framework, developed by Christopher Truncer and Steve Borosh, which simulates data exfiltration to enhance security assessments. It focuses on various tunneling protocols like ICMP, DNS, HTTP, and FTP for transferring data and includes methodologies for both red and blue team exercises. The goal is to prepare organizations against real-world threats by emulating attackers' strategies in a controlled environment.
6.Temp & Rand
6.Temp & Randphanleson This document discusses temporary files and randomness. It outlines issues with creating temporary files in insecure directories like /tmp, including name collisions and race conditions. It recommends using OS functions like mktemp, mkstemp, and mkdtemp to generate unique, unpredictable temporary file names. It also discusses the need for cryptographically secure random numbers and recommends using OS devices like /dev/urandom as sources of randomness.
Csi dot net (Hardcore .NET production debugging)
Csi dot net (Hardcore .NET production debugging)Jonne Kats This document discusses various debugging scenarios for .NET applications including hangs, memory leaks, and high CPU usage. It provides tips on diagnosing issues using performance counters, process dumps, and tools like SOS to analyze threads and memory. The key is to recreate the problem, collect a process dump, and investigate the dump to find the root cause.
Metasploit magic the dark coners of the framework
Metasploit magic the dark coners of the frameworkRob Fuller The document discusses installing and using the Metasploit framework. It describes the directory structure of Metasploit and provides examples of using resource scripts to automate attacks across multiple targets using the psexec module and Ruby scripts. Additional tips mentioned include using the gui and color options in Metasploit.
Similar to Debugging performance issues, memory issues and crashes in .net applications rev (20)
.NET Debugging Tips and Techniques
.NET Debugging Tips and TechniquesBala Subra Debugging is an important part of the software development process that helps developers write more reliable code. There are several tools available for debugging .NET applications, including Visual Studio and Debugging Tools for Windows. Some basic debugging tasks involve setting breakpoints, stepping through code, examining variables and call stacks, and understanding memory usage and threads. Postmortem debugging techniques like dump file analysis can help debug problems that occur in production environments where live debugging is not possible.
.Net Debugging Techniques
.Net Debugging TechniquesBala Subra The document discusses various .NET debugging techniques, including:
1. The importance of debugging and the tools available for debugging .NET applications, such as Visual Studio and Debugging Tools for Windows.
2. Basic debugging tasks like setting breakpoints, stepping through code, and examining variables and call stacks.
3. Advanced techniques like debugging managed code, threads, and memory issues.
Interview Question of Aspdotnet
Interview Question of AspdotnetMohitKumar1985 The CLR is the runtime that converts MSIL code to native machine code. It provides services like memory management, security, and exception handling. A CLR host loads the CLR into a process and creates application domains to execute user code. The CTS defines a common type system that facilitates cross-language integration and type safety. The CLS specifies rules for language integration so code written in different .NET languages can interoperate.
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting ClassRob Fuller The talk at DerbyCon 2011 by Chris Gates and Rob Fuller covers critical insights and practical strategies for penetration testing that aren't typically taught in formal classes. It discusses effective goal setting focused on client needs rather than merely achieving technical milestones like domain admin access, emphasizing the importance of testing the client's detection and response capabilities. The presenters also highlight the significance of post-exploitation tactics and tools, sharing practical advice to enhance efficiency and effectiveness in pentesting operations.
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...DevOpsDays Tel Aviv The document describes BrightSource Energy's process for analyzing crash dumps from their solar power plant control software. Originally, crashes were analyzed manually using debuggers like Visual Studio, which could take 10 minutes per dump and there were often dozens of dumps per day. They developed an automatic analysis workflow using the ClrMD NuGet package to analyze dumps. The script uses ClrMD to find the exception, call stack, and faulty component in each dump. It then alerts the relevant owner and creates a ticket in Redmine. This reduced analysis time from hours to seconds and allowed them to analyze around 1000 dumps in a single day.
Bsides Tampa Blue Team’s tool dump.
