Crash Dump Analysis Patterns (Part 40a)

In Advanced Windows Debugging book I encountered some thread stacks related to debugger events like Exit a Process, Load or Unload a Module and realized that I’ve seen process crash dumps with such stacks traces. These thread stacks are not normally encountered in healthy process dumps and, statistically speaking, when a process terminates or unloads a library the chances to save a memory dump manually using process dumpers like userdump.exe or Task Manager in Vista are very low unless an interactive debugger was attached or breakpoints were set in advance. Therefore the presence of such threads in a captured crash dump usually indicates some problem or at least focuses attention to the procedure used to save a dump. Such pattern merits its own name: Special Stack Trace.

For example, one process dump had the following stack trace showing process termination initiated from .NET runtime:

STACK_TEXT:
0012fc2c 7c827c1b ntdll!KiFastSystemCallRet
0012fc30 77e668c3 ntdll!NtTerminateProcess+0xc
0012fd24 77e66905 KERNEL32!_ExitProcess+0x63
0012fd38 01256d9b KERNEL32!ExitProcess+0x14
0012ff60 01256dc7 mscorwks!SafeExitProcess+0x11a
0012ff6c 011c5fa4 mscorwks!DisableRuntime+0xd0
0012ffb0 79181b5f mscorwks!_CorExeMain+0x8c
0012ffc0 77e6f23b mscoree!_CorExeMain+0x2c
0012fff0 00000000 KERNEL32!BaseProcessStart+0x23

The original problem was an error message box and the application disappeared when a user dismissed the message. How the dump was saved? Someone advised to attach NTSD to that process, hit ‘g’ and then save the memory dump when the process breaks into the debugger again. So the problem was already gone by that time and the better way would have been to create the manual user dump of that process when it was displaying the error message.

- Dmitry Vostokov @ DumpAnalysis.org -

5 Responses to “Crash Dump Analysis Patterns (Part 40a)”

  1. Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 48) Says:

    […] Special Stack Trace pattern is about stack traces not present in normal crash dumps. The similar pattern is called Special Process which is about processes not running during normal operation or highly domain specific processes that are the sign of certain software environment, for example, OS running inside VMWare or VirtualPC. Here I’ll show one example when identifying specific process led to successful problem identification inside a complete memory dump. […]

  2. Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 59b) Says:

    […] launched CDB attached to it and saved a crash dump. If we open it in WinDbg we get characteristic Special Stack Trace involving loader […]

  3. whunmr Says:

    yes, because stack trace over written, it’s important to capture a dump file in corret and proper time.

  4. Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 65) Says:

    […] Experts Magazine Online Today we introduce an icon for Special Stack Trace […]

  5. Dmitry Vostokov Says:

    Another example is blocked csrss.exe during session logoff in terminal services environments:

    ntdll!KiFastSystemCallRet
    ntdll!NtWaitForMultipleObjects
    kernel32!WaitForMultipleObjectsEx
    kernel32!WaitForMultipleObjects
    winsrv!W32WinStationTerminate
    winsrv!TerminalServerRequestThread

Leave a Reply