Memory Dump Analysis Anthology, Volume 3, Revised Edition
Memory Dump Analysis Anthology, Volume 3, Revised Edition
About the Book
This reference volume consists of revised, edited, cross-referenced, and thematically organized articles from Software Diagnostics Institute and Software Diagnostics Library (former Crash Dump Analysis blog) written in October 2008 - June 2009. In addition to various corrections, this major revision updates relevant links and removes obsolete references. Some articles are preserved for historical reasons. Most of the content, especially memory analysis and trace and log analysis pattern languages, is still relevant today and for the foreseeable future. The output of WinDbg commands is also remastered to include color highlighting. Crash dump analysis pattern names are also corrected to reflect the continued expansion of the catalog.
Compared to the second revised volume, the third revised volume features:
- 15 new crash dump analysis patterns
- 29 new pattern interaction case studies
- Trace analysis patterns
- Fully cross-referenced with Volume 1 and Volume 2
- New appendixes
The primary audience for Memory Dump Analysis Anthology reference volumes is: software engineers developing and maintaining products on Windows platforms, technical support, escalation, and site reliability engineers dealing with complex software issues, quality assurance engineers testing software on Windows platforms, security and vulnerability researchers, reverse engineers, malware and memory forensics analysts. Trace and log analysis articles may be of interest to users of other platforms.
About the Author
Table of Contents
Preface 17
Acknowledgments 19
About the Author 20
PART 1: Professional Crash Dump Analysis 21
Sparse Complete x64 Memory Dumps 21
Common Mistakes 24
Not Looking at All Stack Traces 24
Dump Analysis on Windows 7 28
32-bit Stack Traces from x64 Complete Memory Dumps 43
Debugger Log Reading Technique 48
Variable Kernel Stack in Vista and W2K8 49
Advanced Local Procedure Call WinDbg Extension 52
!cs vs. !ntsdexts.locks 54
Copyright as Timestamp 55
NULL Data Pointer Pattern: Case Study 56
Looking for Abnormal: Case Study 60
Raw Stack Dump of All Threads 62
Comparative Memory Dump Analysis: CPU Spikes 63
Graphical Notation for Memory Dumps 68
Exception Addresses from Event Logs 71
The Importance of Symbols 72
Platformorphism 75
PART 2: Crash Dump Analysis Patterns 77
Data Alignment (Page Boundary) 77
Multiple Exceptions (Kernel Mode) 78
C++ Exception 84
Deadlock (Mixed Objects, Kernel Space) 85
Wait Chain (Thread Objects) 92
Divide by Zero (User Mode) 96
Wait Chain (LPC/ALPC) 97
Insufficient Memory (Physical Memory) 104
Swarm of Shared Locks 107
Process Factory 112
Paged Out Data 118
Semantic Split 120
Pass-Through Function 129
NULL Pointer (Data) 131
JIT Code (.NET) 132
PART 3: Crash Dump Analysis AntiPatterns 137
No Question 137
Missing Space 138
PART 4: Pattern Interaction 141
Early Crash Dump, Blocked Thread, Not My Version, and Lost Opportunity 141
Lateral Damage, Stack Overflow, and Execution Residue 144
Truncated Dump, Spiking Thread, Not My Version, and Hooked Functions 149
Stack Trace Collection, Hidden Exception, and NULL Code Pointer 155
WOW64, Blocked Threads, and Coupled Processes 160
Invalid Handle, Stack Trace Collection, Multiple Exceptions, Invalid Pointer, Data Alignment on Page Boundary, Dynamic Memory Corruption, and Not My Version 163
Wait Chain and Spiking Thread 167
Blocked GUI Thread, Wait Chain, and Virtualized Process 170
Insufficient Memory, Handle Leak, Wait Chain, Deadlock, Inconsistent Dump, and Overaged System 175
Memory Leak, Spiking Threads, Wait Chain, High Critical Section Contention, and Module Variety 181
NULL Code Pointer, Changed Environment, Hooked Functions, and Execution Residue 196
Swarm of Shared Locks, Blocked Threads, and Waiting Time 201
Stack Trace Collection, Blocked Thread, and Coupled Processes 205