Bsides Tampa Blue Team’s tool dump.Alexander Kot This document provides an overview of various cybersecurity tools and concepts. It begins by explaining security information and event management (SIEM) tools and what logs they can ingest. It then discusses intrusion detection systems (IDS) versus intrusion prevention systems (IPS) and how they work. Next, it covers endpoint detection and response (EDR) tools, open source alternatives, and how they can provide threat hunting capabilities. The document concludes by discussing the importance of vulnerability assessment and patching systems to reduce risk.
Android memory analysis Debug slides.pdf
Android memory analysis Debug slides.pdfVishalKumarJha10 The document details a course on Android debugging and performance analysis, covering tools, techniques, and the internal workings of Android and its underlying Linux architecture. It outlines high-level and specific goals for participants, prerequisites for attending, key topics to be discussed, and provides an overview of available tools for debugging and performance monitoring. Additionally, it includes hands-on exercises and resources for further learning.
Production Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyBrian Lyttle This document provides an introduction to production debugging techniques. It discusses monitoring tools like Task Manager and Performance Monitor, debugging fundamentals like stack traces and crash dumps, protocol analysis, and remote debugging. The goal is to help developers effectively debug problems in production environments using tools that don't require a development workstation.
A client-side vulnerability under the microscope!
A client-side vulnerability under the microscope!Nelson Brito The document discusses the challenges of understanding and addressing client-side vulnerabilities, specifically a use-after-free vulnerability affecting Microsoft Internet Explorer known as CVE-2008-4844. It emphasizes the importance of reverse engineering to gather valuable information and successfully exploit, detect, prevent, and mitigate such vulnerabilities. The author presents practical checklists for vulnerability preparation and analysis, highlights public tools available for reverse engineering, and provides an overview of the exploitation process.
Evolution of computers aaaaaaaaaaaaaaaaaaaaaaaaaaa
Evolution of computers aaaaaaaaaaaaaaaaaaaaaaaaaaadilshanweeraratnelk The document provides an overview of operating system internals, focusing on the evolution, functionality, and structure of operating systems. It discusses key tasks such as process management, memory management, and device management, along with the historical progression from early systems to modern implementations like Windows and Linux. Additionally, it touches on operating system architectures, including monolithic and microkernel structures.
How to Build a Pure Evil Magento Module
How to Build a Pure Evil Magento ModuleAOE The document discusses the risks associated with installing Magento modules, emphasizing the importance of avoiding malicious or poorly designed code. It encourages developers to improve their practices and take security seriously, while also highlighting the complexities of managing dependencies and version control. Ultimately, it stresses the importance of thoroughly reviewing and testing code before deployment to ensure a secure and reliable environment.
Introductiontoasp netwindbgdebugging-100506045407-phpapp01
Introductiontoasp netwindbgdebugging-100506045407-phpapp01Camilo Alvarez Rivera This document introduces debugging ASP.NET applications with WinDBG and dump analysis. It discusses collecting dump files from ASP.NET processes using tools like ADPlus and Debug Diagnostic Tool. It then explains analyzing these dumps in WinDBG using commands and extensions like SOS and PSSCOR2 to diagnose issues like crashes, slow performance, hangs and memory leaks. The document provides an overview of common debugging scenarios, techniques and commands to get started with debugging ASP.NET applications offline using memory dumps.
Linux Recovery
Linux RecoveryVíctor Capetillo This document discusses using Linux to recover data from failed Windows systems by creating disk images that can be mounted and accessed. Key steps include using dd to create an image file, mounting the image to access files, and copying recovered files to another location or burning to CD. More advanced tools like The Coroner's Toolkit can help if the filesystem is damaged. Safety precautions are advised when dealing with potentially failing drives.
