Memory Dump Analysis Interview Questions

The following interview questions might be useful to assess the skill level in crash dump analysis on Windows platforms. These could be useful for debugging interviews as well.

  1. What is FPO?

  2. How many exceptions can be found in a crash dump?

  3. You see the message from WinDbg:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    What would you do?

  4. How would you find spinlock implementation if you have a kernel dump?

  5. What is OMAP?

  6. What is full page heap?

  7. Company name is missing from module information. How would you try to find it?

  8. What is IDT?

  9. How does a postmortem debugger work?

  10. You’ve got a mini dump of your application. How would you disassemble the code?

  11. Memory consumption is growing for an application. How would you discover the leaking component?

  12. What is IRQL?

  13. When do you use TEB?

  14. You’ve got 200 process dumps from a server. You need to find a deadlock. How would you do it?

  15. You’ve got a complete memory dump from a server. You need to find a deadlock. How would you do it?

  16. What is GC heap?

  17. Your customer is reluctant to send a dump due to security policies. What is your next step?

  18. What is a first chance exception?

I’ve created a permanent page and will add more questions there in the future:

Memory Dump Analysis Interview Questions

- Dmitry Vostokov @ DumpAnalysis.org -

Leave a Reply

You must be logged in to post a comment.