Archive for January, 2012

Professional Software Debugging Services

Tuesday, January 31st, 2012

Memory Dump Analysis Services starts providing debugging training and assistance in addition to (based on) memory dump and software trace analysis. It has recently registered www.debugging.pro domain and is working on extending its courses to cover live debugging and additional OS platforms this year.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

A Bug in a Bag (Collections, Ex-hi-bit 1)

Monday, January 30th, 2012

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

A Bug Meets a Bug (The Clash of Civilizations)

Saturday, January 28th, 2012

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

New Book: Advanced Windows Memory Dump Analysis

Friday, January 27th, 2012

Advanced training sessions time may not suitable due to different geographic time zones. So I have decided to publish this training in a book format (currently in PDF) and make it available in paperback on Amazon and B&N later. Book details:

  • Title: Advanced Windows Memory Dump Analysis with Data Structures: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Description: The full transcript of Memory Dump Analysis Services Training with 10 step-by-step exercises, notes, and selected Q&A.
  • Authors: Dmitry Vostokov, Memory Dump Analysis Services
  • Publisher: OpenTask (January 2012)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 180 pages
  • ISBN-13: 978-1908043344

Table of Contents

Now available for sale in PDF format from Memory Dump Analysis Services.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

A Bug Catcher

Monday, January 23rd, 2012

As always, if I’m asked to do something, I don’t stop there and apply all my accumulated knowledge to go beyond. Here is an example: after designing 2CARE2 trademark I imagined an organic creature that catches bugs:

If you compare it with a trademark you would recognize A, R and E as Phenyl, Methyl, and Ethyl groups.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

The Second Generation of CARE System (Trademark)

Monday, January 23rd, 2012

Memory Dump Analysis Services started working on 2CARE2 system (Crash Analysis Report Environment, 2nd generation) and asked me to design a trademark. My Chemistry background (I like Organic Chemistry most) and imagination led me to represent client and server parts holistically as an aromatic-like compound:

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Raw Stack Dump of all threads (part 5)

Sunday, January 22nd, 2012

Having done in the past with user space raw stack data analysis for 32-bit complete memory dumps I found today the need to look at kernel raw stack data from all threads and created this fast script:

!for_each_thread "!thread @#Thread; r? $t1 = ((nt!_KTHREAD *) @#Thread )->StackLimit; r? $t2 = ((nt!_KTHREAD *) @#Thread )->InitialStack; dps @$t1 @$t2"

It can be run for kernel and complete memory dumps from both x86 and x64 systems. If you need to have correct symbolic mapping for user space in kernel space data you need to modify it a bit and it will be slower to run.

!for_each_thread "!thread @#Thread ff; .thread /r /p @#Thread; r? $t1 = ((nt!_KTHREAD *) @#Thread )->StackLimit; r? $t2 = ((nt!_KTHREAD *) @#Thread )->InitialStack; dps @$t1 @$t2"

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Music for Debugging: Going Romantic

Sunday, January 22nd, 2012

I have discovered that Romantic era music is good for debugging, memory dump and software trace analysis sessions. Previously I included Beethoven and now suggest to listen to Schumann. For a starter you can try this album: Schumann: Symphonies Nos. 1-4

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Bugtation No.154

Sunday, January 22nd, 2012

3 bugtations in a column:

Every debugger I know has trouble debugging.
Talent is helpful in debugging, but guts are absolutely necessary.
With failure comes a dump.

