Memory Analysis Patterns
Multiple Exceptions (user mode) - Modeling Example
Multiple Exceptions (kernel mode)
Dynamic Memory Corruption (process heap)
Dynamic Memory Corruption (kernel pool)
False Positive Dump
Lateral Damage
Optimized Code
Invalid Pointer (general)
NULL Pointer (code)
NULL Pointer (data)
Inconsistent Dump
Hidden Exception
Deadlock (critical sections)
Deadlock (executive resources)
Deadlock (mixed objects, user space)
Deadlock (LPC)
Deadlock (mixed objects, kernel space)
Changed Environment
Incorrect Stack Trace
OMAP Code Optimization
No Component Symbols
Insufficient Memory (committed memory)
Insufficient Memory (handle leak)
Insufficient Memory (kernel pool)
Insufficient Memory (PTE)
Insufficient Memory (virtual memory)
Insufficient Memory (physical memory)
Insufficient Memory (control blocks)
Spiking Thread
Module Variety
Stack Overflow (kernel mode)
Stack Overflow (user mode)
Managed Code Exception
Truncated Dump
Waiting Thread Time (kernel dumps)
Waiting Thread Time (user dumps)
Memory Leak (process heap) - Modeling Example
Memory Leak (.NET heap)
Missing Thread
Unknown Component
Double Free (process heap)
Double Free (kernel pool)
Coincidental Symbolic Information
Stack Trace
Virtualized Process (WOW64)
Stack Trace Collection
Coupled Processes (strong)
Coupled Processes (weak)
Coupled Processes (semantics)
High Contention (executive resources)
High Contention (critical sections)
High Contention (processors)
Accidental Lock
Passive Thread (user space)
Passive System Thread (kernel space)
Main Thread
Busy System
Historical Information
IRP Distribution Anomaly
Local Buffer Overflow
Early Crash Dump
Hooked Functions (user space)
Hooked Functions (kernel space)
Custom Exception Handler
Special Stack Trace
Manual Dump (kernel)- Manual Dump (process)
- Wait Chain (general)
- Wait Chain (critical sections)
- Wait Chain (executive resources)
- Wait Chain (thread objects)
- Wait Chain (LPC/ALPC)
- Wait Chain (process objects)
- Corrupt Dump
- Dispatch Level Spin
- No Process Dumps
- No System Dumps
- Suspended Thread
- Special Process
- Frame Pointer Omission
- False Function Parameters
- Message Box
- Self-Dump
- Blocked Thread (software)
- Blocked Thread (hardware)
- Zombie Processes
- Wild Pointer
- Wild Code
- Hardware Error
- Handle Limit (GDI)
- Missing Component (general)
- Missing Component (static linking, user mode)
- Execution Residue
- Optimized VM Layout
- Invalid Handle
- Overaged System
- Thread Starvation (realtime priority)
- Thread Starvation (normal priority)
- Duplicated Module
- Not My Version (software)
- Not My Version (hardware)
- Data Contents Locality
- Nested Exceptions (unmanaged code)
- Nested Exceptions (managed code)
- Affine Thread
- Self-Diagnosis
- Inline Function Optimization
- Critical Section Corruption
- Lost Opportunity
- Young System
- Last Error Collection
- Hidden Module
- Data Alignment (page boundary)
- C++ Exception
- Divide by Zero (user mode)
- Swarm of Shared Locks
- Process Factory
- Paged Out Data
- Semantic Split
- Pass Through Function
- JIT Code (.NET)
- Ubiquitous Component
- Nested Offender
- Virtualized System
- Effect Component
- Well-Tested Function
- Mixed Exception
- Random Object
- Missing Process
- Platform-Specific Debugger
- Value Deviation (stack trace)
- CLR Thread
- Coincidental Frames
- Fault Context
- Hardware Activity
- Incorrect Symbolic Information
- Message Hooks - Modeling Example
- Coupled Machines
- Abridged Dump
- Exception Stack Trace
Forthcoming Book about Windows Crash Dump Analysis (Systematic Software Fault Analysis Series)
The reader will master crash and hang memory dump analysis for process, minidump, kernel and complete memory dumps from Windows XP/Vista/7 and Windows Server 2003/2008/R2.
Additional features include:
- 64-bit crash dump analysis
- Stack reconstruction examples
- WinDbg scripts
- Enhanced and coherent coverage of crash dump analysis patterns
- Quick start for GDB and ADB users
- and many more
Management chapter will include guidelines for implementing SMART (Smart Memory Analysis in Real Time) process in a technical support or software maintenance environment.
The book will provide answers to many questions including those in the following list: Memory Dump Analysis Interview Questions
- Author: Dmitry Vostokov
- Paperback: 512 pages (*)
- ISBN-13: 978-0-9558328-2-6
- Publisher: Opentask (01 Dec 2008)
- Language: English
- Product Dimensions: 22.86 x 15.24
(*) subject to change