Comments on: Crash Dump Analysis Patterns (Part 90) https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Mon, 18 May 2026 03:00:31 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-741647 Dmitry Vostokov Fri, 30 May 2014 12:29:09 +0000 https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-741647 The other way around, when CLR exception is enveloped by unmanaged exception is possible like in this example: http://blogs.msdn.com/b/ntdebugging/archive/2014/05/28/debugging-a-windows-8-1-store-app-crash-dump-part-2.aspx The other way around, when CLR exception is enveloped by unmanaged exception is possible like in this example:
http://blogs.msdn.com/b/ntdebugging/archive/2014/05/28/debugging-a-windows-8-1-store-app-crash-dump-part-2.aspx

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-101303 Dmitry Vostokov Thu, 29 Oct 2009 08:57:11 +0000 https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-101303 Yes, it corresponds because it calls it: <code>0:000> ub 77f299f7 ntdll!KiUserCallbackDispatcher+0x42: 77f299e2 ret 0Ch 77f299e5 lea ecx,[ecx] ntdll!KiUserExceptionDispatcher: 77f299e8 cld 77f299e9 mov ecx,dword ptr [esp+4] 77f299ed mov ebx,dword ptr [esp] <font color="blue">77f299f0 push ecx 77f299f1 push ebx 77f299f2 call ntdll!RtlDispatchException (77f0d132)</font></code> Yes, it corresponds because it calls it:

0:000> ub 77f299f7
ntdll!KiUserCallbackDispatcher+0x42:
77f299e2 ret 0Ch
77f299e5 lea ecx,[ecx]
ntdll!KiUserExceptionDispatcher:
77f299e8 cld
77f299e9 mov ecx,dword ptr [esp+4]
77f299ed mov ebx,dword ptr [esp]
77f299f0 push ecx
77f299f1 push ebx
77f299f2 call ntdll!RtlDispatchException (77f0d132)

]]> By: Marc Sherman https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-101271 Marc Sherman Thu, 29 Oct 2009 04:07:43 +0000 https://www.dumpanalysis.org/blog/index.php/2009/10/28/crash-dump-analysis-patterns-part-90/#comment-101271 Hello, From <code>0012e73c 77f299f7 ntdll!KiUserExceptionDispatcher+0xf 0012e740 0012e750 0012e744 0012e76c</code> Does this correspond to the args for the call to ntdll!RtlDispatchException? If so, then 0012e76c is the 2nd arg to ntdll!RtlDispatchException which is the context record? thanks, Marc Hello,

From

0012e73c 77f299f7 ntdll!KiUserExceptionDispatcher+0xf
0012e740 0012e750
0012e744 0012e76c

Does this correspond to the args for the call to ntdll!RtlDispatchException?

If so, then 0012e76c is the 2nd arg to ntdll!RtlDispatchException which is the context record?

thanks,
Marc

]]>