From Bugchecks to Patterns

One of the questions asked during Introduction to Pattern-Driven Software Problem Solving¬†Webinar was how to map bugcheck codes to crash dump analysis patterns. I’m starting this post to provide a few initial mappings and plan to extend it later.

BAD_POOL_CALLER (c2)

BAD_POOL_HEADER (19)

Dynamic Memory Corruption (kernel pool)

Self-Diagnosis (kernel mode)

UNEXPECTED_KERNEL_MODE_TRAP (7f)
Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO

Divide by Zero (kernel mode)

NO_MORE_IRP_STACK_LOCATIONS (35)

Stack Overflow (software implementation)

MANUALLY_INITIATED_CRASH (e2)

NMI_HARDWARE_FAILURE (80)

CRITICAL_OBJECT_TERMINATION (f4)

KMODE_EXCEPTION_NOT_HANDLED (1e)
Arg2: 000000000000f001, The address that the exception occurred at

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arg4: 0000f001, address which referenced memory

Manual Dump (kernel)

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Leave a Reply