Joseph Heller

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Browser Wars in 2011

Saturday, January 21st, 2012

Here’s what we see from our Google Analytics stats. Top 5 browsers in 2011 used to access our portal and blog:

Browser

Visits

Internet Explorer

82,334

Firefox

76,880

Chrome

57,275

Opera

9,776

Safari

6,197

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Mobile Phone Market in 2011

Saturday, January 21st, 2012

Here’s what we see from our Google Analytics stats. Top 25 mobile devices in 2011 used to access our portal and blog:

Mobile Device Info

Visits

Apple iPhone

599

Apple iPad

467

(not set)

415

Apple iPod Touch

41

Samsung GT-I9100 Galaxy S II

30

HTC Desire HD

20

Motorola DroidX

19

SonyEricsson LT15i Xperia Arc

18

HTC Desire

16

Motorola Xoom

12

Verizon Droid

12

Google Nexus One

9

HTC EVO 4G

9

Samsung Nexus S

8

Nokia E63

7

Samsung GT-I9000 Galaxy S

7

Huawei IDEOS S7

6

Samsung SHW-M130L Galaxy U

6

HTC ADR6300 Incredible

5

Motorola A953 MILESTONE 2

5

Motorola Droid 2

5

RIM BlackBerry 8530 Curve

5

Samsung Galaxy Tab

5

Samsung GT-P7510 Galaxy Tab 10.1

5

Samsung SWH-M110S

5

Top 10 mobile operating systems:

Operating System

Visits

iPhone

1,078

iPad

827

Android

628

iPod

75

BlackBerry

54

Nokia

23

SymbianOS

15

Windows Phone

13

Windows

8

Samsung

4

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

2011 in Retrospection

Saturday, January 21st, 2012

According to Google Analytics the number of visits / year increased by 4% since 2010 with almost 160,000 unique visitors (2% increase) from 180 countries and 34% of them are coming back. 2,725 visits were via 12 mobile operating systems (106% increase). Here are the top 100 network locations out of 28,932:

Service Provider

Visits

microsoft corp

5,292

comcast cable communications inc.

3,596

internet service provider

3,509

road runner holdco llc

3,314

verizon online llc

2,597

comite gestor da internet no brasil

2,557

hewlett-packard company

2,546

ip pools

2,222

deutsche telekom ag

2,160

japan network information center

2,109

chunghwa telecom data communication business group

1,632

intel corporation

1,518

uunet non-portable customer assignment

1,312

qwest communications company llc

1,202

symantec corporation

1,170

charter communications

1,110

at&t internet services

1,108

emc corporation

1,099

network of citrix systems inc

1,093

broadband multiplay project o/o dgm bb noc bsnl bangalore

1,063

abts (karnataka)

1,043

comcast cable communications holdings inc

986

eircom

919

this space is statically assigned.

918

chinanet guangdong province network

900

cox communications

896

korea telecom

895

proxad / free sas

886

comcast business communications llc

845

tw telecom holdings inc.

825

china unicom beijing province network

816

psinet inc.

811

kaspersky lab internet

734

telstra internet

716

chinanet shanghai province network

664

comcast cable communications

652

honeywell international inc.

641

cisco systems inc.

637

shaw communications inc.

629

cox communications inc.

627

xo communications

618

ntt communications corporation

604

optimum online (cablevision systems)

597

microsoft

595

symantec

590

krnic

589

citrix systems inc.

571

chtd chunghwa telecom co. ltd.

557

telefonica de espana sau

547

this space is statically assigned

543

dynamic ip pool for broadband customers

538

frontier communications of america inc.

523

computer associates international

501

appense

479

telus communications inc.

473

unknown

473

research in motion limited

469

singnet pte ltd

458

customers ie

457

arcor ag

454

chinanet jiangsu province network

448

sympatico hse

445

suddenlink communications

435

nib (national internet backbone)

429

comcast cable communications ip services

426

rcs & rds s.a.

425

dynamic pools

421

siemens ag

419

mcafee inc.

410

iinet limited

409

smart comp. a.s.

406

eset s.r.o.

400

tpg internet pty ltd.

393

ziggo consumers

390

ncc#2011011865 approved ip assignment

383

ibm india private limited

373

abts tamilnadu

355

pt telkom indonesia

340

tata teleservices ltd - tata indicom - cdma division

336

pacnet services (japan) corp.

334

opera software asa

333

core ip development

332

easynet ltd

327

mcafee

313

global crossing

312

uecomm

311

wipro technologies

310

mtnl cat b isp

306

upc polska sp. z o.o.

