Crash Dump Analysis Patterns (Part 8b)
Thursday, August 30th, 2012This is an example of Hidden Exception pattern in kernel space:
0: kd> !thread
THREAD fffffa800d4bf9c0 Cid 0e88.56e0 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
DeviceMap fffff8a001e91950
Owning Process fffffa800b33cb30 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 13154529 Ticks: 0
Context Switch Count 1426
UserTime 00:00:00.015
KernelTime 00:00:00.124
Win32 Start Address 0x0000000077728d20
Stack Init fffff8800a83fdb0 Current fffff8800a83eb90
Base fffff8800a840000 Limit fffff8800a83a000 Call 0
Priority 10 BasePriority 10 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
[…]
0: kd> dps fffff8800a83a000 fffff8800a840000
[...]
fffff880`0a83e180 fffff880`0a83ea10
fffff880`0a83e188 fffff880`0a83e6d0
fffff880`0a83e190 fffff880`0a83e968
fffff880`0a83e198 fffff800`016c88cf nt!KiDispatchException+0×16f
fffff880`0a83e1a0 fffff880`0a83e968
fffff880`0a83e1a8 fffff880`0a83e1d0
fffff880`0a83e1b0 fffff880`00000000
fffff880`0a83e1b8 00000000`00000000
fffff880`0a83e1c0 00000000`00000000
fffff880`0a83e1c8 00000000`00000000
[…]
0: kd> .cxr fffff880`0a83e1d0
rax=0000000000000009 rbx=fffffa800d4c1de0 rcx=0000000000000000
rdx=fffff8800a83ece0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800016ad74f rsp=fffff8800a83eba0 rbp=00000000a000000c
r8=fffff8800a83ecd8 r9=fffff8800a83ecc0 r10=0000000000000000
r11=fffff8800a83ed58 r12=0000000000000000 r13=0000000000000000
r14=fffffa800d4bf9c0 r15=fffffa800d4c1ea0
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!IopCompleteRequest+0x12f:
fffff800`016ad74f 48894108 mov qword ptr [rcx+8],rax ds:002b:00000000`00000008=????????????????
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
