Comments on: Crash Dump Analysis Patterns (Part 6a)

By: Dmitry Vostokov

Dmitry Vostokov — Sat, 20 Oct 2018 17:38:32 +0000

Some runtime implementations replace NULL code pointers with some default functions which provide additional diagnostics, for example, in the case of C++ pure virtual call:

0:008> kc
#
00 ucrtbase!abort
01 VCRUNTIME140!_purecall
WARNING: Stack unwind information not available. Following frames may be wrong.
02 ClientTelemetry!Microsoft::Applications::Telemetry::LogManager::checkup
03 ClientTelemetry!Microsoft::Applications::Telemetry::EventProperty::type_name
04 ClientTelemetry!Microsoft::Applications::Telemetry::EventProperty::type_name
05 ClientTelemetry!Microsoft::Applications::Telemetry::EventProperty::type_name
06 ClientTelemetry!Microsoft::Applications::Telemetry::EventProperty::type_name
07 wininet!InternetIndicateStatus
08 wininet!CFsm::RunWorkItem
09 wininet!CSocket::ReceiveCompletion
0a wininet!CWxSocket::IoCompletionCallback
0b KERNELBASE!BasepTpIoCallback
0c ntdll!TppIopExecuteCallback
0d ntdll!TppWorkerThread
0e kernel32!BaseThreadInitThunk
0f ntdll!__RtlUserThreadStart
10 ntdll!_RtlUserThreadStart

By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 9)

Mon, 22 Mar 2010 20:54:55 +0000

[…] Today we introduce an icon for NULL Pointer (code) pattern: […]

By: Crash Dump Analysis » Blog Archive » Hunting for a Driver

Crash Dump Analysis » Blog Archive » Hunting for a Driver — Mon, 06 Jul 2009 15:57:02 +0000

[…] resulted effective address is a NULL code pointer (EAX=3, major code and ESI is […]

By: Crash Dump Analysis » Blog Archive » Stack trace, invalid code pointer and hooked functions: pattern cooperation

Wed, 13 May 2009 13:50:17 +0000

[…] looking at a stack trace of one crashed process we noticed an invalid code pointer. It is not a NULL code pointer but has the same stack trace […]

By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 6b)

Tue, 14 Apr 2009 17:51:03 +0000

[…] Analysis NULL Data Pointer is a special version of the more general Invalid Pointer pattern like NULL Code Pointer. The effective address is below 0xFFFF and it is usually a register with 0 value and the small […]

By: Crash Dump Analysis » Blog Archive » NULL code pointer, changed environment and hooked functions: pattern cooperation

Wed, 04 Feb 2009 17:11:40 +0000

[…] 2009 (0×7D9) - The Year of Debugging 2010 (0×7DA) - The Year of Dump Analysis It was reported that after an upgrade to the new version of a productivity software package one unrelated GUI application started to crash frequently. One crash dump was collected and the following stack trace pointed to a NULL code pointer: […]