305

integra telecom inc.

304

videotron ltee

299

network of ign arch. and design gb

297

rcom-wireless-hsd-mumbai

292

scansafe inc.

292

hutchison global communications

285

upc slovakia

279

gesti n de direccionamiento uninet

278

bellsouth.net inc.

277

starhub cable vision ltd

271

las colinas microsoft

268

Top 25 visiting countries:

Country/Territory

Visits

United States

67,799

India

22,266

United Kingdom

17,258

Russia

11,094

Germany

10,244

China

8,928

Canada

7,569

France

5,551

Japan

4,944

Australia

4,792

South Korea

4,279

Taiwan

3,845

Ukraine

3,315

Netherlands

3,176

Israel

2,791

Poland

2,781

Brazil

2,773

Italy

2,701

Spain

2,623

Ireland

2,592

Romania

2,391

Czech Republic

2,359

Singapore

2,307

Sweden

2,255

Finland

1,800

More than 8,000 portal and blog pages were viewed a total of more than 392,000 times with top 100 content pages:

Page

Pageviews

/

39,456

/blog/

30,649

/blog/index.php/2007/06/20/crash-dump-analysis-checklist/

7,596

/blog/index.php/category/windbg-tips-and-tricks/

7,406

/blog/index.php/2008/01/10/what-is-kifastsystemcallret/

5,553

/blog/index.php/2008/09/12/adplus-in-21-seconds-and-13-steps/

4,179

/blog/index.php/2007/07/20/crash-dump-analysis-patterns-part-17/

3,712

/blog/index.php/category/minidump-analysis/

3,393

/blog/index.php/category/windows-7/

3,012

/blog/index.php/2007/09/17/resolving-symbol-file-could-not-be-found/

2,932

/blog/index.php/2007/09/06/minidump-analysis-part-2/

2,859

/Tools

2,632

/Memory+Dump+Analysis+Anthology+Volume+5

2,507

/blog/index.php/category/windbg-scripts/

2,444

/ru/blog/

2,337

/blog/index.php/category/windows-server-2008/

2,262

/blog/index.php/2008/03/13/crash-dump-analysis-patterns-part-2b/

2,196

/blog/index.php/2006/10/31/crash-dump-analysis-patterns-part-2/

2,182

/blog/index.php/2008/04/22/bugchecks-system_service_exception/

2,073

/blog/index.php/2007/09/11/crash-dump-analysis-patterns-part-26/

1,998

/blog/index.php/2008/01/24/crash-dump-analysis-patterns-part-43/

1,986

/blog/index.php/2007/04/03/crash-dump-analysis-patterns-part-11/

1,960

/blog/index.php/2007/10/11/minidump-analysis-part-4/

1,938

/blog/index.php/category/gdb-for-windbg-users/

1,928

/blog/index.php/2006/12/09/clipboard-issues-explained/

1,922

/blog/index.php/about/

1,863

/blog/index.php/2006/10/30/crash-dump-analysis-patterns-part-1/

1,803

/FCMDA-book

1,800

/mda-learning-speed

1,793

/blog/index.php/2007/02/02/crash-dump-analysis-patterns-part-8/

1,753

/Memory+Dump+Analysis+Anthology+Volume+1

1,746

/blog/index.php/2007/04/25/bugchecks-system_thread_exception_not_handled/

1,712

/blog/index.php/2007/02/09/crash-dump-analysis-patterns-part-9a/

1,705

/blog/index.php/2007/08/06/crash-dump-analysis-patterns-part-20a/

1,661

/blog/index.php/category/windbg-tips-and-tricks/page/2/

1,661

/blog/index.php/2008/03/12/bug-check-frequencies/

1,646

/blog/index.php/2007/10/17/crash-dump-analysis-patterns-part-31/

1,615

/blog/index.php/2007/03/04/windbg-tips-and-tricks-analyzing-hangs-faster/

1,605

/blog/index.php/basic-windows-crash-dump-analysis/

1,600

/blog/index.php/2007/07/15/interrupts-and-exceptions-explained-part-4/

1,591

/blog/index.php/category/bugchecks-depicted/

1,584

