Crash Dump Analysis Patterns (Part 302)
Monday, November 17th, 2025The list of local variables displayed by the dv WinDbg command may contain False Local Addresses, especially if some non-standard alignment is used on ARM64 platforms. For example, we get this address that doesn’t look correct if we associate it with the source code:
* _Alignas(4096) long long ll = 1;
0:000> dv /V
0000000b`970fe260 @x27+0×1000 ll = 0n-3689348814741910324
0000000b`970fd490 @x27+0×0230 align = 8
It is not aligned on the page boundary, and the value is not the expected 1:
0:000> dq 0000000b`970fe260 L1
0000000b`970fe260 cccccccc`cccccccc
However, in the disassembly, we see the following sequence of instructions to initialize the variable:
00007ff7`d061afdc f9533f69 ldr x9,[x27,#0x2678]
00007ff7`d061afe0 d2800028 mov x8,#1
00007ff7`d061afe4 f9000128 str x8,[x9]
So, we can see that the local variable address is stored at x27+0×2678:
0:000> dp x27+0x2678 L1
0000000b`970ff8d8 0000000b`970fd000
and see the correct variable value:
0:000> dpp x27+0x2678 L1
0000000b`970ff8d8 0000000b`970fd000 00000000`00000001
This analysis pattern differs from False Effective Address analysis pattern in the correct value of the base register.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -