Comments on: Reconstructing Stack Trace Manually https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 12:08:18 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-380542 Dmitry Vostokov Sun, 27 Nov 2011 13:02:18 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-380542 Neil, can you send me a download link to one such dump? You can use contact form on dumpanalysis.org. Thanks! Neil, can you send me a download link to one such dump? You can use contact form on dumpanalysis.org. Thanks!

]]> By: Neil https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-377923 Neil Wed, 23 Nov 2011 17:15:29 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-377923 Hi, Have you ever come across ntdll!RcConsolidateFrames in a call stack? I'm seeing it a lot in x64 mini dumps and can't figure out how to reconstruct the stack. Thanks, Neil Hi,

Have you ever come across ntdll!RcConsolidateFrames in a call stack? I’m seeing it a lot in x64 mini dumps and can’t figure out how to reconstruct the stack.

Thanks,
Neil

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 100) https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-163879 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 100) Tue, 06 Jul 2010 15:50:44 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-163879 [...] we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in [...] […] we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 87) https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-83964 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 87) Fri, 10 Jul 2009 19:26:26 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-83964 [...] Looking at raw stack further we can even see that it was processing a page fault too and manually reconstruct its stack trace: [...] […] Looking at raw stack further we can even see that it was processing a page fault too and manually reconstruct its stack trace: […]

]]> By: Crash Dump Analysis » Blog Archive » The Importance of Symbols https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-79067 Crash Dump Analysis » Blog Archive » The Importance of Symbols Sun, 14 Jun 2009 20:20:02 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-79067 [...] we look at the thread raw stack data from ESP up to the base and try to do a manual descent to reconstruct that stack trace, starting from EBP value (EIP points to [...] […] we look at the thread raw stack data from ESP up to the base and try to do a manual descent to reconstruct that stack trace, starting from EBP value (EIP points to […]

]]> By: Software Generalist » Blog Archive » Reading Notebook: 20-Apr-09 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-71695 Software Generalist » Blog Archive » Reading Notebook: 20-Apr-09 Mon, 20 Apr 2009 16:40:41 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-71695 [...] Broken stack traces (pp. 151 -152) - Here is my case study about manual stack trace reconstruction using WinDbg: http://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/ [...] […] Broken stack traces (pp. 151 -152) - Here is my case study about manual stack trace reconstruction using WinDbg: http://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/ […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 60) https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-24969 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 60) Tue, 29 Apr 2008 11:30:39 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/#comment-24969 [...] and differentiate between 1st and 2nd chance exceptions. Code residues are very powerful in reconstructing stack traces manually or looking for partial stack traces and historical [...] […] and differentiate between 1st and 2nd chance exceptions. Code residues are very powerful in reconstructing stack traces manually or looking for partial stack traces and historical […]

]]>