Crash Dump Analysis Patterns (Part 140)
In this part we introduce Coupled Modules pattern. Often we identify a pattern that points to a particular module such as a driver or DLL other modules could use functional services from and, therefore, the latter modules can be implicated in abnormal software behavior. For example, detected insufficient kernel paged pool memory pointed to a driver that owns a pool tag DRV:
1: kd> !poolused 4
Sorting by Paged Pool Consumed
Tag Allocs Frees Diff Used
DRV 1466496 1422361 44135 188917256 UNKNOWN pooltag ‘DRV ‘, please update pooltag.txt
File 6334830 6284036 50794 6735720 File objects
Thre 53721 45152 8569 4346432 Thread objects , Binary: nt!ps
[…]
This module is known to be a directing module to other drivers (from stack trace perspective) but we also know that other (directed) modules use its services that require memory allocation.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
August 22nd, 2020 at 5:18 pm
We can also see if 2 modules are coupled statically by examining their import tables (!dh).