Mind the gap - Troopers 2016
Mind the gap - Troopers 2016Casey Smith This document summarizes ways that application whitelisting defenses can be circumvented without using exploits. It begins by exploring weaknesses in default Windows application whitelisting rules, such as trusting all signed Microsoft binaries. It then demonstrates how utilities like InstallUtil.exe and RegAsm.exe that are installed by default and trusted can be abused to bypass whitelisting and execute malicious payloads without exploits. The document argues that while whitelisting provides benefits, it has gaps that attackers can leverage through "living off the land" tactics and misusing trusted applications. It concludes by discussing emerging strengths in whitelisting through technologies like Windows 10 Device Guard but notes scripting engines and memory injection remain challenges.
Forensic Memory Analysis of Android's Dalvik Virtual Machine
Forensic Memory Analysis of Android's Dalvik Virtual MachineSource Conference This document summarizes a presentation on analyzing the memory of the Dalvik virtual machine used in Android. It discusses acquiring Android phone memory, locating key data structures in Dalvik like loaded classes and instance fields, and analyzing specific Android applications to recover data like call histories, text messages, browser sessions, and wireless network information. The goal is to extract runtime information and data from Android apps through memory forensics.
the productive programer: mechanics
the productive programer: mechanicselliando dias This document contains notes from a presentation given by Neal Ford on productivity techniques for programmers. Some key topics covered include: accelerating work by using keyboard shortcuts, search over navigation, reducing distractions, applying DRY principles, and automating repetitive tasks. Ford advocates focusing on acceleration, focus, and automation to work more efficiently. He provides many examples of tools and techniques to improve productivity.
LogChaos: Challenges and Opportunities of Security Log Standardization
LogChaos: Challenges and Opportunities of Security Log StandardizationAnton Chuvakin Dr. Anton Chuvakin discusses the critical need for standardization in security logs, highlighting the chaos caused by inconsistent logging practices across various systems and the historical failures in establishing effective logging standards. He introduces the Common Event Expression (CEE), envisioning it as a comprehensive framework that provides consistent definitions, syntax, and transport mechanisms for logs, which could enhance log management and security analysis. The presentation concludes with a call to action for the adoption and development of the CEE standard to mitigate log chaos.
SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012Rian Yulian This document outlines a 13-step process for analyzing a system for signs of malware infection. The steps include: reducing evidence files, performing antivirus checks, searching for indicators of compromise, automated and manual memory analysis, checking for persistence mechanisms, entropy/packing analysis, reviewing event logs, timeline analysis, third-party hash lookups, and analyzing MFT and file time anomalies. The goal is to methodically narrow down thousands of files to the few most likely to be malware through successive rounds of filtering and examination.
EPM Logs 101 - Hyperion Focus 17
EPM Logs 101 - Hyperion Focus 17Datavail The document provides an overview of logging facilities in EPM (Enterprise Performance Management) systems, detailing log file formats, levels of detail, retention strategies, and tools for reading logs. It emphasizes the importance of managing log data for efficiency and troubleshooting while presenting tools like the Accelatis log analyzer for effective log management. Additionally, it highlights the expertise of Datavail in supporting Oracle and Hyperion applications across various industries.
Ad
More from Tess Ferrandez (11)
funwithalgorithms.pptx
funwithalgorithms.pptxTess Ferrandez Tess Ferrandez is an expert in data science and algorithms. She has skills in computer vision, machine learning, and cloud computing. Some of her projects include extracting cells by color range from images, scheduling jobs efficiently on Azure batch, and tracking the movement of objects in videos.
Debugging .NET apps
Debugging .NET appsTess Ferrandez The document discusses issues related to high memory usage and poor performance in ASP.NET applications, primarily on Azure and Linux environments. It includes references to debugging tools like Windbg, Visual Studio, and .NET diagnostics to investigate memory issues and crashes. Key concepts such as the large object heap and garbage collection are also mentioned as potential areas of concern.
CSI .net core - debugging .net applications
CSI .net core - debugging .net applicationsTess Ferrandez Tess Ferrandez, a Microsoft software engineer, presented on diagnosing and troubleshooting issues with .NET Core such as high memory usage, crashes, exceptions, and poor performance on Linux, macOS, and Azure. The presentation covered tools for debugging memory issues, including dotnet counters, dotnet gcdump, and dotnet dump. It also provided demonstrations of memory issues, high CPU usage, hangs, and crashes along with the recommended tools to diagnose each type of issue.
