Comments on: Crash Dump Analysis Patterns (Part 27c) https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 08:55:06 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741763 Dmitry Vostokov Sun, 24 Nov 2019 18:27:07 +0000 https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741763 Windows 10: !findthreads Windows 10: !findthreads

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741732 Dmitry Vostokov Thu, 22 Dec 2016 12:30:35 +0000 https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741732 To list 32-bit stack traces from the specific WOW64 process: !for_each_thread ".thread @#Thread; r $t0 = @#Thread; .if (@@c++(((nt!_KTHREAD *)@$t0)->Process) == <em>ProcessAddress</em>) {.thread /w @#Thread; .reload; kv 256; .effmach AMD64 }" To list 32-bit stack traces from the specific WOW64 process:

!for_each_thread “.thread @#Thread; r $t0 = @#Thread; .if (@@c++(((nt!_KTHREAD *)@$t0)->Process) == ProcessAddress) {.thread /w @#Thread; .reload; kv 256; .effmach AMD64 }”

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741703 Dmitry Vostokov Tue, 10 May 2016 13:11:50 +0000 https://www.dumpanalysis.org/blog/index.php/2011/12/03/crash-dump-analysis-patterns-part-27c/#comment-741703 An example here can be service tags in TEB.SubProcessTag to identify threads from specific service in svchost.exe. An example here can be service tags in TEB.SubProcessTag to identify threads from specific service in svchost.exe.

]]>