Structural Memory Patterns (Part 7)
In order to start the analysis of a structured memory snapshot a debugger engine needs Anchor Region that describes memory layout and where to start unfolding of analysis. For example, it can be a list of modules (another forthcoming structural pattern). We can observe the importance of such regions when we try to open corrupt or severely truncated memory dumps:
[...]
KdDebuggerDataBlock is not present or unreadable.
[...]
Unable to read PsLoadedModuleList
[...]
For certain types of memory snapshots (like software traces) an anchor region coinsides with its structure description (message trace format for structured snapshots) and a trace file header (if any) for aggregate snapshots.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
March 13th, 2016 at 2:53 pm
Undocumented WinDbg command .dumpdebug can show some anchor values http://sww-it.ru/2016-03-13/1320