Comments on: Raw Stack Dump of all threads https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 12:25:24 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 4) https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-191224 Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 4) Fri, 08 Oct 2010 15:34:40 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-191224 [...] Experts Magazine Online The previously published script to dump raw stack of all threads dumps only 64-bit raw stack from 64-bit WOW64 process memory dumps (a 32-bit process saved in a [...] […] Experts Magazine Online The previously published script to dump raw stack of all threads dumps only 64-bit raw stack from 64-bit WOW64 process memory dumps (a 32-bit process saved in a […]

]]> By: Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 3) https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-74073 Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 3) Mon, 11 May 2009 14:16:03 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-74073 [...] the script featured in part 1 doesn’t work because of the lack of symbols or [...] […] the script featured in part 1 doesn’t work because of the lack of symbols or […]

]]> By: Crash Dump Analysis » Blog Archive » Hooksware https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-37543 Crash Dump Analysis » Blog Archive » Hooksware Sun, 10 Aug 2008 11:27:14 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-37543 [...] stack output of dds command reveals them but beware of Coincidental Symbolic Information. See also Raw Stack Dump of all threads (process dumps) and Raw Stack Dump of all threads (part 2) (complete memory [...] […] stack output of dds command reveals them but beware of Coincidental Symbolic Information. See also Raw Stack Dump of all threads (process dumps) and Raw Stack Dump of all threads (part 2) (complete memory […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-36968 Dmitry Vostokov Tue, 05 Aug 2008 12:24:58 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-36968 If you get this error Symbol ntdll!_NT_TIB not found. try to omit ntdll because sometimes the structure is imported into an application module or another DLL: <p align="left">0:071> dt _NT_TIB Application!_NT_TIB +0x000 ExceptionList : Ptr32 _EXCEPTION_REGISTRATION_RECORD +0x004 StackBase : Ptr32 Void +0x008 StackLimit : Ptr32 Void +0x00c SubSystemTib : Ptr32 Void +0x010 FiberData : Ptr32 Void +0x010 Version : Uint4B +0x014 ArbitraryUserPointer : Ptr32 Void +0x018 Self : Ptr32 _NT_TIB</p> If you get this error

Symbol ntdll!_NT_TIB not found.

try to omit ntdll because sometimes the structure is imported into an application module or another DLL:

0:071> dt _NT_TIB
Application!_NT_TIB
+0×000 ExceptionList : Ptr32 _EXCEPTION_REGISTRATION_RECORD
+0×004 StackBase : Ptr32 Void
+0×008 StackLimit : Ptr32 Void
+0×00c SubSystemTib : Ptr32 Void
+0×010 FiberData : Ptr32 Void
+0×010 Version : Uint4B
+0×014 ArbitraryUserPointer : Ptr32 Void
+0×018 Self : Ptr32 _NT_TIB

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 60) https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-24966 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 60) Tue, 29 Apr 2008 11:28:26 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-24966 [...] a NULL thread procedure pointer to CreateThread function. We might expect to see little in the raw stack data because there was no user-supplied thread code. In reality, if we dump it we would see lots of [...] […] a NULL thread procedure pointer to CreateThread function. We might expect to see little in the raw stack data because there was no user-supplied thread code. In reality, if we dump it we would see lots of […]

]]> By: Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 2) https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-14419 Crash Dump Analysis » Blog Archive » Raw Stack Dump of all threads (part 2) Mon, 24 Dec 2007 19:53:56 +0000 https://www.dumpanalysis.org/blog/index.php/2007/08/28/raw-stack-dump-from-all-threads/#comment-14419 [...] the previous part I used WinDbg scripting to get raw stack data from user process dump. However the script needs to be modified if the dump is complete memory dump. Here I use [...] […] the previous part I used WinDbg scripting to get raw stack data from user process dump. However the script needs to be modified if the dump is complete memory dump. Here I use […]

]]>