Comments on: Crash Dump Analysis Patterns (Part 83) https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Thu, 07 May 2026 03:53:11 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-741644 Dmitry Vostokov Fri, 14 Feb 2014 13:35:19 +0000 https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-741644 Sometimes we need to check return addresses to see whether a function introduced an alternative execution path such as with hooking: [...] retA ntdll!NtCreateFile retB DLL!HookCreateFile retC kernel32!OtherFunction [...] Here we can check what function was called from kernel32!OtherFunction: ub retB [...] call [kernel32!_imp_NtCreateFile] If it is the same function semantically we can assume the hook is pass-through but it is not then we have a divergence of execution flow and we need to pay attention to that. Sometimes we need to check return addresses to see whether a function introduced an alternative execution path such as with hooking:

[…]
retA ntdll!NtCreateFile
retB DLL!HookCreateFile
retC kernel32!OtherFunction
[…]

Here we can check what function was called from kernel32!OtherFunction:

ub retB
[…]
call [kernel32!_imp_NtCreateFile]

If it is the same function semantically we can assume the hook is pass-through but it is not then we have a divergence of execution flow and we need to pay attention to that.

]]> By: Crash Dump Analysis » Blog Archive » Stack trace collection, blocked threads, pass through functions and main thread: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-175793 Crash Dump Analysis » Blog Archive » Stack trace collection, blocked threads, pass through functions and main thread: pattern cooperation Fri, 13 Aug 2010 19:06:55 +0000 https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-175793 [...] functions shown in blue are known from past issues to be pass through forwarding IRP to the lower drivers in a device driver [...] […] functions shown in blue are known from past issues to be pass through forwarding IRP to the lower drivers in a device driver […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 89) https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-100381 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 89) Fri, 23 Oct 2009 20:29:14 +0000 https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-100381 [...] WinDbg to ignore our own functions and modules as well if we are sure they were well-tested or pass-through. For details please see the old minidump analysis case [...] […] WinDbg to ignore our own functions and modules as well if we are sure they were well-tested or pass-through. For details please see the old minidump analysis case […]

]]> By: Crash Dump Analysis » Blog Archive » Hunting for a Driver https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-83184 Crash Dump Analysis » Blog Archive » Hunting for a Driver Mon, 06 Jul 2009 15:55:21 +0000 https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-83184 [...] see that DriverA and DriverB are possibly pass-through and have little influence. For DriverC and DriverD we don’t even have symbol files but they [...] […] see that DriverA and DriverB are possibly pass-through and have little influence. For DriverC and DriverD we don’t even have symbol files but they […]

]]> By: Crash Dump Analysis » Blog Archive » Null data pointer, pass through functions and platformorphic fault: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-79997 Crash Dump Analysis » Blog Archive » Null data pointer, pass through functions and platformorphic fault: pattern cooperation Fri, 19 Jun 2009 23:31:29 +0000 https://www.dumpanalysis.org/blog/index.php/2009/04/14/crash-dump-analysis-patterns-part-83/#comment-79997 [...] DriverA function on the stack trace looks like a passthrough, DriverA was removed from the system. However, the same pattern continued [...] […] DriverA function on the stack trace looks like a passthrough, DriverA was removed from the system. However, the same pattern continued […]

]]>