Comments on: Crash Dump Analysis Patterns (Part 100) https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 05:33:44 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-741671 Dmitry Vostokov Tue, 12 May 2015 22:01:37 +0000 https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-741671 Another example: 002afcd0 765614ab ntdll!ZwWaitForSingleObject+0x15 002afd3c 768b1194 KERNELBASE!WaitForSingleObjectEx+0x98 002afd54 768b1148 kernel32!WaitForSingleObjectExImplementation+0x75 002afd68 002e95de kernel32!WaitForSingleObject+0x12 WARNING: Stack unwind information not available. Following frames may be wrong. 002afd9c 767c8336 HookA+0x95de 002afdcc 767b80a9 USER32!DispatchHookA+0x10e 002afe0c 767c2bfd USER32!CallHookWithSEH+0x21 002afe3c 775b010a USER32!__fnHkINLPMOUSEHOOKSTRUCTEX+0x29 002afed4 00471c64 ntdll!KiUserCallbackDispatcher+0x2e 002afefc 00471d1f ProcessA+0x62d60 [...] 002aff94 775d9f72 kernel32!BaseThreadInitThunk+0xe 002affd4 775d9f45 ntdll!__RtlUserThreadStart+0x70 002affec 00000000 ntdll!_RtlUserThreadStart+0x1b Another example:

002afcd0 765614ab ntdll!ZwWaitForSingleObject+0×15
002afd3c 768b1194 KERNELBASE!WaitForSingleObjectEx+0×98
002afd54 768b1148 kernel32!WaitForSingleObjectExImplementation+0×75
002afd68 002e95de kernel32!WaitForSingleObject+0×12
WARNING: Stack unwind information not available. Following frames may be wrong.
002afd9c 767c8336 HookA+0×95de
002afdcc 767b80a9 USER32!DispatchHookA+0×10e
002afe0c 767c2bfd USER32!CallHookWithSEH+0×21
002afe3c 775b010a USER32!__fnHkINLPMOUSEHOOKSTRUCTEX+0×29
002afed4 00471c64 ntdll!KiUserCallbackDispatcher+0×2e
002afefc 00471d1f ProcessA+0×62d60
[…]
002aff94 775d9f72 kernel32!BaseThreadInitThunk+0xe
002affd4 775d9f45 ntdll!__RtlUserThreadStart+0×70
002affec 00000000 ntdll!_RtlUserThreadStart+0×1b

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 111) https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-197157 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 111) Tue, 26 Oct 2010 21:22:16 +0000 https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-197157 [...] the presence of the whole Pervasive System. It is not just a module that does function and / or message hooking but the whole system of modules from a single vendor that is context-aware (for example, [...] […] the presence of the whole Pervasive System. It is not just a module that does function and / or message hooking but the whole system of modules from a single vendor that is context-aware (for example, […]

]]> By: Crash Dump Analysis » Blog Archive » Models for Memory and Trace Analysis Patterns (Part 3) https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-166376 Crash Dump Analysis » Blog Archive » Models for Memory and Trace Analysis Patterns (Part 3) Tue, 13 Jul 2010 15:56:33 +0000 https://www.dumpanalysis.org/blog/index.php/2010/07/06/crash-dump-analysis-patterns-part-100/#comment-166376 [...] we model Message Hooks pattern using MessageHistory tool. It uses window message hooking mechanism to intercept window [...] […] we model Message Hooks pattern using MessageHistory tool. It uses window message hooking mechanism to intercept window […]

]]>