Memory Dump Analysis Anthology, Volume 5 > Pattern Interaction > Strong Process Coupling, Stack Trace Collection, Critical Section Corruption and Wait Chains, Message Box, Self-Diagnosis, Hidden Exception and Dynamic Memory Corruption

Table of Contents

Download Safari Books Online apps: Apple iOS | Android

Entire Site

Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

This Book

Memory Dump Analysis Anthology, Volume 5

Search

Table of Contents

Dedication

Preface

Acknowledgements

PART 1. Professional Crash Dump Analysis and Debugging

PART 2. Crash Dump Analysis Patterns

PART 3. Crash Dump Analysis AntiPatterns

PART 4. Pattern Interaction

Inconsistent Dump, Stack Trace Collection, LPC, Tthread, Process, Executive Resource Wait Chains, Missing Threads and Waiting Thread Time

Fault Context, Wild Code and Hardware Error

Main Thread, Critical Section Wait Chains, Critical Section Deadlock, Stack Trace Collection, Execution Residue, Data Contents Locality, Self-Diagnosis and Not My Version

Strong Process Coupling, Stack Trace Collection, Critical Section Corruption and Wait Chains, Message Box, Self-Diagnosis, Hidden Exception and Dynamic Memory Corruption

IRP Distribution Anomaly, Inconsistent Dump, Execution Residue, Hardware Activity, Coincidental Symbolic Information, Not My Version, Virtualized System

Spiking Thread, Main Thread, Message Hooks, Hooked Functions, Semantic Split, Coincidental Symbolic Information and Not My Version

Stack Trace Collection, Special Process, LPC and Critical Section Wait Chains, Blocked Thread, Coupled Machines, Thread Waiting Time and IRP Distribution Anomaly

ALPC Wait Chains, Missing Threads, Waiting Thread Time and Semantic Process Coupling

Insufficient Kernel Pool Memory, Spiking Thread and Data Contents Locality

Incorrect Stack Trace, Stack Overflow, Early Crash Dump, Nested Exception, Problem Exception Handler and Same Vendor

PART 5. A Bit of Science and Philosophy

PART 6. Fun with Crash Dumps

PART 7. Software Trace Analysis

PART 8. Software Trace Analysis Patterns

PART 9. Models of Software Behaviour

PART 10. The Origin of Crash Dumps

PART 11. Structural Memory Patterns

PART 12. Memory Visualization

PART 13. Art

PART 14. Security and Malware Analysis

PART 15. Miscellanious

Appendix

Strong Process Coupling, Stack Trace Collection, Critical Section Corruption and Wait Chains, Message Box, Self-Diagnosis, Hidden Exception and Dynamic Memory Corruption

A print spooler service process was hanging and blocking print-related requests from other coupled processes (Volume 1, page 419). Default analysis of its dump doesn't show any problem (it shows the normal service main thread):

Code View: Scroll / Show All

0:000> !analyze -v

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

STACK_TEXT:
0006fbcc 7c82776b 77e418b2 00000064 00000000 ntdll!KiFastSystemCallRet
0006fbd0 77e418b2 00000064 00000000 00000000 ntdll!NtReadFile+0xc
0006fc38 77f65edb 00000064 0006fd04 0000021a kernel32!ReadFile+0x16c
0006fc64 77f65f82 00000064 0006fd04 0000021a advapi32!ScGetPipeInput+0x2a
0006fcd8 77f51ed9 00000064 0006fd04 0000021a advapi32!ScDispatcherLoop+0x51
0006ff3c 01004019 0100d5bc 010047a2 00000001
advapi32!StartServiceCtrlDispatcherW+0xe3
0006ff44 010047a2 00000001 00263fa0 00262be0 spoolsv!main+0xb
0006ffc0 77e6f23b 00000000 00000000 7ffd7000 spoolsv!mainCRTStartup+0x12f
0006fff0 00000000 0100468c 00000000 78746341 kernel32!BaseProcessStart+0x23

0:000> !analyze -v -hang

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

BUGCHECK_STR:  HANG

STACK_TEXT:
0006fbcc 7c82776b 77e418b2 00000064 00000000 ntdll!KiFastSystemCallRet
0006fbd0 77e418b2 00000064 00000000 00000000 ntdll!NtReadFile+0xc
0006fc38 77f65edb 00000064 0006fd04 0000021a kernel32!ReadFile+0x16c
0006fc64 77f65f82 00000064 0006fd04 0000021a advapi32!ScGetPipeInput+0x2a
0006fcd8 77f51ed9 00000064 0006fd04 0000021a advapi32!ScDispatcherLoop+0x51
0006ff3c 01004019 0100d5bc 010047a2 00000001
advapi32!StartServiceCtrlDispatcherW+0xe3
0006ff44 010047a2 00000001 00263fa0 00262be0 spoolsv!main+0xb
0006ffc0 77e6f23b 00000000 00000000 7ffd7000 spoolsv!mainCRTStartup+0x12f
0006fff0 00000000 0100468c 00000000 78746341 kernel32!BaseProcessStart+0x23

You are currently reading a PREVIEW of this book.

Get instant access to over
$1 million worth of books and videos.

Start a Free Trial

Download Safari Books Online apps: Apple iOS | Android

This Book

Search

Contents

PART 4. Pattern Interaction > Strong Process Coupling, Stack Trace Collection, ...

Strong Process Coupling, Stack Trace Collection, Critical Section Corruption and Wait Chains, Message Box, Self-Diagnosis, Hidden Exception and Dynamic Memory Corruption