Errata for Memory Dump Analysis Anthology, Volume 1

First printing

--- Pages 5, 16, 649

Type:
    Spelling
Original text:
    PART 13: Miscelleneous
Reported by:
    pva
BugFix:
    PART 13: Miscellaneous

--- Pages 14, 592

Type:
    Spelling
Original text:
    Troubleshooting as Ddebugging
Reported by:
    author
BugFix:
    Troubleshooting as Debugging

--- Page 720

Type:
    Spelling
Original text:
    virtiual
Reported by:
    author
BugFix:
    virtual

--- Page 199

Type:
    Wrong terminology
Original text:
    Sometimes there is no public PDB file available for a module in a crash dump although we know they exist for different versions of the same module. The typical example is when we have a private PDB file loaded automatically and we need access to structure definitions, for example, _TEB or _PEB. In this case we need to force WinDbg to load an additional PDB file just to be able to use these structure definitions. This can be achieved by loading an additional module at a different address and forcing it to use another public PDB file. At the same time we want to keep the original module to reference the correct PDB file albeit the private one. [...] lm command shows that the symbol file was loaded and it was correct so perhaps it was the private symbol file
Reported by:
    Yong Seok, Hwang
BugFix:
    Sometimes there is no private PDB file available for a module in a crash dump although we know they exist for different versions of the same module. The typical example is when we have a public PDB file loaded automatically and we need access to structure definitions, for example, _TEB or _PEB. In this case we need to force WinDbg to load an additional PDB file just to be able to use these structure definitions. This can be achieved by loading an additional module at a different address and forcing it to use another private PDB file. At the same time we want to keep the original module to reference the correct PDB file albeit the public one. [...] lm command shows that the symbol file was loaded and it was correct so perhaps it was the public symbol file
Additional Notes:
    Definition of public and private PDB files