Comments on: 10 Common Mistakes in Memory Analysis (Part 6) https://www.dumpanalysis.org/blog/index.php/2009/12/08/10-common-mistakes-in-memory-analysis-part-6/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 16:25:10 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/12/08/10-common-mistakes-in-memory-analysis-part-6/#comment-741748 Dmitry Vostokov Sun, 28 Jan 2018 12:07:13 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/08/10-common-mistakes-in-memory-analysis-part-6/#comment-741748 Some WinDbg debugger commands are context sensitive. For example, .trap command is incompatible with !running -t command: the latter shows all CPU threads having the same stack trace as in the output of k after .trap. Some WinDbg debugger commands are context sensitive. For example, .trap command is incompatible with !running -t command: the latter shows all CPU threads having the same stack trace as in the output of k after .trap.

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/12/08/10-common-mistakes-in-memory-analysis-part-6/#comment-741640 Dmitry Vostokov Tue, 12 Nov 2013 12:55:20 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/08/10-common-mistakes-in-memory-analysis-part-6/#comment-741640 Another example, is when we are in x86 mode initially in a complete memory dump: 16.0: kd:x86> .load wow64exts 16.0: kd:x86> !sw The context is partially valid. Only x86 user-mode context is available. Switched to 64bit mode 16.0: kd> Another example, is when we are in x86 mode initially in a complete memory dump:

16.0: kd:x86> .load wow64exts
16.0: kd:x86> !sw
The context is partially valid. Only x86 user-mode context is available.
Switched to 64bit mode
16.0: kd>

]]>