Complexity and Memory Dumps (Part 1)
Wednesday, December 5th, 2007Asking right questions at the appropriate hierarchical organization level is a known solution to complexity. In case of memory dumps it is sometimes useful to forget about bits, bytes, words, dwords and qwords, memory addresses, pointers, runtime structures, API and ask educated questions at component level, the simplest of it is the question about component timestamp, in WinDbg parlance, using variants of lm command, for example:
0:008> lmt m ModuleA
start end module name
76290000 762ad000 ModuleA Sat Feb 17 13:59:59 2007 (45D70A5F)
0:008> lmt m ModuleB
start end module name
66c50000 66c65000 ModuleB Fri Feb 02 22:30:03 2007 (45C3BB6B)
The next step is obvious: test with the newer version. Another good question is about consistency to exclude cases caused by α-particle hits. This latter possibility was mentioned in Andreas Zeller’s book I read some time ago and can be considered as the efficient cause of some crash dumps according to Aristotelian causation categories.
- Dmitry Vostokov @ DumpAnalysis.org -