Crash Dump Analysis Patterns
Pattern Classification:
Patterns:
- Multiple Exceptions (user mode)
- Multiple Exceptions (kernel mode)
- Dynamic Memory Corruption (process heap)
- Dynamic Memory Corruption (kernel pool)
- False Positive Dump
- Lateral Damage
- Optimized Code
- Invalid Pointer (general)
- NULL Pointer (code)
- Inconsistent Dump
- Hidden Exception
- Deadlock (critical sections)
- Deadlock (executive resources)
- Deadlock (mixed objects, user space)
- Deadlock (LPC)
- Deadlock (mixed objects, kernel space)
- Changed Environment
- Incorrect Stack Trace
- OMAP Code Optimization
- No Component Symbols
- Insufficient Memory (committed memory)
- Insufficient Memory (handle leak)
- Insufficient Memory (kernel pool)
- Insufficient Memory (PTE)
- Insufficient Memory (virtual memory)
- Spiking Thread
- Module Variety
- Stack Overflow (kernel mode)
- Stack Overflow (user mode)
- Managed Code Exception
- Truncated Dump
- Waiting Thread Time (kernel dumps)
- Waiting Thread Time (user dumps)
- Memory Leak (process heap)
- Memory Leak (.NET heap)
- Missing Thread
- Unknown Component
- Double Free (process heap)
- Double Free (kernel pool)
- Coincidental Symbolic Information
- Stack Trace
- Virtualized Process (WOW64)
- Stack Trace Collection
- Coupled Processes
- High Contention (executive resources)
- High Contention (critical sections)
- Accidental Lock
- Passive Thread (user space)
- Passive System Thread (kernel space)
- Main Thread
- Busy System
- Historical Information
- IRP Distribution Anomaly
- Local Buffer Overflow
- Early Crash Dump
- Hooked Functions
- Custom Exception Handler
- Special Stack Trace
- Manual Dump (kernel)
- Manual Dump (process)
- Wait Chain (general)
- Wait Chain (critical sections)
- Wait Chain (executive resources)
- Wait Chain (thread objects)
- Corrupt Dump
- Dispatch Level Spin
- No Process Dumps
- No System Dumps
- Suspended Thread
- Special Process
- Frame Pointer Omission
- False Function Parameters
- Message Box
- Self-Dump
- Blocked Thread
- Zombie Processes
- Wild Pointer
- Wild Code
- Hardware Error
- Handle Limit (GDI)
- Missing Component (general)
- Missing Component (static linking, user mode)
- Execution Residue
- Optimized VM Layout
- Invalid Handle
- Overaged System
- Thread Starvation
- Duplicated Module
- Not My Version
- Data Contents Locality
- Nested Exceptions (unmanaged code)
- Nested Exceptions (managed code)
- Affine Thread
- Self-Diagnosis
- Inline Function Optimization
- Critical Section Corruption
- Lost Opportunity
- Young System
- Last Error Collection
- Hidden Module
- Data Alignment (page boundary)
- C++ Exception
- Divide by Zero (user mode)
AntiPatterns:
- Alien Component
- Zippocricy
- Word of Mouth
- Wrong Dump
- Fooled by Description
- Need the crash dump. Period.
- Be Language
- Fooled by Abbreviation
- Symbolless or Imageless Analysis
- Myopic Troubleshooting and Debugging
- No Question
New Books:
WinDbg: A Reference Poster and Learning Cards Memory Dump Analysis Anthology, Volume 2Also available:
Memory Dump Analysis Anthology, Volume 1New Children's Book:
Baby Turing