Comments on: Crash Dump Analysis Patterns (Part 5b) https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sun, 17 May 2026 15:48:17 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-741721 Dmitry Vostokov Wed, 05 Oct 2016 15:28:49 +0000 https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-741721 See also: https://msdn.microsoft.com/en-us/library/windows/hardware/ff541382(v=vs.85).aspx See also:
https://msdn.microsoft.com/en-us/library/windows/hardware/ff541382(v=vs.85).aspx

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 20) https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-142117 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 20) Thu, 08 Apr 2010 16:26:42 +0000 https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-142117 [...] Today we introduce an icon for OMAP Code Optimization pattern: [...] […] Today we introduce an icon for OMAP Code Optimization pattern: […]

]]> By: !analyze -v : Crash Dump Analysis Patterns (Part 5b) https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-43200 !analyze -v : Crash Dump Analysis Patterns (Part 5b) Thu, 18 Sep 2008 08:20:48 +0000 https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-43200 [...] Crash Dump Analysis Patterns (Part 5b) [...] […] Crash Dump Analysis Patterns (Part 5b) […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-1930 Dmitry Vostokov Tue, 22 May 2007 12:07:39 +0000 https://www.dumpanalysis.org/blog/index.php/2007/04/20/crash-dump-analysis-patterns-part-5b/#comment-1930 <p>Another example of OMAP when we try to disassemble backwards:</p> <p align="left"><code>ChildEBP RetAddr Args to Child<br /> 0006f87c 01034efb application!MultiUserLogonAttempt+0x5ba<br /> 0006fee4 01037120 application!LogonAttempt+0x406</code></p> <p align="left"><code>1: kd> ub application!LogonAttempt+0x406<br /> ^ Unable to find valid previous instruction for 'ub application!LogonAttempt+0x406'<br /> 1: kd> u application!LogonAttempt+0x406<br /> application!LogonAttempt+0x20b:<br /> 010348d5 add dword ptr [edx+10h],ebp</code></p> <p>We have to specify the return address for MultiUserLogonAttempt:</p> <p align="left"><code>1: kd> ub 01034efb<br /> application!LogonAttempt+0x3e4:<br /> 01034ed9 mov dword ptr [ebp-628h],ecx<br /> 01034edf mov ecx,dword ptr [ebp-61Ch]<br /> 01034ee5 mov dword ptr [eax+24h],ecx<br /> 01034ee8 push dword ptr [ebp-61Ch]<br /> 01034eee lea eax,[ebp-638h]<br /> 01034ef4 push eax<br /> 01034ef5 push ebx<br /> 01034ef6 call application!MultiUserLogonAttempt (0102c822)</code></p> <p align="left"><code>1: kd> u 01034efb<br /> application!LogonAttempt+0x406:<br /> 01034efb mov ecx,dword ptr [ebp-628h]<br /> 01034f01 mov  dword ptr [ebp-608h],eax<br /> 01034f07 mov  eax,dword ptr [ebx+8]<br /> 01034f0a mov  dword ptr [eax+24h],ecx<br /> 01034f0d cmp  dword ptr [application!g_SessionId (010742dc)],0<br /> 01034f14 je application!LogonAttempt+0x47e (01034f73)<br /> 01034f16 lea  eax,[ebx+1078h]<br /> 01034f1c push eax</code></p> Another example of OMAP when we try to disassemble backwards:

ChildEBP RetAddr Args to Child
0006f87c 01034efb application!MultiUserLogonAttempt+0×5ba
0006fee4 01037120 application!LogonAttempt+0×406

1: kd> ub application!LogonAttempt+0x406
^ Unable to find valid previous instruction for ‘ub application!LogonAttempt+0×406′
1: kd> u application!LogonAttempt+0×406
application!LogonAttempt+0×20b:
010348d5 add dword ptr [edx+10h],ebp

We have to specify the return address for MultiUserLogonAttempt:

1: kd> ub 01034efb
application!LogonAttempt+0×3e4:
01034ed9 mov dword ptr [ebp-628h],ecx
01034edf mov ecx,dword ptr [ebp-61Ch]
01034ee5 mov dword ptr [eax+24h],ecx
01034ee8 push dword ptr [ebp-61Ch]
01034eee lea eax,[ebp-638h]
01034ef4 push eax
01034ef5 push ebx
01034ef6 call application!MultiUserLogonAttempt (0102c822)

1: kd> u 01034efb
application!LogonAttempt+0×406:
01034efb mov ecx,dword ptr [ebp-628h]
01034f01 mov  dword ptr [ebp-608h],eax
01034f07 mov  eax,dword ptr [ebx+8]
01034f0a mov  dword ptr [eax+24h],ecx
01034f0d cmp  dword ptr [application!g_SessionId (010742dc)],0
01034f14 je application!LogonAttempt+0×47e (01034f73)
01034f16 lea  eax,[ebx+1078h]
01034f1c push eax

]]>