https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Mon, 25 May 2026 02:39:49 +0000 http://wordpress.org/?v=2.3.3 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-767706 Dmitry Vostokov Fri, 21 Jan 2022 21:35:02 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-767706 ~*k 1 lists the first frame only like thread info GDB command. ~*k 1 lists the first frame only like thread info GDB command.

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-741764 Dmitry Vostokov Sun, 24 Nov 2019 18:27:30 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-741764 Windows 10: !findthreads Windows 10: !findthreads

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-590535 Dmitry Vostokov Wed, 31 Oct 2012 15:54:20 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-590535 For Windows 8 the latest WinDbg 6.2.9200.16384 the parameter ff doesn't show stack traces so we can use 1f or 16. For Windows 8 the latest WinDbg 6.2.9200.16384 the parameter ff doesn’t show stack traces so we can use 1f or 16.

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-376349 Dmitry Vostokov Mon, 21 Nov 2011 15:06:57 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-376349 Added !for_each_thread Added !for_each_thread

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-374817 Dmitry Vostokov Fri, 18 Nov 2011 22:54:38 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-374817 Added !sprocess command Added !sprocess command

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-192738 Crash Dump Analysis » Blog Archive » Software Chorography and Chorology: A Definition Wed, 13 Oct 2010 21:56:30 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-192738 [...] dumps have some extension in the dimension of narrativity because it is possible to get stack traces and other execution residue from them that provide partial fragments of a software [...] […] dumps have some extension in the dimension of narrativity because it is possible to get stack traces and other execution residue from them that provide partial fragments of a software […]

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-173582 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 105) Thu, 05 Aug 2010 20:07:13 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-173582 [...] by the default analysis command (for example, !analyze -v WinDbg command) or by inspecting a stack trace collection. However if we didn’t see any exception thread it doesn’t mean that no exception had [...] […] by the default analysis command (for example, !analyze -v WinDbg command) or by inspecting a stack trace collection. However if we didn’t see any exception thread it doesn’t mean that no exception had […]

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-168327 Crash Dump Analysis » Blog Archive » Stack trace collection, special process, LPC and critical section wait chains, blocked thread, coupled machines, thread waiting time and IRP distribution anomaly: pattern cooperation Sun, 18 Jul 2010 14:08:01 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-168327 [...] was reported that new remote sessions couldn’t be created. A complete memory dump stack trace collection log lists a special process that would not normally be present in a fully initialized session: [...] […] was reported that new remote sessions couldn’t be created. A complete memory dump stack trace collection log lists a special process that would not normally be present in a fully initialized session: […]

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-158854 Crash Dump Analysis » Blog Archive » 10 Common Mistakes in Memory Analysis (Part 8) Wed, 16 Jun 2010 22:40:52 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-158854 [...] a culprit component, DllA, or not? Could this blockage result from earlier problems? We search stack trace collection for any other anomalous activity (Semantic Split) and we find indeed a recurrent stack trace [...] […] a culprit component, DllA, or not? Could this blockage result from earlier problems? We search stack trace collection for any other anomalous activity (Semantic Split) and we find indeed a recurrent stack trace […]

]]> https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-147471 Crash Dump Analysis » Blog Archive » Strong process coupling, stack trace collection, critical section coruption and wait chains, message box, self-diagnosis and hidden exception and dynamic memory corruption: pattern cooperation Mon, 26 Apr 2010 19:59:26 +0000 https://www.dumpanalysis.org/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/#comment-147471 [...] Stack trace collection shows several threads waiting for a critical section when allocating heap blocks or calling loader functions, for example: [...] […] Stack trace collection shows several threads waiting for a critical section when allocating heap blocks or calling loader functions, for example: […]

]]>