https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 22:57:21 +0000 http://wordpress.org/?v=2.3.3 https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-159951 Crash Dump Analysis » Blog Archive » Old Mental Dumps from June 21st Mon, 21 Jun 2010 11:09:09 +0000 https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-159951 [...] • Crash Dump Analysis Patterns (Part 16a) - Stack overflow in kernel. Generated some comments and can also be see in the following pattern case study: Lateral damage, stack overflow and execution residue [...] […] • Crash Dump Analysis Patterns (Part 16a) - Stack overflow in kernel. Generated some comments and can also be see in the following pattern case study: Lateral damage, stack overflow and execution residue […]

]]> https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-139574 Dmitry Vostokov Tue, 30 Mar 2010 18:47:59 +0000 https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-139574 Thanks! Have never considered the possibility of being uninitialized. Now I'm thinking about another pattern (if I find other cases) Thanks! Have never considered the possibility of being uninitialized. Now I’m thinking about another pattern (if I find other cases)

]]> https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-139563 OZone Tue, 30 Mar 2010 17:55:08 +0000 https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-139563 Backlink of TSS that you have pointed to was not corrupted. It is just uninitialized. See SS0, ESP0, Flags and LDT - they are valid. So the structure itself is not corrupted. It has never been used instead. On doublefault Windows uses task gate #8 in IDT. Backlink of TSS that you have pointed to was not corrupted. It is just uninitialized. See SS0, ESP0, Flags and LDT - they are valid. So the structure itself is not corrupted. It has never been used instead. On doublefault Windows uses task gate #8 in IDT.

]]> https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-86321 Ivan Bohannon Tue, 28 Jul 2009 14:57:43 +0000 https://www.dumpanalysis.org/blog/index.php/2008/11/05/lateral-damage-stack-overflow-and-execution-residue-pattern-cooperation/#comment-86321 Thank you, I was able to extract more information from a customers "corrupted" crash dump with this writeup. Thank you, I was able to extract more information from a customers “corrupted” crash dump with this writeup.

]]>