Comments for Software Diagnostics Library

Comment on Crash Dump Analysis Patterns (Part 291) by Dmitry Vostokov

Dmitry Vostokov — Sat, 11 Apr 2026 09:46:22 +0000

Categorize this stack trace: …
Split this stack trace into appropriate categories: …

Comment on Crash Dump Analysis Patterns (Part 293) by Dmitry Vostokov

Dmitry Vostokov — Sat, 11 Apr 2026 09:15:52 +0000

Explain all symbolic references.

Comment on Crash Dump Analysis Patterns (Part 291) by Dmitry Vostokov

Dmitry Vostokov — Sat, 11 Apr 2026 08:43:45 +0000

Annotate 10/10

Comment on Crash Dump Analysis Patterns (Part 291) by Dmitry Vostokov

Dmitry Vostokov — Sat, 11 Apr 2026 08:40:11 +0000

Brutally assess the annotation and score it.

Comment on Crash Dump Analysis Patterns (Part 291) by Dmitry Vostokov

Dmitry Vostokov — Sat, 11 Apr 2026 08:38:59 +0000

Write the best prompt to annotate stack traces. …

Comment on Crash Dump Analysis Patterns (Part 41a) by Dmitry Vostokov

Dmitry Vostokov — Sat, 31 Jan 2026 10:46:39 +0000

The stack trace from USB-keyboard generated dump on Windows 11 ARM64

MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

0: kd> kc
# Call Site
00 nt!KeBugCheck2
01 nt!KeBugCheckEx
02 kbdhid!KbdHidProcessCrashDump
03 kbdhid!KbdHid_InsertCodesIntoQueue
04 HIDPARSE!HidP_ModifierCode
05 HIDPARSE!HidP_TranslateUsageAndPagesToI8042ScanCodes
06 kbdhid!KbdHid_ReadComplete
07 nt!IopUnloadSafeCompletion
08 nt!IopfCompleteRequest
09 HIDCLASS!HidpDistributeInterruptReport
0a HIDCLASS!HidpInterruptReadComplete
0b nt!IopfCompleteRequest
0c Wdf01000!FxIrp::CompleteRequest
0d Wdf01000!FxRequest::CompleteInternal
0e Wdf01000!FxRequest::Complete
0f Wdf01000!imp_WdfRequestComplete
10 USBXHCI!Bulk_ProcessTransferEventWithED1
11 USBXHCI!Bulk_EP_TransferEventHandler
12 USBXHCI!Endpoint_TransferEventHandler
13 USBXHCI!Interrupter_DeferredWorkProcessor
14 Wdf01000!FxInterrupt::DpcHandler
15 Wdf01000!FxInterrupt::_InterruptDpcThunk
16 nt!KiExecuteAllDpcs
17 nt!KiRetireDpcList
18 nt!KxPlatformSwapStacksAndCall
19 nt!KiPlatformSwapStacksAndCallReturn
1a nt!KiDispatchInterrupt
1b nt!HalpInterruptCheckForSoftwareInterrupt
1c nt!KiInterruptException
1d nt!KiUserInterruptHandler
1e ntdll!RtlpHpTagFreeHeap
1f ntdll!RtlFreeHeap
20 msvcrt!free
21 diagperf!XPerfCore::CPathNode::`scalar deleting destructor’
22 diagperf!XPerfCore::CPathNode::Insert
23 diagperf!XPerfCore::CPathNode::Insert
24 diagperf!XPerfCore::CPathNode::Insert
25 diagperf!XPerfCore::CPathNode::Insert
26 diagperf!XPerfAddIn::CProcessInfoSource::ImageEvent
27 diagperf!XPerfAddIn::CProcessInfoSource::OnEvent
28 diagperf!XPerfCore::CSession::OnEventRecord
29 diagperf!XPerfCore::CSession::EventRecordCallback
2a diagperf!XPerfCore::CEtwTrace::EventRecordCallback
2b sechost!EtwpProcessTraceLog
2c sechost!ProcessTrace
2d diagperf!XPerfCore::CEtwTraceGroup::ProcessEvents
2e diagperf!XPerfCore::CSession::ProcessEvents
2f diagperf!PerfDiagBoot::CTraceContext::Open
30 diagperf!BootScenario::PerformTroubleshooting
31 diagperf!BootScenario::TroubleShoot
32 diagperf!PerfDiagDm::CDmManager::HandleInstance
33 diagperf!WdiHandleInstance
34 wdi!WdipHandleInstance
35 wdi!WdipProcessDiagnosticMessage
36 wdi!WdipProcessSessionMessage
37 wdi!WdipSessionListener
38 ntdll!TppAlpcpExecuteCallback
39 ntdll!TppWorkerThread
3a KERNEL32!BaseThreadInitThunk
3b ntdll!RtlUserThreadStart

Comment on Crash Dump Analysis Patterns (Part 305) by Dmitry Vostokov

Dmitry Vostokov — Sat, 10 Jan 2026 17:17:38 +0000

If you open an ARM64 dump of a 32-bit process, use .effmach CHPE and .effmach ARM64 to switch between both modes.

Comment on Crash Dump Analysis Patterns (Part 155) by Dmitry Vostokov

Dmitry Vostokov — Sat, 10 Jan 2026 11:36:02 +0000

These can surface in kv args output

Comment on Crash Dump Analysis Patterns (Part 56) by Dmitry Vostokov

Dmitry Vostokov — Tue, 23 Dec 2025 22:07:46 +0000

Wild Code memory dump analysis pattern example:

0:000> db @$scopeip L10
04fd0002 48 61 70 70 79 20 48 6f-6c 69 64 61 79 73 21 00 Happy Holidays!.

0:000> u @$scopeip
04fd0002 48 dec eax
04fd0003 61 popad
04fd0004 7070 jo 04fd0076
04fd0006 7920 jns 04fd0028
04fd0008 48 dec eax
04fd0009 6f outs dx,dword ptr [esi]
04fd000a 6c ins byte ptr es:[edi],dx
04fd000b 6964617973210000 imul esp,dword ptr [ecx+79h],2173h

Comment on Crash Dump Analysis Patterns (Part 160) by Dmitry Vostokov

Dmitry Vostokov — Sat, 15 Nov 2025 19:23:51 +0000

Another example from Windows ARM64: aligned local variable:

_Alignas(4096) long long ll = 1;

0:000> dv /V
00000037`30b8e690 @x27+0×1000 ll = 0n-3689348814741910324
00000037`30b8d8c0 @x27+0×0230 align = 8

They are stored indirectly instead:

00007ff6`e7afafdc f9533f69 ldr x9,[x27,#0×2678]
00007ff6`e7afafe0 d2800028 mov x8,#1
00007ff6`e7afafe4 f9000128 str x8,[x9]

0:000> ? @x27+0×2678
Evaluate expression: 237040631048 = 00000037`30b8fd08
0:000> dp 00000037`30b8fd08 L1
00000037`30b8fd08 00000037`30b8d000
0:000> dpp 00000037`30b8fd08 L1
00000037`30b8fd08 00000037`30b8d000 00000000`00000001