Comments on: Crash Dump Analysis Patterns (Part 74) https://www.dumpanalysis.org/blog/index.php/2008/08/05/crash-dump-analysis-patterns-part-74/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 09:58:24 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/08/05/crash-dump-analysis-patterns-part-74/#comment-741665 Dmitry Vostokov Sat, 21 Mar 2015 19:51:27 +0000 https://www.dumpanalysis.org/blog/index.php/2008/08/05/crash-dump-analysis-patterns-part-74/#comment-741665 In case of Virtualized Processes !gle may show Win32 last error and status values incorrectly: 0:000:x86> !gle LastErrorValue: (Win32) 0 (0) - The operation completed successfully. LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0 Wow64 TEB status: LastErrorValue: (Win32) 0 (0) - The operation completed successfully. LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0 0:000:x86> !teb Wow64 TEB32 at 00000000fffde000 ExceptionList: 00000000002fb108 StackBase: 0000000000390000 StackLimit: 0000000000255000 SubSystemTib: 0000000000000000 FiberData: 0000000000001e00 ArbitraryUserPointer: 0000000000000000 Self: 00000000fffde000 EnvironmentPointer: 0000000000000000 ClientId: 00000000000016d8 . 00000000000011e0 RpcHandle: 0000000000000000 Tls Storage: 0000000000e12978 PEB Address: 00000000fffdf000 LastErrorValue: 38 LastStatusValue: c0000011 Count Owned Locks: 0 HardErrorMode: 0 Wow64 TEB at 00000000fffdc000 ExceptionList: 00000000fffde000 StackBase: 000000000008fd30 StackLimit: 0000000000083000 SubSystemTib: 0000000000000000 FiberData: 0000000000001e00 ArbitraryUserPointer: 0000000000000000 Self: 00000000fffdc000 EnvironmentPointer: 0000000000000000 ClientId: 00000000000016d8 . 00000000000011e0 RpcHandle: 0000000000000000 Tls Storage: 0000000000000000 PEB Address: 00000000fffd6000 LastErrorValue: 0 LastStatusValue: 0 Count Owned Locks: 0 HardErrorMode: 0 In case of Virtualized Processes !gle may show Win32 last error and status values incorrectly:

0:000:x86> !gle
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0
Wow64 TEB status:
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0

0:000:x86> !teb
Wow64 TEB32 at 00000000fffde000
ExceptionList: 00000000002fb108
StackBase: 0000000000390000
StackLimit: 0000000000255000
SubSystemTib: 0000000000000000
FiberData: 0000000000001e00
ArbitraryUserPointer: 0000000000000000
Self: 00000000fffde000
EnvironmentPointer: 0000000000000000
ClientId: 00000000000016d8 . 00000000000011e0
RpcHandle: 0000000000000000
Tls Storage: 0000000000e12978
PEB Address: 00000000fffdf000
LastErrorValue: 38
LastStatusValue: c0000011
Count Owned Locks: 0
HardErrorMode: 0

Wow64 TEB at 00000000fffdc000
ExceptionList: 00000000fffde000
StackBase: 000000000008fd30
StackLimit: 0000000000083000
SubSystemTib: 0000000000000000
FiberData: 0000000000001e00
ArbitraryUserPointer: 0000000000000000
Self: 00000000fffdc000
EnvironmentPointer: 0000000000000000
ClientId: 00000000000016d8 . 00000000000011e0
RpcHandle: 0000000000000000
Tls Storage: 0000000000000000
PEB Address: 00000000fffd6000
LastErrorValue: 0
LastStatusValue: 0
Count Owned Locks: 0
HardErrorMode: 0

]]> By: Crash Dump Analysis » Blog Archive » Heap and early crash dump: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/08/05/crash-dump-analysis-patterns-part-74/#comment-40730 Crash Dump Analysis » Blog Archive » Heap and early crash dump: pattern cooperation Tue, 02 Sep 2008 16:15:17 +0000 https://www.dumpanalysis.org/blog/index.php/2008/08/05/crash-dump-analysis-patterns-part-74/#comment-40730 [...] one of last error values was access violation (Last Error Collection [...] […] one of last error values was access violation (Last Error Collection […]

]]>