Fun421 stephens
Fun421 stephensTess Ferrandez This document summarizes garbage collection in the .NET Common Language Runtime (CLR). It covers the basics of generations and segments, how allocation and collection work, and different flavors of GC like concurrent and server GC. It also discusses pinning, tools for analyzing GC, and challenges for 64-bit systems. The goal of generational GC is to improve efficiency by focusing collection on younger object generations where most objects die, in order to minimize pause times during full collections.
Facenet - Paper Review
Facenet - Paper ReviewTess Ferrandez The document discusses Facenet, a unified embedding approach for face recognition and clustering developed by Google in 2015. It covers the limitations of previous methods, the architecture of the CNN used, and the implementation of triplet loss for training the model. Additionally, it highlights the datasets utilized for evaluating the system, particularly the Labeled Faces in the Wild (LFW) dataset.
AI and Ethics - We are the guardians of our future
AI and Ethics - We are the guardians of our futureTess Ferrandez The document discusses the ethical implications and responsibilities of engineers in the development of AI technologies, particularly in gang crime classification and facial recognition systems. It highlights issues of bias, societal impact, and the need for accountability and fairness in algorithmic decision-making. The central theme emphasizes that engineers must recognize their role as guardians of the future, ensuring the technology is used responsibly.
Deep learning and computer vision
Deep learning and computer visionTess Ferrandez The document discusses practical applications of deep learning in various fields such as cancer detection and shoplifting prevention. It outlines techniques such as neural networks, model training, and data augmentation, while emphasizing the importance of understanding business needs and ethical concerns. Additionally, it highlights challenges posed by limited sample sizes and biases in machine learning models.
A practical guide to deep learning
A practical guide to deep learningTess Ferrandez This document provides an overview of deep learning concepts including linear regression, neural networks, convolutional neural networks, transfer learning, and generative adversarial networks. It discusses techniques such as data augmentation, dropout, and pretrained models. It also covers visualizing networks, one shot learning, and using cognitive services for computer vision tasks. The goal is to provide practical guidance on deep learning topics and code examples.
Notes from Coursera Deep Learning courses by Andrew Ng
Notes from Coursera Deep Learning courses by Andrew NgTess Ferrandez My notes from the excellent Coursera specialization by Andrew Ng
A developers guide to machine learning
A developers guide to machine learningTess Ferrandez This document contains information about various machine learning algorithms including linear regression, decision trees, naive bayes, logistic regression, and neural networks. It also contains a table with details about superheroes such as their name, birth year, abilities, and alignment.
My bot has a personality disorder
My bot has a personality disorderTess Ferrandez The document discusses the design and functional principles of chatbots, comparing them to app design and emphasizing the importance of user-friendly interactions. Key elements include conversational flow, UI design, and the necessity for bots to ask clear, concise questions while maintaining brand personality. It highlights that a bot's success hinges on its ability to solve problems rather than its intelligence or use of natural language.
Ad
Recently uploaded (20)
CodeCleaner: Mitigating Data Contamination for LLM Benchmarking
CodeCleaner: Mitigating Data Contamination for LLM Benchmarkingarabelatso The pdf-version of "CodeCleaner: Mitigating Data Contamination for LLM Benchmarking" presented in Internetware 2025.
Canva Pro Crack Free Download 2025-FREE LATEST
Canva Pro Crack Free Download 2025-FREE LATESTgrete1122g 🌍📱👉COPY & PASTE LINK >> https://click4pc.com/after-verification-click-go-to-download-page/
Canva Pro PC Crack is a practical design app to create beautiful montages and compositions with a lot of resources on the platform.
