If we dump contents of memory regions such as thread stacks we get different region memory addresses due to ASLR. To compare such regions from different executions we need to make them Normalized Regions replacing varying address parts with a common symbolic denominator, for example, 0-based addresses (or some other non-digital symbols to account of the possibility of already existing similar 0-based addresses) and adjusting address offsets appropriately. For example, the following raw stack region from Foreign Stack analysis pattern (we do not normalize foreign stack addresses below):
00000055`adbfe000 00000000`00000000
00000055`adbfe008 00000000`00000000
00000055`adbfe010 00000000`00000000
00000055`adbfe018 00000000`00000000
00000055`adbfe020 00000000`00000000
…
00000055`adbffa58 00000000`00000008
00000055`adbffa60 00000055`adbffb28
00000055`adbffa68 00007ff7`96e116a3 module!func+0×13
00000055`adbffa70 00000055`ad8ffde0
00000055`adbffa78 00000000`00000000
00000055`adbffa80 00000000`00000000
00000055`adbffa88 00007ffa`28ecc9a8 ucrtbase!`string’
00000055`adbffa90 00000000`00000000
00000055`adbffa98 00007ff7`96e116c3 module!thread_proc+0×13
00000055`adbffaa0 00000055`ad8ffde0
00000055`adbffaa8 00000055`adbffb28
00000055`adbffab0 ffffffff`ffffffff
00000055`adbffab8 00007ffa`28fa0748 KERNELBASE!GetAppModelPolicy+0×18
00000055`adbffac0 00000055`adbffba0
00000055`adbffac8 00007ff7`96e12657 module!std::invoke<void (__cdecl*)(int *),int *>+0×27
00000055`adbffad0 00000055`ad8ffde0
00000055`adbffad8 00000055`adbffb00
00000055`adbffae0 00000055`adbffb18
…
--------`00000000 00000000`00000000
--------`00000008 00000000`00000000
--------`00000010 00000000`00000000
--------`00000018 00000000`00000000
--------`00000020 00000000`00000000
…
--------`00001a58 00000000`00000008
--------`00001a60 --------`00001b28
--------`00001a68 00007ff7`96e116a3 module!func+0×13
--------`00001a70 00000055`ad8ffde0
--------`00001a78 00000000`00000000
--------`00001a80 00000000`00000000
--------`00001a88 00007ffa`28ecc9a8 ucrtbase!`string’
--------`00001a90 00000000`00000000
--------`00001a98 00007ff7`96e116c3 module!thread_proc+0×13
--------`00001aa0 00000055`ad8ffde0
--------`00001aa8 --------`00001b28
--------`00001ab0 ffffffff`ffffffff
--------`00001ab8 00007ffa`28fa0748 KERNELBASE!GetAppModelPolicy+0×18
--------`00001ac0 --------`00001ba0
--------`00001ac8 00007ff7`96e12657 module!std::invoke<void (__cdecl*)(int *),int *>+0×27
--------`00001ad0 00000055`ad8ffde0
--------`00001ad8 --------`00001b00
--------`00001ae0 --------`00001b18
…
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -