Structural Memory Patterns (Part 7)

In order to start the analysis of a structured memory snapshot a debugger engine needs Anchor Region that describes memory layout and where to start unfolding of analysis. For example, it can be a list of modules (another forthcoming structural pattern). We can observe the importance of such regions when we try to open corrupt or severely truncated memory dumps:

KdDebuggerDataBlock is not present or unreadable.
Unable to read PsLoadedModuleList

For certain types of memory snapshots (like software traces) an anchor region coinsides with its structure description (message trace format for structured snapshots) and a trace file header (if any) for aggregate snapshots.

- Dmitry Vostokov @ + -

One Response to “Structural Memory Patterns (Part 7)”

  1. Dmitry Vostokov Says:

    Undocumented WinDbg command .dumpdebug can show some anchor values

Leave a Reply

You must be logged in to post a comment.