Crash Dump Analysis Patterns (Part 34)
Although crash dumps are static in nature they contain Historical Information about past system dynamics that might give clues to a problem and help with troubleshooting and debugging.
For example, IRP flow between user processes and drivers is readily available in any kernel or complete memory dump. WinDbg !irpfind command will show the list of currently present I/O request packets. !irp command will give individual packet details.
Recent Driver Verifier improvements in Vista and Windows Server 2008 allow to embed stack traces associated with IRP allocation, completion and cancellation. For information please look at the following document:
http://www.microsoft.com/whdc/devtools/tools/vistaverifier.mspx
Other information that can be included in process, kernel and complete memory dumps may reveal some history of function calls beyond the current snapshot of thread stacks:
-
Heap allocation stack traces that are usually used for debugging memory leaks
-
Handle traces that are used to debug handle leaks (!htrace command)
-
Raw stack data interpreted symbolically. Some examples include dumping stack data from all process threads and dumping kernel mode stack data
-
LPC messages (!lpc thread)
- Dmitry Vostokov @ DumpAnalysis.org -
Announcements:New Book Memory Dump Analysis Anthology, Volume 1
January 25th, 2008 at 6:56 pm
Unloaded module list (lm) is another example of Historical Information pattern
April 29th, 2008 at 11:41 am
[…] In the pattern about NULL code pointer I created a simple program that crashes when we pass a NULL thread procedure pointer to CreateThread function. We might expect to see little in the raw stack data because there was no user-supplied thread code. In reality, if we dump it we would see lots of symbolic information for code and data including ASCII and UNICODE fragments that I call Execution Residue patterns and one of them is Exception Handling Residue we can use to check for hidden exceptions and differentiate between 1st and 2nd chance exceptions. Code residues are very powerful in reconstructing stack traces manually or looking for partial stack traces and historical information. […]
August 5th, 2008 at 1:39 pm
Also last error values for all threads make another good example of historical info