Comments on: Crash Dump Analysis Patterns (Part 18) https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 04:50:59 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-767711 Dmitry Vostokov Sat, 02 Apr 2022 12:25:37 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-767711 A laptop switched off during dump file write: <p align=left>Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.</p> <p align=left>Dump completed successfully, progress percentage: 65</p> <p align=left>Symbol search path is: srv* Executable search path is: Missing image name, possible paged-out or corrupt data. Unable to load image Unknown_Module_65000000`00b7fc41, Win32 error 0n2 *** WARNING: Unable to verify timestamp for Unknown_Module_65000000`00b7fc41 Debugger can not determine kernel base address Windows 10 Kernel Version 22000 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Edition build lab: 22000.1.amd64fre.co_release.210604-1628 Machine Name: Kernel base = 0xfffff807`3a800000 PsLoadedModuleList = 0xfffff807`3b429b90 Debug session time: Sat Apr 2 13:08:14.826 2022 (UTC + 1:00) System Uptime: 16 days 13:25:19.305 Page 40500fe039 too large to be in the dump file. Page 54f0b7fe91 too large to be in the dump file. Page 9646e65230 too large to be in the dump file. Page 5f0127b460 too large to be in the dump file. Page 23cc8250 too large to be in the dump file. Missing image name, possible paged-out or corrupt data. Unable to load image Unknown_Module_65000000`00b7fc41, Win32 error 0n2 *** WARNING: Unable to verify timestamp for Unknown_Module_65000000`00b7fc41 Debugger can not determine kernel base address Loading Kernel Symbols Missing image name, possible paged-out or corrupt data. .Unable to read KLDR_DATA_TABLE_ENTRY at 3cb77e4e`2bb76537 - NTSTATUS 0xC0000141</p> <p align=left>Image path too long, possible corrupt data. Loading unloaded module list ..Image path too long, possible corrupt data.</p> A laptop switched off during dump file write:

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Dump completed successfully, progress percentage: 65

Symbol search path is: srv*
Executable search path is:
Missing image name, possible paged-out or corrupt data.
Unable to load image Unknown_Module_65000000`00b7fc41, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_65000000`00b7fc41
Debugger can not determine kernel base address
Windows 10 Kernel Version 22000 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff807`3a800000 PsLoadedModuleList = 0xfffff807`3b429b90
Debug session time: Sat Apr 2 13:08:14.826 2022 (UTC + 1:00)
System Uptime: 16 days 13:25:19.305
Page 40500fe039 too large to be in the dump file.
Page 54f0b7fe91 too large to be in the dump file.
Page 9646e65230 too large to be in the dump file.
Page 5f0127b460 too large to be in the dump file.
Page 23cc8250 too large to be in the dump file.
Missing image name, possible paged-out or corrupt data.
Unable to load image Unknown_Module_65000000`00b7fc41, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_65000000`00b7fc41
Debugger can not determine kernel base address
Loading Kernel Symbols
Missing image name, possible paged-out or corrupt data.
.Unable to read KLDR_DATA_TABLE_ENTRY at 3cb77e4e`2bb76537 - NTSTATUS 0xC0000141

Image path too long, possible corrupt data.
Loading unloaded module list
..Image path too long, possible corrupt data.

]]> By: Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-186343 Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) Fri, 24 Sep 2010 10:55:34 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-186343 [...] Truncated Dump [...] […] Truncated Dump […]

]]> By: Crash Dump Analysis » Blog Archive » Truncated dump, spiking thread, not my version and hooked functions: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-175805 Crash Dump Analysis » Blog Archive » Truncated dump, spiking thread, not my version and hooked functions: pattern cooperation Fri, 13 Aug 2010 19:16:00 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-175805 [...] We also see that this thread spent more than a minute in user mode. Unfortunately we cannot see its thread stack because the dump shows signs of Truncated Dump pattern: [...] […] We also see that this thread spent more than a minute in user mode. Unfortunately we cannot see its thread stack because the dump shows signs of Truncated Dump pattern: […]

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 34) https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-150571 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 34) Fri, 07 May 2010 14:08:49 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-150571 [...] we introduce an icon for Truncated Dump [...] […] we introduce an icon for Truncated Dump […]

]]> By: Crash Dump Analysis » Blog Archive » Truncated dump, stack trace collection, waiting thread time and wait chains: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-93420 Crash Dump Analysis » Blog Archive » Truncated dump, stack trace collection, waiting thread time and wait chains: pattern cooperation Thu, 10 Sep 2009 15:16:32 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-93420 [...] this nonsense I checked that complete dump was truncated by half because page file was 4Gb but the amount of physical memory was [...] […] this nonsense I checked that complete dump was truncated by half because page file was 4Gb but the amount of physical memory was […]

]]> By: Crash Dump Analysis » Blog Archive » Sparse complete x64 memory dumps https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-49043 Crash Dump Analysis » Blog Archive » Sparse complete x64 memory dumps Thu, 30 Oct 2008 15:49:08 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-49043 [...] memory dumps could be smaller than the actual amount of physical memory and even when possibly truncated with many OS structures being included. For the virtual memory stats above the size of complete [...] […] memory dumps could be smaller than the actual amount of physical memory and even when possibly truncated with many OS structures being included. For the virtual memory stats above the size of complete […]

]]> By: Crash Dump Analysis » Blog Archive » 10 Common Mistakes in Memory Analysis (Part 3) https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-48948 Crash Dump Analysis » Blog Archive » 10 Common Mistakes in Memory Analysis (Part 3) Wed, 29 Oct 2008 19:03:13 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-18/#comment-48948 [...] the common mistake of not looking at all stack traces. This important when the dump is partially truncated or inconsistent. For example, in one complete memory dump from one hang system WinDbg !locks [...] […] the common mistake of not looking at all stack traces. This important when the dump is partially truncated or inconsistent. For example, in one complete memory dump from one hang system WinDbg !locks […]

]]>