- Cover Page
- Title Page
- Copyright Page
- Summary of Contents
- Contents
- Preface
- Acknowledgements
- Part 1: Professional Crash Dump Analysis and Debugging
- Part 2: Crash Dump Analysis Patterns
- Divide by Zero (Kernel Mode)
- Fat Process Dump
- Blocked Queue
- Crash Signature
- Invalid Parameter (Process Heap)
- Hooking Level
- Embedded Comments
- Well-Tested Module
- String Parameter
- Environment Hint
- Dual Stack Trace
- Blocking Module
- Wait Chain (Window Messaging)
- Wait Chain (Named Pipes)
- Top Module
- Dialog Box
- Technology-Specific Subtrace (COM Interface Invocation)
- Livelock
- Semantic Structure (PID.TID)
- Instrumentation Side Effect
- Directing Module
- Stack Overflow (Software Implementation)
- Data Correlation
- Truncated Stack Trace
- Least Common Frame
- Self-Diagnosis (Kernel Mode)
- Technology-Specific Subtrace (Dynamic Memory)
- Module Hint
- Custom Exception Handler (Kernel Space)
- No Data Types
- Cloud Environment
- Version-Specific Extension
- Multiple Exceptions (Managed Space)
- Blocking File
- Quiet Dump
- Pleiades
- Thread Age
- Unsynchronized Dumps
- Coupled Modules
- Managed Stack Trace
- Problem Vocabulary
- Activation Context
- Stack Trace Set
- Special Thread (.NET CLR)
- Dynamic Memory Corruption (Managed Heap)
- Stack Trace Collection (Managed Space)
- Duplicate Extension
- Deadlock (Managed Space)
- Caller-n-Callee
- Handled Exception (User Space)
- Handled Exception (.NET CLR)
- Execution Residue (Managed Space)
- Annotated Disassembly (JIT .NET code)
- Wait Chain (Mutex Objects)
- Inline Function Optimization (Managed Code)
- Technology-Specific Subtrace (JIT .NET Code)
- Double IRP Completion
- Part 3: Pattern Interaction
- Main Thread, Self-Diagnosis, Window Message Chain, Blocking Module, Ubiquitous Component, Dual Stack Trace, Pipe Wait Chain and Coupled Machines
- Abridged Dump, Embedded Comment, Spiking Thread, Incorrect Stack Trace and Top Module
- Stack Trace Collection, Message Box, Self-Diagnosis, Version-Specific Extension, Managed Stack Trace and Managed Code Exception
- Part 4: Unified and Generative Debugging
- Part 5: A Bit of Science and Philosophy
- On Memory Perspectives
- Orbifold Memory Space
- Notes on Memoidealism
- M->analysis
- Memiosphere
- On Memory-Time vs. Space-Time
- The Will to Be Memorized
- The Trinity of Memory Worldview
- Uses of Memoretics
- Crossdisciplinary Memoretics as Interdisciplinary Science
- Private Property on Memory Spaces
- Coarse vs. Fine Grained DNA of Software Behavior
- Part 6: Fun with Crash Dumps
- Music for Debugging
- Debugging Joke
- Memory Dump Barcodes
- MessageBox at Dublin Zoo
- CDB for Kids
- Snow Spike Residue
- Second Snowfall Spike in Dublin
- MMXI
- Happy New Year and Decade of Debugging 0×7DB - 0×7E4!
- Do Security Professionals Dream?
- Debugging Slang
- Mad OS and other Publishing Blunders
- The Ultimate Debugger's Desk
- Memceptions: Flags and Handles are Everywhere!
- Computer Memory Monsters
- On President's Daily Briefs (PDBs)
- The First Evidence for Process Resurrection
- Vacuum Pages
- WinDbg Command on Certificate
- Pleasing WinDbg SOS Extension
- Airport Terminal Services Incident
- Philosophical Self-Interview
- Part 7: A Bit of Religion
- Part 8: Software Trace Analysis
- Part 9: Software Trace Analysis Patterns
- Part 10: Software Troubleshooting and Debugging
- Part 11: Software Victimology
- Part 12: Art
- Part 13: Miscellaneous
- Part 14: Intelligence Analysis
- Appendix
- Index of WinDbg Commands
- Cover Images
PART 11: Software Victimology
Function Activity Theory
Borrowing routine activity theory97 (RAT) from criminology we would like to introduce the similar approach to abnormal software behavior with patterning activities that adds additional unmotivated offenders to combine malware (software rats) with unintentional ordinary common bugware:
The application of RAT to software can be metaphorically named as Function Activity Theory (FAT).
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.