/blog/index.php/2007/08/29/minidump-analysis-part-1/

1,508

/blog/index.php/2008/06/12/crash-dump-analysis-patterns-part-59b/

1,479

/blog/index.php/crash-dump-analysis-patterns/

1,456

/blog/index.php/2008/03/08/time-travel-debugging/

1,453

/ru/blog/index.php/category/komandy-otladchika-windbg/

1,420

/WinDbg+reference

1,396

/blog/index.php/crash-dump-examples/

1,358

/advanced-software-debugging-reference

1,347

/blog/index.php/category/windbg-tips-and-tricks/page/6/

1,317

/ru/blog/index.php/page/2/

1,314

/blog/index.php/2010/01/08/live-kernel-debugging-of-a-system-freeze-case-study/

1,298

/Forthcoming+Windows+Debugging+Notebook

1,285

/Crash+Dump+Analysis+for+System+Administrators

1,278

/blog/index.php/2007/03/03/windbg-tips-and-tricks-hypertext-commands/

1,240

/accelerated-windows-memory-dump-analysis

1,191

/blog/index.php/2007/06/21/crash-dump-analysis-patterns-part-16a/

1,178

/blog/index.php/category/cartoons/

1,157

/blog/index.php/category/windbg-tips-and-tricks/page/7/

1,128

/blog/index.php/2008/06/26/heuristic-stack-trace-in-windbg-693113/

1,114

/blog/index.php/2007/12/17/crash-dump-analysis-patterns-part-41b/

1,106

/blog/index.php/category/mac-crash-corner/

1,082

/blog/index.php/2007/05/19/resurrecting-dr-watson-on-vista/

1,036

/blog/index.php/category/bugchecks-depicted/page/2/

976

/blog/index.php/2007/02/10/crash-dump-analysis-in-visual-studio-2005/

947

/blog/index.php/category/dump-analysis/

937

/blog/index.php/2008/05/09/windbg-cheat-sheet-for-crash-dump-analysis/

931

/arts-photography-links

917

/blog/index.php/2008/04/03/crash-dump-analysis-patterns-part-57/

915

/blog/index.php/2007/06/21/repair-clipboard-chain-201/

880

/blog/index.php/automated-analysis/

848

/blog/index.php/2007/07/25/reconstructing-stack-trace-manually/

844

/Forthcoming+Windows+Debugging:+Practical+Foundations

841

/Memory+Dump+Analysis+Anthology+Volume+4

831

/blog/index.php/2007/09/

828

/blog/index.php/2007/09/14/crash-dump-analysis-patterns-part-27/

819

/museum-debugging

813

/blog/index.php/dumps-for-dummies/

810

/blog/index.php/2007/08/19/crash-dump-analysis-patterns-part-23a/

807

/blog/index.php/2007/08/04/visualizing-memory-dumps/

797

/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/

785

/blog/index.php/2008/01/02/how-to-distinguish-between-1st-and-2nd-chances/

784

/blog/index.php/2008/05/08/stl-and-windbg/

780

/blog/index.php/2007/05/20/custom-postmortem-debuggers-on-vista/

764

/blog/index.php/2007/10/01/windows-service-crash-dumps-on-vista/

760

/blog/index.php/category/linux-crash-corner/

748

/blog/index.php/memory-dump-analysis-interview-questions/

746

/blog/index.php/2007/12/19/crash-dump-analysis-patterns-part-42b/

723

/blog/index.php/2007/10/30/object-names-and-waiting-threads/

720

/blog/index.php/2006/10/09/dumps-for-dummies-part-1/

700

/blog/index.php/category/windbg-scripts/page/2/

693

/node?page=1

687

/Forthcoming+Memory+Dump+Analysis+Anthology+Volume+2

686

/blog/index.php/2006/10/

680

/blog/index.php/2008/10/15/crash-dump-analysis-patterns-part-1b/

680

/blog/index.php/2006/11/01/crash-dump-analysis-patterns-part-3/

677

/blog/index.php/2007/12/12/crash-dump-analysis-patterns-part-41a/

676

/blog/index.php/category/net-debugging/

