Debugging Tools on Windows

Windows Error Reporting (WER): Collecting User-Mode Dumps
http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

• DumpFolder, REG_EXPAND_SZ, %LOCALAPPDATA%\CrashDumps
• DumpCount, REG_DWORD, 10
• DumpType, REG_DWORD, 1 (1: mini dump; 2: full dump;)

Per-application setting:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApplication.exe

* Need to restart (or log out and log in again) to make the change effective.


Enabling Postmortem Debugging - register a debugger (WinDBG, CDB, ntsd)
http://msdn.microsoft.com/en-us/library/windows/desktop/ff542967%28v=vs.85%29.aspx


Tools comparision matrix (ADPlus; WER; CDB/WinDbg; UserDump)
http://msdn.microsoft.com/en-us/library/windows/desktop/ff539117%28v=vs.85%29.aspx


More tools in the toolset
http://msdn.microsoft.com/en-us/library/windows/desktop/ff543998%28v=vs.85%29.aspx


Application Verifier
http://msdn.microsoft.com/en-us/library/windows/desktop/dd371695%28v=vs.85%29.aspx

Restart of the application is needed - after it is added into AppVerifier.

WinDbg

bank security token - reverse engineering

The original source is obviously unavailable now.

Just saved for later reading/reference.