Comments on: 10 Common Mistakes in Memory Analysis (Part 2) https://www.dumpanalysis.org/blog/index.php/2008/06/17/10-common-mistakes-in-memory-analysis-part-2/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 23:04:00 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/06/17/10-common-mistakes-in-memory-analysis-part-2/#comment-189716 Dmitry Vostokov Mon, 04 Oct 2010 14:28:40 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/17/10-common-mistakes-in-memory-analysis-part-2/#comment-189716 Another example are very large numbers that may result from inconsistent dumps: <p align="left"><font size="1"><code>0: kd> !poolused 2 Sorting by NonPaged Pool Consumed Pool Used: NonPaged RxBm 9 4294967264 0 0 buffering manager Nbtm -1 4294967248 0 0 NetBT allocations Nb22 -3 4294967152 0 0 NetBT allocations NbL1 -1 4294967112 0 0 NetBT allocations PsEx -12 4294966624 0 0 Process exit APC , Binary: nt!ps IoEr -17 4294966088 0 0 Io error log packets , Binary: nt!io SmSr 24 4294966056 -56 4294963712 Server (special build only) LBwi -58 4294965904 0 0 Work item SmMt -46 4294964872 0 0 mailslot buffer (special build only) Icp -65 4294964696 0 0 I/O completion packets queue on a completion ports 93DC -352 4294958848 0 0 UNKNOWN pooltag '93DC', please update pooltag.txt AfdL -235 4294957896 0 0 Afd local address buffer , Binary: afd.sys ObSt -43 4294957664 0 0 Object Manager temporary storage , Binary: nt!ob tmt. -110 4294956872 0 0 UNKNOWN pooltag ' tmt', please update pooltag.txt TCPa -363 4294955680 0 0 TCP/IP network protocol , Binary: TCP CM 23 4294955576 -2 11240 Configuration Manager (registry) , Binary: nt!cm CcWk -493 4294955464 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc TMsc -327 4294954216 0 0 UNKNOWN pooltag 'TMsc', please update pooltag.txt NbL2 -123 4294944664 0 0 NetBT allocations Psap -405 4294941376 0 0 Block used to hold a user mode APC while its queued to a thread , Binary: nt!ps TCiA -300 4294940896 0 0 TCP/IP network protocol , Binary: TCP NbL3 -146 4294940432 0 0 NetBT allocations LBma -316 4294939488 0 0 Master announce context Nbtl -269 4294928560 0 0 NetBT allocations AfdE -214 4294907376 0 0 Afd endpoint structure , Binary: afd.sys LBpd -581 4294903064 0 0 LM Datagram receiver allocations Ntfi -462 4294841632 0 0 IRP_CONTEXT , Binary: ntfs.sys TCPA -371 4294830768 0 0 TCP/IP network protocol , Binary: TCP TCiV -3100 4294818496 0 0 TCP/IP network protocol , Binary: TCP NpFR -280 4294699712 0 0 UNKNOWN pooltag 'NpFR', please update pooltag.txt LvKd -139 4294397952 0 0 UNKNOWN pooltag 'LvKd', please update pooltag.txt TCPB -510 4294194704 0 0 TCP/IP network protocol , Binary: TCP</code></font> Another example are very large numbers that may result from inconsistent dumps:

0: kd> !poolused 2
Sorting by NonPaged Pool Consumed
Pool Used:
NonPaged
RxBm 9 4294967264 0 0 buffering manager
Nbtm -1 4294967248 0 0 NetBT allocations
Nb22 -3 4294967152 0 0 NetBT allocations
NbL1 -1 4294967112 0 0 NetBT allocations
PsEx -12 4294966624 0 0 Process exit APC , Binary: nt!ps
IoEr -17 4294966088 0 0 Io error log packets , Binary: nt!io
SmSr 24 4294966056 -56 4294963712 Server (special build only)
LBwi -58 4294965904 0 0 Work item
SmMt -46 4294964872 0 0 mailslot buffer (special build only)
Icp -65 4294964696 0 0 I/O completion packets queue on a completion ports
93DC -352 4294958848 0 0 UNKNOWN pooltag '93DC', please update pooltag.txt
AfdL -235 4294957896 0 0 Afd local address buffer , Binary: afd.sys
ObSt -43 4294957664 0 0 Object Manager temporary storage , Binary: nt!ob
tmt. -110 4294956872 0 0 UNKNOWN pooltag ' tmt', please update pooltag.txt
TCPa -363 4294955680 0 0 TCP/IP network protocol , Binary: TCP
CM 23 4294955576 -2 11240 Configuration Manager (registry) , Binary: nt!cm
CcWk -493 4294955464 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc
TMsc -327 4294954216 0 0 UNKNOWN pooltag 'TMsc', please update pooltag.txt
NbL2 -123 4294944664 0 0 NetBT allocations
Psap -405 4294941376 0 0 Block used to hold a user mode APC while its queued to a thread , Binary: nt!ps
TCiA -300 4294940896 0 0 TCP/IP network protocol , Binary: TCP
NbL3 -146 4294940432 0 0 NetBT allocations
LBma -316 4294939488 0 0 Master announce context
Nbtl -269 4294928560 0 0 NetBT allocations
AfdE -214 4294907376 0 0 Afd endpoint structure , Binary: afd.sys
LBpd -581 4294903064 0 0 LM Datagram receiver allocations
Ntfi -462 4294841632 0 0 IRP_CONTEXT , Binary: ntfs.sys
TCPA -371 4294830768 0 0 TCP/IP network protocol , Binary: TCP
TCiV -3100 4294818496 0 0 TCP/IP network protocol , Binary: TCP
NpFR -280 4294699712 0 0 UNKNOWN pooltag 'NpFR', please update pooltag.txt
LvKd -139 4294397952 0 0 UNKNOWN pooltag 'LvKd', please update pooltag.txt
TCPB -510 4294194704 0 0 TCP/IP network protocol , Binary: TCP

]]> By: Crash Dump Analysis » Blog Archive » The Importance of Symbols https://www.dumpanalysis.org/blog/index.php/2008/06/17/10-common-mistakes-in-memory-analysis-part-2/#comment-79003 Crash Dump Analysis » Blog Archive » The Importance of Symbols Sun, 14 Jun 2009 11:08:26 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/17/10-common-mistakes-in-memory-analysis-part-2/#comment-79003 [...] string comparison function could be called from Application code it has a semantic inconsistency: FreeHeap surely wouldn’t call Application code. So why it appears on the stack trace? To [...] […] string comparison function could be called from Application code it has a semantic inconsistency: FreeHeap surely wouldn’t call Application code. So why it appears on the stack trace? To […]

]]>