Comments on: Crash Dump Analysis Patterns (Part 40a) https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 20:38:24 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-343948 Dmitry Vostokov Wed, 21 Sep 2011 16:55:47 +0000 https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-343948 Another example is blocked csrss.exe during session logoff in terminal services environments: ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects winsrv!W32WinStationTerminate winsrv!TerminalServerRequestThread Another example is blocked csrss.exe during session logoff in terminal services environments:

ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects
kernel32!WaitForMultipleObjectsEx
kernel32!WaitForMultipleObjects
winsrv!W32WinStationTerminate
winsrv!TerminalServerRequestThread

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 65) https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-179288 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 65) Fri, 27 Aug 2010 15:44:31 +0000 https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-179288 [...] Experts Magazine Online Today we introduce an icon for Special Stack Trace [...] […] Experts Magazine Online Today we introduce an icon for Special Stack Trace […]

]]> By: whunmr https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-113603 whunmr Sat, 02 Jan 2010 21:32:38 +0000 https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-113603 yes, because stack trace over written, it's important to capture a dump file in corret and proper time. yes, because stack trace over written, it’s important to capture a dump file in corret and proper time.

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 59b) https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-30181 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 59b) Thu, 12 Jun 2008 16:49:41 +0000 https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-30181 [...] launched CDB attached to it and saved a crash dump. If we open it in WinDbg we get characteristic Special Stack Trace involving loader [...] […] launched CDB attached to it and saved a crash dump. If we open it in WinDbg we get characteristic Special Stack Trace involving loader […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 48) https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-18291 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 48) Tue, 12 Feb 2008 13:05:24 +0000 https://www.dumpanalysis.org/blog/index.php/2007/12/10/crash-dump-analysis-patterns-part-40a/#comment-18291 [...] Special Stack Trace pattern is about stack traces not present in normal crash dumps. The similar pattern is called Special Process which is about processes not running during normal operation or highly domain specific processes that are the sign of certain software environment, for example, OS running inside VMWare or VirtualPC. Here I’ll show one example when identifying specific process led to successful problem identification inside a complete memory dump. [...] […] Special Stack Trace pattern is about stack traces not present in normal crash dumps. The similar pattern is called Special Process which is about processes not running during normal operation or highly domain specific processes that are the sign of certain software environment, for example, OS running inside VMWare or VirtualPC. Here I’ll show one example when identifying specific process led to successful problem identification inside a complete memory dump. […]

]]>