Crash Dump Analysis

Memory Dump Analysis Interview Questions

DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.

Twitter @ DumpAnalysis
You can now follow portal and blog news at DumpAnalysis on Twitter

LinkedIn Group Dr. Watson Enthusiasts
All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)

This is the growing list of interview questions that might be useful to assess the skill level in crash dump analysis and debugging on Windows platforms.

What is FPO?
How many exceptions can be found in a crash dump?
You see the message from WinDbg:
WARNING: Stack unwind information not available. Following frames may be wrong.
What would you do?
How would you find spinlock implementation if you have a kernel dump?
What is OMAP?
What is full page heap?
Company name is missing from module information. How would you try to find it?
What is IDT?
How does a postmortem debugger work?
You’ve got a mini dump of your application. How would you disassemble the code?
Memory consumption is growing for an application. How would you discover the leaking component?
What is IRQL?
When do you use TEB?
You’ve got 200 process dumps from a server. You need to find a deadlock. How would you do it?
You’ve got a complete memory dump from a server. You need to find a deadlock. How would you do it?
What is GC heap?
Your customer is reluctant to send a dump due to security policies. What is your next step?
What is a first chance exception?