675

/blog/index.php/2007/07/15/crash-dump-analysis-patterns-part-13b/

674

/blog/index.php/category/windbg-scripts/page/3/

667

More than 70,000 Google search keywords pointed to the portal and this blog with 100 most frequent (some are in Russian):

Keyword

Visits

crash dump

2,485

crash dump analysis

2,042

kifastsystemcallret

1,881

nt!_gshandlercheck_seh

1,111

adplus

1,099

dump analysis

894

ntdll!kifastsystemcallret

640

windbg

595

bugcheck 3b

570

win32 error 0n2

551

memory dump analysis

526

symbol file could not be found

405

windbg commands

393

dmitry vostokov

385

dumpanalysis.org

361

fnodobfm

361

system_thread_exception_not_handled

338

adplus download

336

crash dump analyzer

328

crash dump windows 7

326

windbg crash dump analysis

320

kisystemservicecopyend

317

idna trace

306

dumpanalysis

301

minidump analysis

288

warning: frame ip not in any known module. following frames may be wrong.

264

crash dumps

253

windows 7 crash dump

250

crashdump

244

frame ip not in any known module

239

adplus tutorial

237

memory dump analysis anthology

235

core dump analysis

224

windbg script

217

kiuserexceptiondispatcher

213

application_fault_status_breakpoint

211

pool corruption

192

exception_double_fault

189

basethreadinitthunk

188

анализ дампа памяти

187

getcontextstate failed, 0xd0000147

184

ntdll kifastsystemcallret

184

nngakegl

180

memory dump analysis tool

179

analyze minidump

177

error: symbol file could not be found

176

dump analyzer

175

kernel_mode_exception_not_handled

174

rtlpwaitoncriticalsection

174

trap frame

174

дамп памяти

173

getcontextstate failed, 0×80070026

171

windows crash dump analysis

170

windbg analyze

168

system_service_exception

167

frame pointer omission

161

minidump analyzer

156

obfreferenceobject

155

“this book fills the gap in children’s literature and introduces binary arithmetic to babies”

154

life cycle of a beetle

152

string theory

148

отладка windows dump

143

application_hang_blockedon_fileio

142

bugcheck 7e

139

image dump analysis visual studio

139

ntdll.dll!kifastsystemcallret

138

windbg cheat sheet

138

msmapi32.dll!fopenthreadimpersonationtoken

130

windbg debugging using vmware mac osx

128

download adplus

127

memory worldview

127

waitformultiple windbg????

127

rtlplowfragheapfree

125

application_hang_busyhang

124

symbol file could not be found. defaulted to export symbols for fltmgr.sys

121

error: symbol file could not be found. defaulted to export symbols for ntkrnlmp.exe

120

unwindandcontinuerethrowhelperaftercatch

120

анализ дампа памяти ядра

120

bugcheck analysis

118

ntdll dbgbreakpoint

117

error: symbol file could not be found.

116

windows debugging: practical foundations

116

!cs windbg

113

bios disassembly ninjutsu uncovered

112

kipagefault

110

pool_corruption

110

windbg symbol file could not be found

109

crash dump analysis windbg

108

linux crash dump analysis

105

warning: stack unwind information not available. following frames may be wrong.

104

zwwaitforworkviaworkerfactory

104

failure_bucket_id

103

system_thread_exception_not_handled (7e)

103

the stored exception information can be accessed via .ecxr.

