Archive for September 7th, 2006

Exploring Kernel Memory Space Analyzer

Thursday, September 7th, 2006

It takes approximately 10 - 30 minutes to process an average 2Gb complete memory dump. After loading couple of dumps I found the following useful features so far:

  • You can save analysis tree in a file and open it later for further analysis (but you need to keep dump file too)
  • Wait chains might be useful. However the tool reports too many of them (608 in my dump). They are sorted by length so it might be useful in detecting lengthy chains
  • It also detects anomalous (corrupt) critical sections in user processes
  • It detects deadlocks (you don’t need to enable driver verifier and reboot the system to get a new dump)

I’m currently using this tool with every memory dump I get and will post interesting cases.

- Dmitry Vostokov -

Posted in Crash Dump Analysis, Tools | No Comments »

Yet another WinDbg script

Thursday, September 7th, 2006

I got a dump with 30 IE processes running and I want to find the only one waiting for a specific function. I know there is one. The following script lists all processes and their stacks (of course, I already opened a log in WinDbg to save that huge amount of output):

$$
$$ List user processes and stacks
$$
r $t0 = nt!PsActiveProcessHead
.for (r $t1 = poi(@$t0); (@$t1 != 0) & (@$t1 != @$t0); r $t1 = poi(@$t1))
{
    r? $t2 = #CONTAINING_RECORD(@$t1, nt!_EPROCESS, ActiveProcessLinks);
    .process @$t2
    .reload
    !process @$t2
}

- Dmitry Vostokov -

Posted in Crash Dump Analysis, Tools, WinDbg Scripts | 3 Comments »