Streamlining CI/CD with FME Flow: A Practical Guide
Streamlining CI/CD with FME Flow: A Practical GuideSafe Software Join us as we explore how to deploy a fault-tolerant FME Flow installation using FME Flow’s IaC templates alongside Terraform, AWS, and GitHub in a CI/CD workflow. This session will also cover how to leverage FME’s CI/CD capabilities for FME Flow upgrades and FME object migration between different environments, ensuring seamless automation and scalability.
CodeCleaner: Mitigating Data Contamination for LLM Benchmarking
CodeCleaner: Mitigating Data Contamination for LLM Benchmarkingarabelatso This is the pdf-version slides for the presentation "CodeCleaner: Mitigating Data Contamination for LLM Benchmarking" in Internetware 2025.
Sysinfo OST to PST Converter Infographic
Sysinfo OST to PST Converter InfographicSysInfo Tools The SysInfo OST to PST Converter is the most secure software to perform the OST to PST conversion. It converts OST files into various formats, including MBOX, EML, EMLX, HTML, and CSV, with 100% accuracy. Along with that, it imports OST files into different email clients like Office 365 and G Suite.
visit: https://www.sysinfotools.com/ost-to-pst-converter.php
Modern Platform Engineering with Choreo - The AI-Native Internal Developer Pl...
Modern Platform Engineering with Choreo - The AI-Native Internal Developer Pl...WSO2 Building and operating internal platforms has become increasingly complex — sprawling toolchains, rising costs, and fragmented developer experiences are slowing teams down. It’s time for a new approach.
This slide deck explores modern platform engineering with Choreo, WSO2’s AI-native Internal Developer Platform as a Service. Discover how you can streamline platform operations, empower your developers, and drive faster innovation — all while reducing complexity and cost.
Learn more: https://wso2.com/choreo/platform-engineering/
University Campus Navigation for All - Peak of Data & AI
University Campus Navigation for All - Peak of Data & AISafe Software Navigating around the 1000 acres of UBC Vancouver’s campus may look like a walk in a park, but when you’re a student in a wheelchair trying to find a powered door to the class you’re late for, it is not all that scenic. UBC’s GIS team will share the journey from the original 2003 static map application to the current web application built using FME and the ArcGIS JavaScript API. There were two main goals with this new application: 1. Enable the UBC community to easily interact with and navigate the campus by walking, cycling and accessible means (which include mobility constraints such as steep slopes, stairs, and doors that are not powered). 2. Provide high quality geospatial data that is authoritative and updated using FME to reflect existing conditions on campus including road, sidewalk or building closures for construction. We will cover the unique challenges in creating a navigation application which offers features that Google Maps cannot at the scale of a University campus. Door to door navigation, avoiding stairs and steep slopes, navigating to accessible entrances and up to date construction barriers are some of the features we will discuss.
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?Hassan Abid As mobile hardware becomes more powerful, the promise of running advanced AI directly on-device is closer than ever. With Google’s latest on-device model Gemini Nano, accessible through the new ML Kit GenAI APIs and AI Edge SDK, alongside the open-source Gemma-3n models, developers can now integrate lightweight, multimodal intelligence that works even without an internet connection. But does this mean we no longer need cloud-based AI? This session explores the practical trade-offs between on-device and cloud AI for mobile apps.
OpenChain Webinar - AboutCode - Practical Compliance in One Stack – Licensing...
OpenChain Webinar - AboutCode - Practical Compliance in One Stack – Licensing...Shane Coughlan OpenChain Webinar - AboutCode - Practical Compliance in One Stack – Licensing, Vulnerabilities, and More
From Data Preparation to Inference: How Alluxio Speeds Up AI
From Data Preparation to Inference: How Alluxio Speeds Up AIAlluxio, Inc. Alluxio Webinar
June 17, 2025
For more Alluxio Events: https://www.alluxio.io/events/
Speaker:
Jingwen Ouyang (Sr. Product Manager @ Alluxio)
In this talk, Jingwen Ouyang, Senior Product Manager at Alluxio, will share how Alluxio make it easy to share and manage data from any storage to any compute engine in any environment with high performance and low cost for your model training, model inference, and model distribution workload.