103

анализ дампов памяти

103

dump crash

101

ldrpsnapthunk

101

the stored exception information can be accessed via .ecxr

101

windbg !locks

100

windbg gs:[58h]

100

Special thanks to more  1,000 web sites that mention the portal and this blog with the first top 100:

Source/Medium

Visits

google

152,133

(direct) / (none)

34,419

bing

6,847

windbg.org

5,106

google.com

4,904

google.co.in

2,576

stackoverflow.com

1,713

yandex

1,614

dumpanalysis.com

1,577

twitter.com

1,229

baike.baidu.com

1,165

yahoo

1,157

t.co

709

blogs.msdn.com

665

google.co.uk

609

dumpanalysis.org

574

baidu

560

facebook.com

558

google.de

502

winvistaclub.com

442

naver

419

google.ca

394

search

373

linkedin.com

356

google.ru

311

google.com.au

296

citrixblogger.org

277

en.wikipedia.org

257

reconstructer.org

256

analyze-v.com

252

debuggingexperts.com

250

itdatabase.com

250

windbg.dumpanalysis.org

230

advancedwindowsdebugging.com

226

nynaeve.net

225

google.com.br

209

blog.miniasp.com

208

google.fr

200

google.it

181

google.com.hk

180

advanceddotnetdebugging.com

172

blogs.microsoft.co.il

171

community.citrix.com

166

google.co.kr

165

google.es

152

social.technet.microsoft.com

149

google.pl

142

google.nl

140

google.com.ua

136

serverfault.com

125

google.com.tw

123

google.com.tr

118

bytetalk.net

114

google.co.jp

107

forum.sysinternals.com

105

blog.naver.com

104

google.be

98

reddit.com

97

google.com.sg

95

google.co.il

93

google.ch

91

jasonhaley.com

87

netfxharmonics.com

87

google.ie

83

support.citrix.com

83

advdbg.org

81

google.se

80

google.com.pk

77

saygoodnight.com

76

google.ro

75

blogs.technet.com

74

news.ycombinator.com

74

google.co.za

73

driverentry.com.br

72

google.co.nz

69

google.cz

68

admin.itdatabase.com

66

codemachine.com

66

rambler

66

ask

63

dotnettips.info

63

google.at

63

pchelpforum.com

63

techspot.com

62

google.com.my

61

images.google

61

my.safaribooksonline.com

60

opentask.com

60

voneinem-windbg.blogspot.com

60

google.com.ph

58

google.no

55

google.gr

54

ja.iphone.luna.tv

53

kaixin001.com

53

aol

52

google.co.id

52

networksteve.com

52

caloni.com.br

51

google.com.ar

51

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Marx and the Alternative to Capitalism

Thursday, January 19th, 2012

This book I bought in a local Costa bookshop and found it was written by an Irish sociologist Kieran Allen. Shortly before my interest in Marxism was inspired by seeing a link to Irish communist party website and socialist bookshop in a booklet for Dublin Culture nights festival. It was a bit funny to see communists as part of Irish culture festival especially for me from former Soviet Union. Anyway, later I saw on streets that Marxist festivals are popular in Ireland nowadays. So let’s go back to the book. I found it very good and even lucid in explaining various Marxist ideas and vocabulary. A good start for more advance reading such as “Capital” (I have all 3 hardcover volumes from an Indian publisher and plan to have leather bound edition from Russia if I have enough surplus and MEW German edition) or specialized books such as “A Dictionary of Marxist Thought”. What I also tend to agree with the author is that Stalinism is a mirror of Capitalism (there is also a book “Magnetic Mountain: Stalinism as a Civilization” that I’m reading). I leave an application of a dialectical method of double negation to a reader here. Now the weak points of the book: 1) it doesn’t cover post-Stalinist era; 2) subsequent analysis of alternatives sounds a bit naive for me who really lived in socialism and can compare it to capitalism both in post-socialist country and now living in real capitalist country. The book also has a good reading suggestion list and I even thinking now on reading Voloshinov book “Marxism and the Philosophy of Language” (in Russian, although there is an English edition). Anyway, I would recommend Kieran’s book with reservations (about alternatives) as a first introduction to Marxist thought.

