Comments on: Crash Dump Analysis Patterns (Part 52) https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 04:28:25 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-741679 Dmitry Vostokov Mon, 10 Aug 2015 19:31:18 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-741679 Sometimes, such truncated stack traces hide Self-Dump processing: 4 Id: 10e4.2838 Suspend: 0 Teb: 7efa6000 Unfrozen ChildEBP RetAddr 026beb1c 00000000 ntdll!NtGetContextThread+0x12 We need to examine raw stack Execution Residue to see the presence of DbgHelp API. Sometimes, such truncated stack traces hide Self-Dump processing:

4 Id: 10e4.2838 Suspend: 0 Teb: 7efa6000 Unfrozen
ChildEBP RetAddr
026beb1c 00000000 ntdll!NtGetContextThread+0×12

We need to examine raw stack Execution Residue to see the presence of DbgHelp API.

]]> By: Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-186345 Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 1) Fri, 24 Sep 2010 10:57:32 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-186345 [...] Self-Dump [...] […] Self-Dump […]

]]> By: Crash Dump Analysis » Blog Archive » On Self Dumps of Secure String API https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-84701 Crash Dump Analysis » Blog Archive » On Self Dumps of Secure String API Tue, 14 Jul 2009 17:21:10 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-84701 [...] we have an instance of Self-Dump pattern here. In case of custom unhandled exception filters not resorting to WER faulrep.dll [...] […] we have an instance of Self-Dump pattern here. In case of custom unhandled exception filters not resorting to WER faulrep.dll […]

]]> By: Crash Dump Analysis » Blog Archive » Blocked threads, message box and self-diagnosis: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-70304 Crash Dump Analysis » Blog Archive » Blocked threads, message box and self-diagnosis: pattern cooperation Fri, 03 Apr 2009 16:55:50 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/22/crash-dump-analysis-patterns-part-52/#comment-70304 [...] message box parameters we see a self-diagnostic [...] […] message box parameters we see a self-diagnostic […]

]]>