Memory Dump Analysis Interview Questions

This is the growing list of interview questions that might be useful to assess the skill level in crash dump analysis and debugging on Windows platforms.

  1. What is FPO?

  2. How many exceptions can be found in a crash dump?

  3. You see the message from WinDbg:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    What would you do?

  4. How would you find spinlock implementation if you have a kernel dump?

  5. What is OMAP?

  6. What is full page heap?

  7. Company name is missing from module information. How would you try to find it?

  8. What is IDT?

  9. How does a postmortem debugger work?

  10. You’ve got a mini dump of your application. How would you disassemble the code?

  11. Memory consumption is growing for an application. How would you discover the leaking component?

  12. What is IRQL?

  13. When do you use TEB?

  14. You’ve got 200 process dumps from a server. You need to find a deadlock. How would you do it?

  15. You’ve got a complete memory dump from a server. You need to find a deadlock. How would you do it?

  16. What is GC heap?

  17. Your customer is reluctant to send a dump due to security policies. What is your next step?

  18. What is a first chance exception?