<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.3.3" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>
<channel>
	<title>Comments on: Crash Dump Analysis Patterns (Part 69b)</title>
	<link>https://www.dumpanalysis.org/blog/index.php/2011/04/26/crash-dump-analysis-patterns-part-69b/</link>
	<description>Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics</description>
	<pubDate>Tue, 05 May 2026 14:40:07 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.3.3</generator>
		<item>
		<title>By: Dmitry Vostokov</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2011/04/26/crash-dump-analysis-patterns-part-69b/#comment-741737</link>
		<dc:creator>Dmitry Vostokov</dc:creator>
		<pubDate>Wed, 19 Apr 2017 06:05:45 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2011/04/26/crash-dump-analysis-patterns-part-69b/#comment-741737</guid>
		<description>Another example:

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd0002926ff90, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd0002926fee8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved</description>
		<content:encoded><![CDATA[<p>Another example:</p>
<p>KERNEL_SECURITY_CHECK_FAILURE (139)<br />
A kernel component has corrupted a critical data structure.  The corruption<br />
could potentially allow a malicious user to gain control of this machine.<br />
Arguments:<br />
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).<br />
Arg2: ffffd0002926ff90, Address of the trap frame for the exception that caused the bugcheck<br />
Arg3: ffffd0002926fee8, Address of the exception record for the exception that caused the bugcheck<br />
Arg4: 0000000000000000, Reserved</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dmitry Vostokov</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2011/04/26/crash-dump-analysis-patterns-part-69b/#comment-682399</link>
		<dc:creator>Dmitry Vostokov</dc:creator>
		<pubDate>Wed, 23 Jan 2013 00:01:06 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2011/04/26/crash-dump-analysis-patterns-part-69b/#comment-682399</guid>
		<description>Another example is this bugcheck:

&lt;p align="left"&gt;&lt;font size="1"&gt;&lt;code&gt;CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: [...], Reserved
Arg2: [...], Reserved
Arg3: [...], Failure type dependent information
Arg4: 0000000000000002, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification&lt;/code&gt;&lt;/font&gt;&lt;/p&gt;</description>
		<content:encoded><![CDATA[<p>Another example is this bugcheck:</p>
<p align="left"><font size="1"><code>CRITICAL_STRUCTURE_CORRUPTION (109)<br />
This bugcheck is generated when the kernel detects that critical kernel code or<br />
data have been corrupted. There are generally three causes for a corruption:<br />
1) A driver has inadvertently or deliberately modified critical kernel code<br />
 or data. See <a href="http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx" rel="nofollow">http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx</a><br />
2) A developer attempted to set a normal kernel breakpoint using a kernel<br />
 debugger that was not attached when the system was booted. Normal breakpoints,<br />
 &#8220;bp&#8221;, can only be set if the debugger is attached at boot time. Hardware<br />
 breakpoints, &#8220;ba&#8221;, can be set at any time.<br />
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.<br />
Arguments:<br />
Arg1: [&#8230;], Reserved<br />
Arg2: [&#8230;], Reserved<br />
Arg3: [&#8230;], Failure type dependent information<br />
Arg4: 0000000000000002, Type of corrupted region, can be<br />
	0 : A generic data region<br />
	1 : Modification of a function or .pdata<br />
	2 : A processor IDT<br />
	3 : A processor GDT<br />
	4 : Type 1 process list corruption<br />
	5 : Type 2 process list corruption<br />
	6 : Debug routine modification<br />
	7 : Critical MSR modification</code></font></p>
]]></content:encoded>
	</item>
</channel>
</rss>
