Comments on: Crash Dump Analysis Patterns (Part 178) https://www.dumpanalysis.org/blog/index.php/2012/06/27/crash-dump-analysis-patterns-part-178/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 19 May 2026 08:04:50 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2012/06/27/crash-dump-analysis-patterns-part-178/#comment-767709 Dmitry Vostokov Sat, 19 Feb 2022 16:09:18 +0000 https://www.dumpanalysis.org/blog/index.php/2012/06/27/crash-dump-analysis-patterns-part-178/#comment-767709 Some recent example: 0:001> kc # Call Site 00 ntdll!NtWaitForMultipleObjects 01 KERNELBASE!WaitForMultipleObjectsEx 02 KERNELBASE!WaitForMultipleObjects 03 kernel32!WerpReportFaultInternal 04 kernel32!WerpReportFault 05 KERNELBASE!UnhandledExceptionFilter 06 ntdll!LdrpLogFatalUserCallbackException 07 ntdll!KiUserCallbackDispatcherHandler 08 ntdll!RtlpExecuteHandlerForException 09 ntdll!RtlDispatchException 0a ntdll!KiUserExceptionDispatch 0b <Unloaded_Windows.UI.Immersive.dll> 0c SHCore!CallNextSubclassProc 0d SHCore!MasterSubclassProc 0e user32!UserCallWinProcCheckWow 0f user32!DispatchClientMessage 10 user32!_fnDWORD 11 ntdll!KiUserCallbackDispatcherContinue 12 user32!NtUserPeekMessage 13 user32!PeekMessageW 14 Windows_UI!Windows::UI::Core::CDispatcher::ProcessMessage 15 Windows_UI!Windows::UI::Core::CDispatcher::WaitAndProcessMessages 16 Windows_UI!Windows::UI::Core::CDispatcher::ProcessEvents 17 Windows_UI_Xaml!CJupiterWindow::RunCoreWindowMessageLoop 18 Windows_UI_Xaml!CJupiterControl::RunMessageLoop 19 Windows_UI_Xaml!DirectUI::DXamlCore::RunMessageLoop 1a twinapi_appcore!Windows::ApplicationModel::Core::CoreApplicationView::Run [...] 1d kernel32!BaseThreadInitThunk 1e ntdll!RtlUserThreadStart Some recent example:

0:001> kc
# Call Site
00 ntdll!NtWaitForMultipleObjects
01 KERNELBASE!WaitForMultipleObjectsEx
02 KERNELBASE!WaitForMultipleObjects
03 kernel32!WerpReportFaultInternal
04 kernel32!WerpReportFault
05 KERNELBASE!UnhandledExceptionFilter
06 ntdll!LdrpLogFatalUserCallbackException
07 ntdll!KiUserCallbackDispatcherHandler
08 ntdll!RtlpExecuteHandlerForException
09 ntdll!RtlDispatchException
0a ntdll!KiUserExceptionDispatch
0b <Unloaded_Windows.UI.Immersive.dll>
0c SHCore!CallNextSubclassProc
0d SHCore!MasterSubclassProc
0e user32!UserCallWinProcCheckWow
0f user32!DispatchClientMessage
10 user32!_fnDWORD
11 ntdll!KiUserCallbackDispatcherContinue
12 user32!NtUserPeekMessage
13 user32!PeekMessageW
14 Windows_UI!Windows::UI::Core::CDispatcher::ProcessMessage
15 Windows_UI!Windows::UI::Core::CDispatcher::WaitAndProcessMessages
16 Windows_UI!Windows::UI::Core::CDispatcher::ProcessEvents
17 Windows_UI_Xaml!CJupiterWindow::RunCoreWindowMessageLoop
18 Windows_UI_Xaml!CJupiterControl::RunMessageLoop
19 Windows_UI_Xaml!DirectUI::DXamlCore::RunMessageLoop
1a twinapi_appcore!Windows::ApplicationModel::Core::CoreApplicationView::Run
[…]
1d kernel32!BaseThreadInitThunk
1e ntdll!RtlUserThreadStart

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2012/06/27/crash-dump-analysis-patterns-part-178/#comment-742015 Dmitry Vostokov Sat, 22 Aug 2020 12:00:17 +0000 https://www.dumpanalysis.org/blog/index.php/2012/06/27/crash-dump-analysis-patterns-part-178/#comment-742015 Sometimes, the module may not be shown as unloaded on the stack trace if there are no symbols for it. So we may need to see if it is in the loaded modules list (lm). Sometimes, the module may not be shown as unloaded on the stack trace if there are no symbols for it. So we may need to see if it is in the loaded modules list (lm).

]]>