Comments on: Crash Dump Analysis Patterns (Part 61) https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sat, 16 May 2026 13:33:22 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-741716 Dmitry Vostokov Mon, 19 Sep 2016 12:09:44 +0000 https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-741716 Enabling application verifier in gflags.exe to catch handle close stack traces may also reveal who closed the handle originally before we get the second invalid handle close. Use !htrace command there. Enabling application verifier in gflags.exe to catch handle close stack traces may also reveal who closed the handle originally before we get the second invalid handle close. Use !htrace command there.

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-741620 Dmitry Vostokov Thu, 05 Sep 2013 12:40:49 +0000 https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-741620 We can also check if the handle value is valid or not: <p align="left">STACK_TEXT: 0fbef7f8 7581c455 00000aa4 00000aa4 0fbef818 ntdll!ZwClose+0x12 0fbef808 76051438 00000aa4 0000000d 00000000 KERNELBASE!CloseHandle+0x2d 0fbef818 5fa2632a 00000aa4 5fa24b9c 00000000 kernel32!CloseHandleImplementation+0x3f [...]</p> 0:017> !handle 0000aa4 Handle 00000aa4 Type <Error retrieving type> 0:017> !handle 0000aa0 Handle 00000aa0 Type Thread 0:017> !handle 0000aa8 Handle 00000aa8 Type Event We can also check if the handle value is valid or not:

STACK_TEXT:
0fbef7f8 7581c455 00000aa4 00000aa4 0fbef818 ntdll!ZwClose+0×12
0fbef808 76051438 00000aa4 0000000d 00000000 KERNELBASE!CloseHandle+0×2d
0fbef818 5fa2632a 00000aa4 5fa24b9c 00000000 kernel32!CloseHandleImplementation+0×3f
[…]

0:017> !handle 0000aa4
Handle 00000aa4
Type

0:017> !handle 0000aa0
Handle 00000aa0
Type Thread

0:017> !handle 0000aa8
Handle 00000aa8
Type Event

]]> By: Crash Dump Analysis » Blog Archive » Invalid handle, stack trace collection, multiple exceptions, invalid pointer, data alignment on page boundary, dynamic memory corruption and not my version: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-59060 Crash Dump Analysis » Blog Archive » Invalid handle, stack trace collection, multiple exceptions, invalid pointer, data alignment on page boundary, dynamic memory corruption and not my version: pattern cooperation Tue, 09 Dec 2008 17:17:16 +0000 https://www.dumpanalysis.org/blog/index.php/2008/05/20/crash-dump-analysis-patterns-part-61/#comment-59060 [...] process dump with many patterns seen inside. Default WinDbg analysis command !analyze -v points to invalid handle exception perhaps during DLL initialization during thread attach to DllA [...] […] process dump with many patterns seen inside. Default WinDbg analysis command !analyze -v points to invalid handle exception perhaps during DLL initialization during thread attach to DllA […]

]]>