Comments on: Crash Dump Analysis Patterns (Part 3) https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 01:52:57 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-362571 Dmitry Vostokov Mon, 31 Oct 2011 13:04:47 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-362571 I think you need to see what module calls OutputDebugString. You may also have other issues on other threads that !analyze -v is not able to figure out. You can ask for memory dump analysis audit: http://www.dumpanalysis.com/memory-dump-analysis-audit-service I think you need to see what module calls OutputDebugString. You may also have other issues on other threads that !analyze -v is not able to figure out. You can ask for memory dump analysis audit:
http://www.dumpanalysis.com/memory-dump-analysis-audit-service

]]> By: Bob A https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-361547 Bob A Sat, 29 Oct 2011 00:55:27 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-361547 Thanks for the great article. I think I see a variant of this signature in another crash scenario: We're seeing WER AppCrash reports, ending in Kernelbase!RaiseException OutputDebugString We've closely inspected our machines, and can't see any debuggers present, nor does '!analyze -v' mention one. The common theme in our issue is that we see this on Win Server 2008 R2 (64), where other OSes don't fail (XP 32/64, Win7). We are a 32bit app. I suspect (and this is hunches) that in this OS, RaiseException is sometimes used to trigger a heap corruption check, we fail, and get terminated. Is this paranoia or FUD? Though (head/tail) pageheap and other lenses don't seem to catch the corruption (it may be subtle?). Thanks again for a great blog, you're an indispensable resource for Win developers! Thanks for the great article.
I think I see a variant of this signature in another crash scenario:

We’re seeing WER AppCrash reports, ending in
Kernelbase!RaiseException
OutputDebugString

We’ve closely inspected our machines, and can’t see any debuggers present, nor does ‘!analyze -v’ mention one.
The common theme in our issue is that we see this on Win Server 2008 R2 (64), where other OSes don’t fail (XP 32/64, Win7).
We are a 32bit app.

I suspect (and this is hunches) that in this OS, RaiseException is sometimes used to trigger a heap corruption check, we fail, and get terminated. Is this paranoia or FUD?

Though (head/tail) pageheap and other lenses don’t seem to catch the corruption (it may be subtle?).

Thanks again for a great blog, you’re an indispensable resource for Win developers!

]]> By: Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-186341 Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) Fri, 24 Sep 2010 10:54:24 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-186341 [...] False Positive Dump [...] […] False Positive Dump […]

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 5) https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-133597 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 5) Fri, 12 Mar 2010 16:08:51 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-133597 [...] we introduce an icon for False Positive Dump [...] […] we introduce an icon for False Positive Dump […]

]]> By: Aviv Greenberg https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-87056 Aviv Greenberg Tue, 04 Aug 2009 09:31:09 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-87056 Thanks for posting this! it really saved me time because i just could not figure out from this dump i got what was wrong with the string that was passed - the memory was valid.... Thanks for posting this! it really saved me time because i just could not figure out from this dump i got what was wrong with the string that was passed - the memory was valid….

]]> By: !analyze -v : Crash Dump Analysis Patterns (Part 3) – False Positive Dump https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-43014 !analyze -v : Crash Dump Analysis Patterns (Part 3) – False Positive Dump Wed, 17 Sep 2008 08:50:55 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-43014 [...] http://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/ [...] […] http://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/ […]

]]> By: Management Bits and Tips » Blog Archive » Project Failure Analysis Patterns (Part 3) https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-18283 Management Bits and Tips » Blog Archive » Project Failure Analysis Patterns (Part 3) Tue, 12 Feb 2008 11:50:59 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/#comment-18283 [...] mapping from False Positive Dump pattern brings us to False Project Failure pattern that usually happen when assessing the current [...] […] mapping from False Positive Dump pattern brings us to False Project Failure pattern that usually happen when assessing the current […]

]]>