Comments on: Crash Dump Analysis Patterns (Part 59) https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sun, 17 May 2026 11:07:53 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 92) https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-106047 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 92) Tue, 24 Nov 2009 00:30:42 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-106047 [...] we should check if it is exited but references to it exist or there are any missing threads or components inside it, any suspended threads and special processes like a postmortem debugger. We [...] […] we should check if it is exited but references to it exist or there are any missing threads or components inside it, any suspended threads and special processes like a postmortem debugger. We […]

]]> By: Crash Dump Analysis » Blog Archive » DLL Link Patterns https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-65353 Crash Dump Analysis » Blog Archive » DLL Link Patterns Tue, 17 Feb 2009 08:57:36 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-65353 [...] Missing Component (general) [...] […] Missing Component (general) […]

]]> By: Software Generalist » Blog Archive » Reading Notebook: 16-Feb-09 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-65283 Software Generalist » Blog Archive » Reading Notebook: 16-Feb-09 Mon, 16 Feb 2009 17:01:31 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-65283 [...] problems (pp. 122 -127) - For Windows, I’ve identified 2 patterns so far: http://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/ and [...] […] problems (pp. 122 -127) - For Windows, I’ve identified 2 patterns so far: http://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/ and […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 59b) https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-30178 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 59b) Thu, 12 Jun 2008 16:47:56 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-30178 [...] I introduced Missing Component pattern where the example and emphasis was on dynamically loaded modules. In this part I cover [...] […] I introduced Missing Component pattern where the example and emphasis was on dynamically loaded modules. In this part I cover […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-24262 Dmitry Vostokov Wed, 23 Apr 2008 14:29:06 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-24262 I forgot to include !teb in the post. Corrected it now: 0:000> !teb TEB at 7ffdf000 ExceptionList: 0024f8c4 StackBase: 00250000 StackLimit: 00249000 SubSystemTib: 00000000 FiberData: 00001e00 ArbitraryUserPointer: 00000000 Self: 7ffdf000 EnvironmentPointer: 00000000 ClientId: 000012f4 . 00001080 RpcHandle: 00000000 Tls Storage: 004e8a18 PEB Address: 7ffde000 LastErrorValue: 126 LastStatusValue: c0000135 Count Owned Locks: 0 HardErrorMode: 0 I forgot to include !teb in the post. Corrected it now:

0:000> !teb
TEB at 7ffdf000
ExceptionList: 0024f8c4
StackBase: 00250000
StackLimit: 00249000
SubSystemTib: 00000000
FiberData: 00001e00
ArbitraryUserPointer: 00000000
Self: 7ffdf000
EnvironmentPointer: 00000000
ClientId: 000012f4 . 00001080
RpcHandle: 00000000
Tls Storage: 004e8a18
PEB Address: 7ffde000
LastErrorValue: 126
LastStatusValue: c0000135
Count Owned Locks: 0
HardErrorMode: 0

]]> By: Marc Sherman https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-24261 Marc Sherman Wed, 23 Apr 2008 14:10:05 +0000 https://www.dumpanalysis.org/blog/index.php/2008/04/22/crash-dump-analysis-patterns-part-59/#comment-24261 When searching the stack, how did you decide to start at 00249000? The lowest address given by kL is 0024f1f8 (child ebp for kernel32!RaiseException). The difference of the two is over 24K. thanks, Marc When searching the stack, how did you decide to start at 00249000? The lowest address given by kL is 0024f1f8 (child ebp for kernel32!RaiseException). The difference of the two is over 24K.

thanks,
Marc

]]>