Comments on: Crash Dump Analysis Patterns (Part 161) https://www.dumpanalysis.org/blog/index.php/2011/12/12/crash-dump-analysis-patterns-part-161/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 06:07:28 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2011/12/12/crash-dump-analysis-patterns-part-161/#comment-392547 Dmitry Vostokov Wed, 14 Dec 2011 21:18:11 +0000 https://www.dumpanalysis.org/blog/index.php/2011/12/12/crash-dump-analysis-patterns-part-161/#comment-392547 I think it needs EIP to show the top stack frame correctly pointing to the currently executing instruction. Here it doesn't matter I think it needs EIP to show the top stack frame correctly pointing to the currently executing instruction. Here it doesn’t matter

]]> By: Marc Sherman https://www.dumpanalysis.org/blog/index.php/2011/12/12/crash-dump-analysis-patterns-part-161/#comment-391463 Marc Sherman Tue, 13 Dec 2011 14:14:17 +0000 https://www.dumpanalysis.org/blog/index.php/2011/12/12/crash-dump-analysis-patterns-part-161/#comment-391463 "0:002> k L=0110f650 0110f650 0110f650" Why does "k" even need the instruction pointer to walk the stack? I've always seen it set to ebp and esp like this which doesn't make sense to me. Marc “0:002> k L=0110f650 0110f650 0110f650″

Why does “k” even need the instruction pointer to walk the stack? I’ve always seen it set to ebp and esp like this which doesn’t make sense to me.

Marc

]]>