Marx and the Alternative to Capitalism

- Dmitry Vostokov @ LiterateScientist.com -

Crash Dump Analysis Patterns (Part 27d)

Wednesday, January 11th, 2012

In addition to stack trace collections for threads (unmanaged, managed and predicate) we introduce an additional pattern for I/O requests. Such requests are implemented via the so called I/O request packets (IRP) that “travel” from a device driver to a device driver similar to a C++ class method to another C++ class method (where a device object address is similar to a C++ object instance address). An IRP stack is used to keep a track of the current driver which is processing an IRP that is reused between device drivers. Its is basically an array of structures describing how a particular driver function was called with appropriate parameters similar to a call frame on an execution thread stack. Long time ago I created an UML diagram depicting the flow of an IRP through the driver (device) stack (diagram #3). An I/O stack location pointer is decremented (from the bottom to the top) like a thread stack pointer (ESP or RSP). We can list active and completed I/O requests with their stack traces using !irpfind -v WinDbg command:

1: kd> !irpfind -v

Scanning large pool allocation table for Tag: Irp? (832c7000 : 833c7000)

Irp    [ Thread ] irpStack: (Mj,Mn)   DevObj  [Driver]         MDL Process
8883dc18: Irp is active with 1 stacks 1 is current (= 0x8883dc88)
No Mdl: No System Buffer: Thread 888f8950:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  d, 0]   5  1 88515ae8 888f82f0 00000000-00000000    pending
\FileSystem\Npfs
Args: 00000000 00000000 00110008 00000000

891204c8: Irp is active with 1 stacks 1 is current (= 0x89120538)
No Mdl: No System Buffer: Thread 889635b0:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  3, 0]   0  1 88515ae8 84752028 00000000-00000000    pending
\FileSystem\Npfs
Args: 0000022a 00000000 00000000 00000000

89120ce8: Irp is active with 1 stacks 1 is current (= 0x89120d58)
No Mdl: No System Buffer: Thread 89212030:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  3, 0]   0  1 88515ae8 8921be00 00000000-00000000    pending
\FileSystem\Npfs
Args: 0000022a 00000000 00000000 00000000
Searching NonPaged pool (80000000 : ffc00000) for Tag: Irp?

[...]

892cbe48: Irp is active with 9 stacks 9 is current (= 0x892cbfd8)
No Mdl: No System Buffer: Thread 892add78:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[  c, 2]   0  1 8474a020 892c8c80 00000000-00000000    pending
\FileSystem\Ntfs
Args: 00000800 00000002 00000000 00000000

892daa88: Irp is active with 4 stacks 4 is current (= 0x892dab64)
No Mdl: System buffer=831559c8: Thread 8322c8e8:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[  e,2d]   5  1 884ba750 83190c40 00000000-00000000    pending
\Driver\AFD
Args: 890cbc44 890cbc44 88e55297 8943b6c8

892ea4e8: Irp is active with 4 stacks 4 is current (= 0x892ea5c4)
No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  Pending has been returned
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  2 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 c0000185
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  f, 0]   0  2 83a34bb0 00000000 84d779ed-88958050
\Driver\atapi CLASSPNP!ClasspMediaChangeDetectionCompletion
Args: 88958050 00000000 00000000 83992d10
>[  0, 0]   2  0 891ee030 00000000 00000000-00000000
\Driver\cdrom
Args: 00000000 00000000 00000000 00000000

8933fcb0: Irp is active with 1 stacks 1 is current (= 0x8933fd20)
No Mdl: No System Buffer: Thread 84753d78:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  3, 0]   0  1 88515ae8 84759f40 00000000-00000000    pending
\FileSystem\Npfs
Args: 0000022a 00000000 00000000 00000000

893cf550: Irp is active with 1 stacks 1 is current (= 0x893cf5c0)
No Mdl: No System Buffer: Thread 888fd3b8:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  3, 0]   0  1 88515ae8 834d30d0 00000000-00000000    pending
\FileSystem\Npfs
Args: 00000400 00000000 00000000 00000000

