Comments on: Crash Dump Analysis Patterns (Part 127d) https://www.dumpanalysis.org/blog/index.php/2015/05/10/crash-dump-analysis-patterns-part-127d/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 14:20:49 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2015/05/10/crash-dump-analysis-patterns-part-127d/#comment-767723 Dmitry Vostokov Mon, 28 Nov 2022 08:49:36 +0000 https://www.dumpanalysis.org/blog/index.php/2015/05/10/crash-dump-analysis-patterns-part-127d/#comment-767723 Another recent example showing combase instead of ole32: 0:003> kc # Call Site 00 ntdll!NtAlpcSendWaitReceivePort 01 rpcrt4!LRPC_BASE_CCALL::SendReceive 02 rpcrt4!NdrpSendReceive 03 rpcrt4!NdrpClientCall2 04 rpcrt4!NdrClientCall2 05 combase!BulkUpdateOIDs 06 combase!CRpcResolver::BulkUpdateOIDs 07 combase!CROIDTable::ClientBulkUpdateOIDWithPingServer 08 combase!CROIDTable::ForceImmediateBulkUpdateWithPingServerForAdds 09 combase!CStdMarshal::ConnectCliIPIDEntry 0a combase!CStdMarshal::MakeCliIPIDEntry 0b combase!CStdMarshal::UnmarshalIPID 0c combase!CStdMarshal::UnmarshalObjRef 0d combase!UnmarshalSwitch 0e combase!UnmarshalObjRef 0f combase!CoUnmarshalInterface 10 combase!Ndr64ExtInterfacePointerUnmarshall 11 rpcrt4!Ndr64TopLevelPointerUnmarshall 12 rpcrt4!Ndr64TopLevelPointerUnmarshall 13 rpcrt4!Ndr64pClientUnMarshal 14 rpcrt4!NdrpClientCall3 15 combase!ObjectStublessClient 16 combase!ObjectStubless 17 netprofm!CPubINetwork::GetNetworkConnections 18 winspool!IsNetworkPPP 19 winspool!GetCurrentNetworkIdInternal 1a winspool!GetCurrentNetworkId 1b winspool!InternalGetDefaultPrinter 1c winspool!GetDefaultPrinterW 1d comdlg32!PrintBuildDevNames 1e comdlg32!PrintDlgX 1f comdlg32!PrintDlgW 20 mfc42u!CWinApp::UpdatePrinterSelection 21 mfc42u!CWinApp::GetPrinterDeviceDefaults 22 wordpad!CWordPadApp::CreateDevNames 23 wordpad!CWordPadApp::DoDeferredInitialization 24 mfc42u!_AfxThreadEntry 25 msvcrt!_callthreadstartex 26 msvcrt!_threadstartex 27 kernel32!BaseThreadInitThunk 28 ntdll!RtlUserThreadStart Another recent example showing combase instead of ole32:

0:003> kc
# Call Site
00 ntdll!NtAlpcSendWaitReceivePort
01 rpcrt4!LRPC_BASE_CCALL::SendReceive
02 rpcrt4!NdrpSendReceive
03 rpcrt4!NdrpClientCall2
04 rpcrt4!NdrClientCall2
05 combase!BulkUpdateOIDs
06 combase!CRpcResolver::BulkUpdateOIDs
07 combase!CROIDTable::ClientBulkUpdateOIDWithPingServer
08 combase!CROIDTable::ForceImmediateBulkUpdateWithPingServerForAdds
09 combase!CStdMarshal::ConnectCliIPIDEntry
0a combase!CStdMarshal::MakeCliIPIDEntry
0b combase!CStdMarshal::UnmarshalIPID
0c combase!CStdMarshal::UnmarshalObjRef
0d combase!UnmarshalSwitch
0e combase!UnmarshalObjRef
0f combase!CoUnmarshalInterface
10 combase!Ndr64ExtInterfacePointerUnmarshall
11 rpcrt4!Ndr64TopLevelPointerUnmarshall
12 rpcrt4!Ndr64TopLevelPointerUnmarshall
13 rpcrt4!Ndr64pClientUnMarshal
14 rpcrt4!NdrpClientCall3
15 combase!ObjectStublessClient
16 combase!ObjectStubless
17 netprofm!CPubINetwork::GetNetworkConnections
18 winspool!IsNetworkPPP
19 winspool!GetCurrentNetworkIdInternal
1a winspool!GetCurrentNetworkId
1b winspool!InternalGetDefaultPrinter
1c winspool!GetDefaultPrinterW
1d comdlg32!PrintBuildDevNames
1e comdlg32!PrintDlgX
1f comdlg32!PrintDlgW
20 mfc42u!CWinApp::UpdatePrinterSelection
21 mfc42u!CWinApp::GetPrinterDeviceDefaults
22 wordpad!CWordPadApp::CreateDevNames
23 wordpad!CWordPadApp::DoDeferredInitialization
24 mfc42u!_AfxThreadEntry
25 msvcrt!_callthreadstartex
26 msvcrt!_threadstartex
27 kernel32!BaseThreadInitThunk
28 ntdll!RtlUserThreadStart

]]>