Comments on: Crash Dump Analysis Patterns (Part 64) https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 11:14:44 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » The Memory Visualization Question from Webinar https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-180317 Crash Dump Analysis » Blog Archive » The Memory Visualization Question from Webinar Wed, 01 Sep 2010 14:59:04 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-180317 [...] I also thought that there was the same module loaded twice from different location like in Duplicated Module pattern. Unfortunately lm command didn’t show any duplicated loaded and unloaded modules as [...] […] I also thought that there was the same module loaded twice from different location like in Duplicated Module pattern. Unfortunately lm command didn’t show any duplicated loaded and unloaded modules as […]

]]> By: Venu https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-109988 Venu Wed, 16 Dec 2009 15:44:40 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-109988 From the list of modules we are able to see two modules are duplicated. Is there any way to find out, who called the moduled to load into memory. I would like to see the calling function (the originator of duplication). From the list of modules we are able to see two modules are duplicated. Is there any way to find out, who called the moduled to load into memory. I would like to see the calling function (the originator of duplication).

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-66666 Dmitry Vostokov Sun, 01 Mar 2009 10:07:53 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-66666 I don't see contradiction here: Timestamp is for the link time not the load time and the loader is free to choose the base address. What do you think in the output contradicts that? I don’t see contradiction here: Timestamp is for the link time not the load time and the loader is free to choose the base address. What do you think in the output contradicts that?

]]> By: Soren Dreijer https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-66552 Soren Dreijer Sat, 28 Feb 2009 15:26:51 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-66552 > We can also see that the old version of MyDLL was the last loaded DLL That statement contradicts the following output where it's clear that the old DLL was loaded first: 0:000> lmv m MyDLL_1e60000 start end module name 00000000`01e60000 00000000`01e71000 MyDLL_1e60000 Loaded symbol image file: MyDLL.dll Image path: C:\OLD\MyDLL.dll Image name: MyDLL.dll Timestamp: Wed Jun 18 14:49:13 2008 (48591259) […] 0:000> lmv m MyDLL start end module name 00000001`80000000 00000001`80011000 MyDLL Image path: C:\2DLLs\DLL\MyDLL.dll Image name: MyDLL.dll Timestamp: Wed Jun 18 14:50:56 2008 (485912C0) [...] > We can also see that the old version of MyDLL was the last loaded DLL

That statement contradicts the following output where it’s clear that the old DLL was loaded first:

0:000> lmv m MyDLL_1e60000
start end module name
00000000`01e60000 00000000`01e71000 MyDLL_1e60000
Loaded symbol image file: MyDLL.dll
Image path: C:\OLD\MyDLL.dll
Image name: MyDLL.dll
Timestamp: Wed Jun 18 14:49:13 2008 (48591259)
[…]

0:000> lmv m MyDLL
start end module name
00000001`80000000 00000001`80011000 MyDLL
Image path: C:\2DLLs\DLL\MyDLL.dll
Image name: MyDLL.dll
Timestamp: Wed Jun 18 14:50:56 2008 (485912C0)
[…]

]]> By: Crash Dump Analysis » Blog Archive » DLL Link Patterns https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-65357 Crash Dump Analysis » Blog Archive » DLL Link Patterns Tue, 17 Feb 2009 09:14:23 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-65357 [...] Duplicated Module [...] […] Duplicated Module […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 65) https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-30854 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 65) Thu, 19 Jun 2008 17:20:10 +0000 https://www.dumpanalysis.org/blog/index.php/2008/06/19/crash-dump-analysis-patterns-part-64/#comment-30854 [...] Crash Dump Analysis Exploring Crash Dumps and Debugging Techniques on Windows Platforms « Crash Dump Analysis Patterns (Part 64) [...] […] Crash Dump Analysis Exploring Crash Dumps and Debugging Techniques on Windows Platforms « Crash Dump Analysis Patterns (Part 64) […]

]]>