Comments on: Crash Dump Analysis Patterns (Part 34)

By: Dmitry Vostokov

Dmitry Vostokov — Sun, 10 Mar 2024 16:16:22 +0000

!memusage

By: Dmitry Vostokov

Dmitry Vostokov — Sat, 01 Jul 2023 22:39:59 +0000

Heap failures !heap -s -v

By: Dmitry Vostokov

Dmitry Vostokov — Thu, 18 Aug 2022 21:21:03 +0000

Various callbacks.

By: Dmitry Vostokov

Dmitry Vostokov — Mon, 10 Jun 2013 13:47:51 +0000

Debugging TV Frames episode 0×29 shows an example for notepad.exe http://www.debugging.tv

By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 56)

Fri, 09 Jul 2010 17:33:39 +0000

[…] we introduce an icon for Historical Information […]

By: Dmitry Vostokov

Dmitry Vostokov — Tue, 18 Aug 2009 14:06:59 +0000

!obtrace monitors more than !htrace (Windows Internals, 5th edition, p. 156)

By: Crash Dump Analysis » Blog Archive » Trace Analysis Patterns (Part 1)

Crash Dump Analysis » Blog Archive » Trace Analysis Patterns (Part 1) — Tue, 28 Apr 2009 09:27:27 +0000

[…] traces and their collections are specializations of the more general traces. Another example is Historical Information in memory dump files especially when it is somehow […]

By: Crash Dump Analysis » Blog Archive » Blocked thread, historical information, execution residue, hidden exception, dynamic memory corruption, incorrect stack trace and not my version: pattern cooperation

Thu, 23 Apr 2009 21:00:30 +0000

[…] and the last thread was blocked in a destructor of MyPrinter class. However we see some historical information, faultrep.dll unloaded, and this means that some exception happened prior to the process […]

By: Dmitry Vostokov

Dmitry Vostokov — Tue, 05 Aug 2008 13:39:26 +0000

Also last error values for all threads make another good example of historical info

By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 60)

Tue, 29 Apr 2008 11:41:24 +0000

[…] In the pattern about NULL code pointer I created a simple program that crashes when we pass a NULL thread procedure pointer to CreateThread function. We might expect to see little in the raw stack data because there was no user-supplied thread code. In reality, if we dump it we would see lots of symbolic information for code and data including ASCII and UNICODE fragments that I call Execution Residue patterns and one of them is Exception Handling Residue we can use to check for hidden exceptions and differentiate between 1st and 2nd chance exceptions. Code residues are very powerful in reconstructing stack traces manually or looking for partial stack traces and historical information. […]