Archive for October 7th, 2008

Hexadecimal / decimal chaos

Tuesday, October 7th, 2008

Over the time I noticed that some troubleshooting and debugging tools show numbers in hex and some in decimal even for things that are traditionally hex, for example PID and TID. Then when getting data from one program I need to convert it to a different base for another tool. So over some time I was able to get the idea of what hex numbers usually are even if they don’t have hexadecimal ‘A’-'F’ in their digits. For example, in one log I got this output:

Parent changed to 393954

Although this number is valid hex number as well as decimal I had intuitive feeling that it was decimal… Checking source code of the tool revealed that it was output as decimal indeed.

I guess this feeling arouse because I just checked that most window handles that I have seen have the 4th zero digit:

  • Handle: 2801E6
  • Handle: 110044
  • Handle:  10052
  • Handle:  E01B6
  • Handle:  602E2

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Software Technical Support, Tools | No Comments »

Bugtation No.42

Tuesday, October 7th, 2008

Reminiscence on a memory dump as an integer:

“The trouble with” memory dumps “is that we have examined only the very small ones. Maybe all the exciting stuff happens at really big” memory dumps, “ones we can’t even begin to think about in any very definite way. So maybe all the action is really inaccessible and we’re just fiddling around. Our brains have evolved to get us out of the rain, find where the berries are, and keep us from getting killed. Our brains did not evolve to help us grasp really large” memory dumps “or to look at things in a hundred thousand” memory locations.

Ronald Lewis Graham, quoted in “Computers, Pattern, Chaos and Beauty” by Clifford A. Pickover

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Bugtations, Crash Dump Analysis, Debugging, Fun with Crash Dumps, Philosophy, Science of Memory Dump Analysis | No Comments »

From user to kernel dumps

Tuesday, October 7th, 2008

Sometimes application developers with WinDbg live debugging and user dump experience need a quick guide to start with kernel and complete memory dumps. Familiar stack trace browsing commands no longer work and here is preliminary discussion/tutorial on the forum:

http://www.dumpanalysis.org/forum/viewtopic.php?f=10&t=270

If you want to dig deeper please see Moving to kernel space (updated references) post for reading list.

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Crash Dump Analysis, Debugging | No Comments »