893da468: Irp is active with 6 stacks 7 is current (= 0x893da5b0)
Mdl=892878f0: No System Buffer: Thread 00000000:  Irp is completed.  Pending has been returned
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  f, 0]   0  0 84b3e028 00000000 9747fcd0-00000000
\Driver\usbehci USBSTOR!USBSTOR_CswCompletion
Args: 00000000 00000000 00000000 00000000
[  f, 0]   0  0 892ba8f8 00000000 84d780ce-8328e0f0
\Driver\USBSTOR CLASSPNP!TransferPktComplete
Args: 00000000 00000000 00000000 00000000

893efb00: Irp is active with 10 stacks 11 is current (= 0x893efcd8)
Mdl=83159378: No System Buffer: Thread 82b7f828:  Irp is completed.  Pending has been returned
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[  3, 0]   0  0 885a55b8 00000000 81614138-00000000
\Driver\disk partmgr!PmReadWriteCompletion
Args: 00000000 00000000 00000000 00000000
[  3, 0]   0  0 89257c90 00000000 8042e4d4-831caab0
\Driver\partmgr volmgr!VmpReadWriteCompletionRoutine
Args: 00000000 00000000 00000000 00000000
[  3, 0]   0  0 831ca9f8 00000000 84dad0be-00000000
\Driver\volmgr ecache!EcDispatchReadWriteCompletion
Args: 00000000 00000000 00000000 00000000
[  3, 0]   0  0 8319c020 00000000 84dcc4d4-8576f8ac
\Driver\Ecache volsnap!VspSignalCompletion
Args: 00000000 00000000 00000000 00000000

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Bugtation No.153

Tuesday, January 10th, 2012

An advice to succeed in Software Technical Support:

They said : The dump came from the wrong site
He’s a page from the end of the dump
I said : The dump came from the right site
Took me just one look
<…>
With a little debugging
You will survive
With a little debugging
You will get by
Do what you want
Go your own way
in Technical Support.

Modern Talking

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Analysis, Architectural, Design, Implementation and Usage Debugging Patterns (Part 1)

Saturday, January 7th, 2012

This is another tracing example of unified debugging patterns introduced previously.

- Analysis Patterns

Focus of Tracing

- Architectural Patterns

Debug Event Subscription / Notification

- Design Patterns

Shared Debug Event State

- Implementation Patterns

Shared Variable

- Usage Patterns

Saving a memory address obtained at a breakpoint event in a debugger pseudo-register for use at later breakpoint events

Debugging.tv published a case study for tracing window messages in WinDbg. There a pseudo-register is used to save a buffer address before GetMessage call and then to reuse it after the call. Please look at Event State Management slide on Frames episode 0×06 presentation. The full WinDbg log and the recording are available there too.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Happy New Year (from Windows 8)

Tuesday, January 3rd, 2012

This is a seasonal greetings postcard with Windows 8 bluescreen theme:

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 45)

Monday, January 2nd, 2012

Based on ideas of Roman Jakobson about “marked” and “unmarked” categories we propose another pattern called Marked Message that groups trace messages based on having some feature or property. For example, marked messages may point to some domain of software activity such related to functional requirements and therefore may help in troubleshooting and debugging. Unmarked messages include all other messages that don’t say anything about such activities (although may include messages pointing to such activities indirectly we unaware of) or messages that say explicitly that no such activity has occurred. We can even borrow a notation of distinctive features from phonology and annotate any trace or log after analysis to compare it with a master trace, for example, compose the following list of software trace distinctive features:

session database queries [+]
session initialization [-]
socket activity [+]
process A launched [+]
process B launched [-]
process A exited [-]
[…]

Here [+] means the activity is present in the trace and [-]  means the activity is either undetected or definitely not present. Sometime a non-present activity can be a marked activity corresponding to all inclusive unmarked present activity (see, for example, No Activity pattern).

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -