Crash Dump Analysis Patterns (Part 201)
Sometimes there are similar crashes in multiplatform products where only some potion of Crash Signature is similar. We call such a pattern Crash Signature Invariant, for example:
x86: cmp dword ptr [eax], 1
x64: cmp dword ptr [r10]. 1
One crash dump had the following condensed stack trace:
0: kd> kc
DriverA
win32k!DrvSetMonitorPowerState
win32k!xxxSysCommand
win32k!xxxRealDefWindowProc
win32k!NtUserfnNCDESTROY
win32k!NtUserMessageCall
nt!KiSystemServiceCopyEnd
with the following faulting instruction:
DriverA+0x1234:
cmp dword ptr [r11],1 ds:002b:00000000`00000000=????????
A search for DriverA led to this x86 crash analysed some time ago:
0: kd> kc
DriverA
nt!IopfCallDriver
win32k!GreDeviceIoControl
win32k!DrvSetMonitorPowerState
win32k!xxxSysCommand
win32k!xxxRealDefWindowProc
win32k!xxxWrapRealDefWindowProc
win32k!NtUserfnNCDESTROY
win32k!NtUserMessageCall
nt!KiSystemServicePostCall
0: kd> r
DtiverA+0x1423:
cmp dword ptr [ecx],1 ds:0023:00000000=????????
We see common function names on both stack traces and overall flow is the same (only 3 functions are omitted in x64 trace); we see the same NULL pointer dereference for the same comparison instruction with the same comparison operand, #1.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -