Crash Dump Analysis Patterns (Part 285)
Sunday, January 21st, 2024Almost 15 years ago we introduced Dereference Fixpoints when the address value is equal to the value at the address. In doing raw stack data classification and pattern matching we may be interested in more general Dereference Nearpoints (especially in position independent ones) illustrated in the following diagram:
Such Dereference Nearpoints may appear due to exception processing when a stack exception address or exception stack pointer address is propagated during exception processing, and multiple structure references, for example, when a local structure address is propagated during function calls.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -