Comments on: Crash Dump Analysis Patterns (Part 54) https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 18:57:14 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-741675 Dmitry Vostokov Fri, 12 Jun 2015 17:45:48 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-741675 If PPID doesn't exist anymore we can dump all handle tables from all processes and search for our process object: !handle 0 3 0 Process If PPID doesn’t exist anymore we can dump all handle tables from all processes and search for our process object:

!handle 0 3 0 Process

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-741659 Dmitry Vostokov Thu, 04 Dec 2014 17:29:00 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-741659 You may want to enable object reference tracing for Proc pool tag if you have very large number of such processes especially if they are not reflected as some parent process handle leak. Please see !obtrace example in WinDbg help. We plan to include Reference Leak pattern too. You may want to enable object reference tracing for Proc pool tag if you have very large number of such processes especially if they are not reflected as some parent process handle leak. Please see !obtrace example in WinDbg help. We plan to include Reference Leak pattern too.

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 80) https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-99684 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 80) Sun, 18 Oct 2009 21:17:47 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-99684 [...] difference of this pattern and similar Handle Leak or Zombie Processes is the fact that leaks usually happen when a process forgets to close handles but Process Factory [...] […] difference of this pattern and similar Handle Leak or Zombie Processes is the fact that leaks usually happen when a process forgets to close handles but Process Factory […]

]]> By: Crash Dump Analysis » Blog Archive » Signaled Objects https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-20146 Crash Dump Analysis » Blog Archive » Signaled Objects Thu, 06 Mar 2008 15:35:26 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-20146 [...] Crash Dump Analysis Exploring Crash Dumps and Debugging Techniques on Windows Platforms « Crash Dump Analysis Patterns (Part 54) [...] […] Crash Dump Analysis Exploring Crash Dumps and Debugging Techniques on Windows Platforms « Crash Dump Analysis Patterns (Part 54) […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-19845 Dmitry Vostokov Mon, 03 Mar 2008 06:34:01 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-19845 I specified the wrong address for dispatcher object. Corrected now. Thanks for pointing to this. I'm now writing another blog post to show the difference for SignalState. I specified the wrong address for dispatcher object. Corrected now. Thanks for pointing to this. I’m now writing another blog post to show the difference for SignalState.

]]> By: Taehwa https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-19606 Taehwa Fri, 29 Feb 2008 01:16:05 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/28/crash-dump-analysis-patterns-part-54/#comment-19606 would you exaplain more about SignalState? would you exaplain more about SignalState?

]]>