Comments on: Crash Dump Analysis Patterns (Part 9c) https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sun, 17 May 2026 21:38:29 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » Deadlock Patterns https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-197367 Crash Dump Analysis » Blog Archive » Deadlock Patterns Wed, 27 Oct 2010 16:03:10 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-197367 [...] Deadlock (mixed objects, user space) [...] […] Deadlock (mixed objects, user space) […]

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 15) https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-139509 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 15) Tue, 30 Mar 2010 13:57:34 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-139509 [...] we introduce an icon for Deadlock (mixed objects, user space) [...] […] we introduce an icon for Deadlock (mixed objects, user space) […]

]]> By: !analyze -v : Crash Dump Analysis Patterns (Part 9c) https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-43191 !analyze -v : Crash Dump Analysis Patterns (Part 9c) Thu, 18 Sep 2008 07:53:32 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-43191 [...] Crash Dump Analysis Patterns (Part 9c) [...] […] Crash Dump Analysis Patterns (Part 9c) […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-30990 Dmitry Vostokov Fri, 20 Jun 2008 16:34:06 +0000 https://www.dumpanalysis.org/blog/index.php/2007/07/28/crash-dump-analysis-patterns-part-9c/#comment-30990 Regarding thread#16 we can see the module it was trying to free if we dump parameters for FreeLibrary: <p align="left"><font size="1"><code>0581fe14 776b46fb kernel32!FreeLibrary+0x41</font></code> In another dump I had this: <p align="left"><font size="1"><code> 16 Id: 13d0.2780 Suspend: 1 Teb: 7ffa8000 Unfrozen ChildEBP RetAddr Args to Child 0210fc98 7c942124 7c95970f 00000100 00000000 ntdll!KiFastSystemCallRet 0210fc9c 7c95970f 00000100 00000000 00000000 ntdll!NtWaitForSingleObject+0xc 0210fcd8 7c959620 00000000 00000004 00000000 ntdll!RtlpWaitOnCriticalSection+0x19c 0210fcf8 7c95a023 7c9a9d94 0210fe78 0210fea8 ntdll!RtlEnterCriticalSection+0xa8 0210fe00 7c827bcd 02a10000 0210fea8 0210fee4 ntdll!LdrUnloadDll+0x35 0210fe14 775346eb <font color="blue"><strong>02a10000</strong></font> 0210ff0c 775346ff kernel32!FreeLibrary+0x41 [...]</font></code> <p align="left"><font size="1"><code>0:000> lm start end module name [...] 02a10000 02a19000 DLL_A DLL_A.dll</font></code> Regarding thread#16 we can see the module it was trying to free if we dump parameters for FreeLibrary:

0581fe14 776b46fb kernel32!FreeLibrary+0x41

In another dump I had this:

16 Id: 13d0.2780 Suspend: 1 Teb: 7ffa8000 Unfrozen
ChildEBP RetAddr Args to Child
0210fc98 7c942124 7c95970f 00000100 00000000 ntdll!KiFastSystemCallRet
0210fc9c 7c95970f 00000100 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
0210fcd8 7c959620 00000000 00000004 00000000 ntdll!RtlpWaitOnCriticalSection+0x19c
0210fcf8 7c95a023 7c9a9d94 0210fe78 0210fea8 ntdll!RtlEnterCriticalSection+0xa8
0210fe00 7c827bcd 02a10000 0210fea8 0210fee4 ntdll!LdrUnloadDll+0x35
0210fe14 775346eb 02a10000 0210ff0c 775346ff kernel32!FreeLibrary+0×41
[…]

0:000> lm
start end module name
[...]
02a10000 02a19000 DLL_A DLL_A.dll

]]>