AI for PV: Development and Governance for a Regulated Industry
AI for PV: Development and Governance for a Regulated IndustryBiologit AI for pharmacovigilance: Development and Governance for a Regulated Industry.
A survey of regulatory guidance for the use of artificial intelligence in pharmacovigilance and best practices for its safe implementation with the Biologit literature platform as case study.
Why Edge Computing Matters in Mobile Application Tech.pdf
Why Edge Computing Matters in Mobile Application Tech.pdfIMG Global Infotech This PDF explores the critical role of edge computing in modern mobile application technology. Learn how edge enhances app speed, reduces latency, improves data privacy, and supports real-time performance. Ideal for developers, tech strategists, and mobile innovators looking to stay ahead in the evolving mobile ecosystem.
Advance Doctor Appointment Booking App With Online Payment
Advance Doctor Appointment Booking App With Online PaymentAxisTechnolabs https://www.slideshare.net/slideshow/advance-doctor-appointment-booking-app-with-online-payment/280654375
Complete Guideliness to Build an Effective Maintenance Plan.ppt
Complete Guideliness to Build an Effective Maintenance Plan.pptQualityzeInc1 Building an effective maintenance plan with Qualityze Maintenance Management Software begins with a structured asset assessment. The software enables organizations to catalog all equipment, tools, and infrastructure, assigning detailed profiles that include manufacturer details, maintenance history, and risk categories. This centralization ensures accurate tracking and allows maintenance teams to prioritize assets based on criticality, condition, and usage frequency.
Once assets are categorized, Qualityze helps define maintenance strategies—such as preventive, predictive, or condition-based approaches—based on industry best practices. With customizable templates and workflows, organizations can schedule recurring maintenance tasks, set alert notifications for due services, and automate work order creation. This proactive scheduling reduces equipment downtime, boosts productivity, and ensures regulatory compliance.
Qualityze also simplifies documentation and reporting. All maintenance activities are recorded with time stamps, technician credentials, and task details. This not only improves accountability but also aids in audits and inspections. The software's real-time dashboards and analytics provide visibility into maintenance performance, helping decision-makers identify trends, gaps, and opportunities for process improvements.
Finally, the Qualityze system promotes team collaboration and compliance. Integrated training modules ensure technicians are certified for assigned tasks, while role-based access controls protect data integrity. With its cloud-based architecture, Qualityze enables remote access, making it ideal for multi-site operations and mobile maintenance teams. The result is a robust, data-driven maintenance plan that extends asset life, reduces risk, and supports continuous improvement.
HYBRIDIZATION OF ALKANES AND ALKENES ...
HYBRIDIZATION OF ALKANES AND ALKENES ...karishmaduhijod1 Hybridization happens when atomic orbitals mix to form a new atomic orbital.
Automated Testing and Safety Analysis of Deep Neural Networks
Automated Testing and Safety Analysis of Deep Neural NetworksLionel Briand Keynote address at Internetware 2025, co-located with FSE 2025
Decipher SEO Solutions for your startup needs.
Decipher SEO Solutions for your startup needs.mathai2 A solution deck that gives you an idea of how you can use Decipher SEO to target keywords, build authority and generate high ranking content.
With features like images to product you can create a E-commerce pipeline that is optimized to help your store rank.
With integrations with shopify, woocommerce and wordpress theres a seamless way get your content to your website or storefront.
View more at decipherseo.com
Introduction to Agile Frameworks for Product Managers.pdf
Introduction to Agile Frameworks for Product Managers.pdfAli Vahed As a Product Manager, having a solid understanding of Agile frameworks is essential, whether you are joining an established team or helping shape a new one.
Agile is not just a delivery method; it is a mind set that directly impacts how products are built, iterated, and brought to market. Knowing the strengths and trade-offs of each framework enables you to collaborate more effectively with teams, foster alignment, and drive meaningful outcomes.
Simply put, Agile fluency helps you lead with clarity in fast-paced, ever-changing environments.
