Comments on: Note: 32-bit stack from 64-bit dump https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 01:35:29 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-159019 Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) Thu, 17 Jun 2010 14:10:05 +0000 https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-159019 [...] flow analysis was incomplete, some code may be missing wanarpv6 ldrpcallinitroutine windbg scripts wow64exts debug_flr_image_timestamp userdump debug crash analyzer dumpanalysis vdtw30.dll windbg 64 bits dump [...] […] flow analysis was incomplete, some code may be missing wanarpv6 ldrpcallinitroutine windbg scripts wow64exts debug_flr_image_timestamp userdump debug crash analyzer dumpanalysis vdtw30.dll windbg 64 bits dump […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-390 Dmitry Vostokov Thu, 22 Feb 2007 12:18:00 +0000 https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-390 Moreover you you need to load that extention manually: 1 Id: 9ac.668 Suspend: 0 Teb: 00000000`7efad000 Unfrozen Need to load wow64exts.dll to retrieve context! ChildEBP RetAddr Args to Child WARNING: Frame IP not in any known module. Following frames may be wrong. 0010001f 00000000 00000000 00000000 00000000 0x0 0:000:x86> .load wow64exts 0:000:x86> ~*kv ... ... ... 1 Id: 9ac.668 Suspend: 0 Teb: 00000000`7efad000 Unfrozen ChildEBP RetAddr Args to Child 03a0fad8 7db40553 00000270 00000001 03a0fb00 ntdll_7d600000!ZwWaitForSingleObject+0x15 03a0fb14 7db4092c 00000270 0000027c 00000000 mswsock!SockWaitForSingleObject+0x19d 03a0fc04 71c0470c 00000001 03a0fe84 03a0fc7c mswsock!WSPSelect+0x380 03a0fc54 77215d7a 00000001 03a0fe84 03a0fc7c WS2_32!select+0xb9 03a0ffb0 7721d925 03a0ffec 7d4dfff1 003349e8 WININET!ICAsyncThread::SelectThread+0x22a 03a0ffb8 7d4dfff1 003349e8 00000000 00000000 WININET!ICAsyncThread::SelectThreadWrapper+0xd 03a0ffec 00000000 7721d918 003349e8 00000000 kernel32!BaseThreadStart+0x34 Moreover you you need to load that extention manually:

1 Id: 9ac.668 Suspend: 0 Teb: 00000000`7efad000 Unfrozen
Need to load wow64exts.dll to retrieve context!
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0010001f 00000000 00000000 00000000 00000000 0×0

0:000:x86> .load wow64exts
0:000:x86> ~*kv
…
…
…

1 Id: 9ac.668 Suspend: 0 Teb: 00000000`7efad000 Unfrozen
ChildEBP RetAddr Args to Child
03a0fad8 7db40553 00000270 00000001 03a0fb00 ntdll_7d600000!ZwWaitForSingleObject+0×15
03a0fb14 7db4092c 00000270 0000027c 00000000 mswsock!SockWaitForSingleObject+0×19d
03a0fc04 71c0470c 00000001 03a0fe84 03a0fc7c mswsock!WSPSelect+0×380
03a0fc54 77215d7a 00000001 03a0fe84 03a0fc7c WS2_32!select+0xb9
03a0ffb0 7721d925 03a0ffec 7d4dfff1 003349e8 WININET!ICAsyncThread::SelectThread+0×22a
03a0ffb8 7d4dfff1 003349e8 00000000 00000000 WININET!ICAsyncThread::SelectThreadWrapper+0xd
03a0ffec 00000000 7721d918 003349e8 00000000 kernel32!BaseThreadStart+0×34

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-389 Dmitry Vostokov Thu, 22 Feb 2007 12:08:22 +0000 https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-389 Thanks, it works, but it still uses wow64exts 0:000> .effmach x86 Effective machine: x86 compatible (x86) 0:000:x86> ~*kv . 0 Id: 9ac.d7c Suspend: 0 Teb: 00000000`7efdb000 Unfrozen Need to load wow64exts.dll to retrieve context! Thanks, it works, but it still uses wow64exts

0:000> .effmach x86
Effective machine: x86 compatible (x86)
0:000:x86> ~*kv

. 0 Id: 9ac.d7c Suspend: 0 Teb: 00000000`7efdb000 Unfrozen
Need to load wow64exts.dll to retrieve context!

]]> By: Skywing https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-324 Skywing Wed, 14 Feb 2007 03:50:41 +0000 https://www.dumpanalysis.org/blog/index.php/2007/01/26/note-32-bit-stack-from-64-bit-dump/#comment-324 The preferred way to do this is ".effmach x86", btw; then use ".effmach ." to return to the native processor mode. The builtin engine commands supersede the older wow64exts extension dll. The preferred way to do this is “.effmach x86″, btw; then use “.effmach .” to return to the native processor mode.

The builtin engine commands supersede the older wow64exts extension dll.

]]>