Comments on: Crash Dump Analysis Patterns (Part 4) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 00:06:06 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-741668 Dmitry Vostokov Thu, 26 Mar 2015 17:41:44 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-741668 0: ???> ~0s ... WARNING: Many commands will not work ... 0:000> .ecxr Unable to get exception context, HRESULT 0x80004005 0:000> .exr -1 ExceptionAddress: ...(ModuleA!func+offset) 0: ???> ~0s
…
WARNING: Many commands will not work
…

0:000> .ecxr
Unable to get exception context, HRESULT 0×80004005

0:000> .exr -1
ExceptionAddress: …(ModuleA!func+offset)

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-741667 Dmitry Vostokov Thu, 26 Mar 2015 17:21:08 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-741667 In case of process memory dumps where .ecxr doesn't work we may try .exr -1 to display the last exception record which may show an exception address, code, and parameters (such as a write or read address) In case of process memory dumps where .ecxr doesn’t work we may try .exr -1 to display the last exception record which may show an exception address, code, and parameters (such as a write or read address)

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 114) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-201568 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 114) Tue, 09 Nov 2010 12:03:24 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-201568 [...] above. In some cases exception information might not be valid though, for example, in the case of laterally damaged or truncated memory dump [...] […] above. In some cases exception information might not be valid though, for example, in the case of laterally damaged or truncated memory dump […]

]]> By: Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-186336 Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) Fri, 24 Sep 2010 10:52:04 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-186336 [...] Lateral Damage [...] […] Lateral Damage […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 104) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-173273 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 104) Wed, 04 Aug 2010 23:07:29 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-173273 [...] The same also applies to user dumps where thread times information is omitted so it is not possible to use !runaway WinDbg command or to a dump saved with various options of .dump command (including privacy-aware) instead of /ma or deprecated /f option. On the contrary, manually erased data in crash dumps looks more like an example of another pattern called Lateral Damage. [...] […] The same also applies to user dumps where thread times information is omitted so it is not possible to use !runaway WinDbg command or to a dump saved with various options of .dump command (including privacy-aware) instead of /ma or deprecated /f option. On the contrary, manually erased data in crash dumps looks more like an example of another pattern called Lateral Damage. […]

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 6) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-134599 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 6) Mon, 15 Mar 2010 15:15:44 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-134599 [...] we introduce an icon for Lateral Damage [...] […] we introduce an icon for Lateral Damage […]

]]> By: Crash Dump Analysis » Blog Archive » Lateral damage, stack overflow and execution residue: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-49660 Crash Dump Analysis » Blog Archive » Lateral damage, stack overflow and execution residue: pattern cooperation Wed, 05 Nov 2008 17:35:18 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-49660 [...] I mentioned in comments to Lateral Damage pattern it lies in between the normal healthy dump files and corrupt dumps. For example, the [...] […] I mentioned in comments to Lateral Damage pattern it lies in between the normal healthy dump files and corrupt dumps. For example, the […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-49655 Dmitry Vostokov Wed, 05 Nov 2008 16:39:15 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-49655 Sometimes you get some vital information missing for default or usual analysis techniques and you need to seek other ways to look at dump data - this is the essence of Lateral Damage pattern. Sometimes you get some vital information missing for default or usual analysis techniques and you need to seek other ways to look at dump data - this is the essence of Lateral Damage pattern.

]]> By: !analyze -v : Crash Dump Analysis Patterns (Part 4) https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-43015 !analyze -v : Crash Dump Analysis Patterns (Part 4) Wed, 17 Sep 2008 08:53:23 +0000 https://www.dumpanalysis.org/blog/index.php/2006/11/03/crash-dump-analysis-patterns-part-4/#comment-43015 [...] 원문링크 [...] […] 원문링크 […]

]]>