The next few slides are simple ‘STUDY CARDS’ to help you learn or refresh your understanding of a few popular Agile frameworks.
From Code to Commerce, a Backend Java Developer's Galactic Journey into Ecomm...
From Code to Commerce, a Backend Java Developer's Galactic Journey into Ecomm...Jamie Coleman In a galaxy not so far away, a Java developer advocate embarks on an epic quest into the vast universe of e-commerce. Armed with backend languages and the wisdom of microservice architectures, set out with us to learn the ways of the Force. Navigate the asteroid fields of available tools and platforms; tackle the challenge of integrating location-based technologies into open-source projects; placate the Sith Lords by enabling great customer experiences.
Follow me on this journey from humble Java coder to digital marketplace expert. Through tales of triumph and tribulation, gain valuable insights into conquering the e-commerce frontier - such as the different open-source solutions available - and learn how technology can bring balance to the business Force, large or small. May the code be with you.
Debugging performance issues, memory issues and crashes in .net applications rev
- 2. 2 Debugging Performance Issues, Memory Issues and Crashes in .net Applications Tess Ferrandez - Norlander Support Escalation Engineer Microsoft Session Code: TLA05-IS
- 3. 3 Tools and Resources BuggyBits from http://blogs.msdn.com/Tess Debugging Tools for Windows SOS.dll Process Explorer Visual Studio Team System Test TinyGet Performance Monitor Our brains
- 4. 4 Memory Dumps Mini Dumps Module Information Threads Information Stacks Full Dumps Full memory and handle data Unloaded module information Thread Time info adplus –crash –pn <processname.exe> adplus –hang –pn <processname.exe>
- 5. 5 SOS.dll 1.1 2.0 For a list of the commands available in sos.dll run !sos.help .load clr10sos .cordll -u –lp <framework dir> .load <framework dir>sos.dll or .loadby sos mscorwks.dll
- 6. 6 Symbols Symbols are used to translate an address into a more understandable function or variable name WinDbg uses deferred symbol loading Three types of symbols Private Public Export
- 7. 7 Symbols (cont.) Symbols can be stored directly in directories or on symbol servers Symbols are not neccesary to translate .NET function names .sympath srv*downstreamstore*http://msdl.microsoft.com/download /symbols Or .symfix downstreamstore
- 8. 8 Performance issues Low CPU => waiting for external resources and/or locks High CPU => busy server, infinite loops or high CPU in GC
- 9. 9 Performance issues High or Low CPU? Get memory dump(s) Look at threads VSTS Test and Profiling is good if you can repro in a test environment
- 10. 10 Crashes Recycling Unhandled exceptions Stack overflow Fatal Execution Engine Exceptions Heap Corruption Out of memory
- 11. 11 Crashes and Exceptions Check out the eventviewer Disable recycling options Get memory dump(s) Look at faulting stacks or logs if neccesary Use TrackClr.cfg to track exceptions during testing
- 12. 12 High memory usage and OOM Caching and Session State “Unexpected roots” Blocked finalizer DataSet serialization Large viewstate Assembly leaks with XmlSerializer Pinned objects
- 13. 13 High memory usage and OOM What are you leaking? (native, .net, assemblies) Take multiple dumps when memory is raising and compare Check the finalizer Check the Large object heap Try to group “leaking” objects Figure out why they are sticking around (rooted)
- 14. 14 Garbage collection Gen 0 Gen 1 Mark Sweep Compact Gen 2 3 1 2 5 6 7 9 8 10 4 11 12 13 14 15 16
- 15. 15 Remember... There are tools out there to track down these types of issues http://blogs.msdn.com/Tess Track exceptions during testing with TrackCLR.cfg Debugging Tools for Windows
- 16. www.microsoft.com/teched Tech·Talks Tech·Ed Bloggers Live Simulcasts Virtual Labs http://microsoft.com/msdn Developer’s Kit, Licenses, and MORE! Resources for Developers
- 17. Complete an evaluation on CommNet and enter to win! 1 Year Subscription!
- 18. 18 © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.