Insufficient Memory, Handle Leak, Process Factory, High Contention, and Busy System 209
Busy System, Blocked Threads, Wait Chains, and Deadlock 215
Manual Dump, Dynamic Memory Corruption, Blocked Threads, Stack Trace Collection, Multiple Exceptions, Wait Chains and Deadlock 224
Coupled Processes, Wait chains, Message Box, Waiting Thread Time, Paged Out Data, Incorrect Stack Trace, Hidden Exception, Unknown Component, and Execution Residue 228
Manual Dump, Wait Chain, Blocked Thread, Dynamic Memory Corruption, and Historical Information 236
Blocked Threads, Message Box, and Self-Diagnosis 240
Manual and Early Crash Dump, Stack Trace Collection, Main Thread, Blocked Threads, and Pass-Through Functions 241
Blocked Thread, Historical Information, Execution Residue, Hidden Exception, Dynamic Memory Corruption, Incorrect Stack Trace, and Not My Version 245
Null Data Pointer, Incorrect Stack Trace, Changed Environment, Hooked Functions, and Coincidental Symbolic Information 248
Heap Corruption, Module Variety, Execution Residue, Coincidental Symbolic Information, and Critical Section Corruption 255
Stack Trace Collection, Blocked Threads, Pass-Through Functions, and Main Thread 262
Stack Trace, Invalid Code Pointer, and Hooked Functions 264
Manual Dump, Virtualized Process, Stack Trace Collection, Multiple Exceptions, Optimized Code, Wild Code Pointer, Incorrect Stack Trace, and Hidden Exception 268
Main Blocked Thread, Missing Component, Execution Residue, and Data Contents Locality 275
Inconsistent Dump, Blocked Threads, Wait Chains, Incorrect Stack Trace, and Process Factory 279
Invalid Pointer, Incorrect Stack Trace, Multiple Exceptions, Insufficient Memory, and Memory Leak 288
PART 5: A Bit of Science and Philosophy 295
Universal Memory Dump: A Definition 295
The Source of Intuition about Infinite 296
Geometrical Debugging 297
Riemann Programming Language 299
Is Memory Dump Analysis a Science? 300
My Dangerous Idea: Parameterized Science 301
Unique Events and Historical Narratives 302
Notes on Memoidealism 303
A Copernican Revolution in Debugging 305
On Subjectivity of Software Defects 306
Memory Field Theories of Memuonics 307
Software Trace: A Mathematical Definition 308
Quantum Memory Dumps 309
Chemistry of Virtual Memory 310
PART 6: Fun with Crash Dumps 313
Music for Debugging 313
Bugs Never Disappear 313
Horrors of Computation 314
Passion, Intellect, and Expression 315
Headphones for Debugging 316
In the Memory Dump File 317
Bugteriology 318
Implausible Debugging Book Titles 319
Build Date Astrology 320
Breaking Technical Barrier 321
Occult Debugging 322
The Year of Dump Analysis! 323
Stack Traces and Poetry 324
Debugging Slang 326
Memory Dump Analysis Walks 327
E-Acheri 329
The Meaning of DATA 330
Irish Government on Dumps 331
Memory Dumps as Relics 332
The Ghost of Adelphi Training Center 333
PART 7: Software Troubleshooting 335
I’m RARE 335
To Bugcheck or Not To Bugcheck 336
T&D Labyrinth 337
Efficient vs. Effective: DATA View 339
PART 8: Software Trace Analysis 341
Tracing Best Practices 341
Software Narratology: A Definition 342
PART 9: Software Trace Analysis Patterns 343
Introduction 343
Periodic Error 344
Basic Facts 345
Circular Trace 346
Intra-Correlation 347
PART 10: The Origin of Crash Dumps 351
Hide, Seek, and Dump 351
OSMOSIS Memory Dumps 353
Tools 356
Crash2Hang 356
MTCrash 358
Where did the Crash Dump Come from? 363
FinalExceptionHandler 364
PART 11: Memory Visualization 367
The Art of Memory Corruption 367
Visualizing Secondary Storage 368
Pictures from Memory Space 369
PART 12: Miscellaneous 375
Hexadecimal/Decimal Chaos 375
The Measure of Debugging and Memory Dump Analysis Complexity 376
How To Simulate a Process Hang? 377
A Windows Case for Delta Debugging 378
Sentinel Pointers 380
Collapsed Stack Trace 381
Appendix A 383
Crash Dump File Examples 383
Appendix B 385
Crash Dump Analysis Checklist 385
Appendix C 389
Memory Dump Analysis Pattern: A Definition 389
Wait Chain Patterns 389
DLL Link Patterns 389
Insufficient Memory Patterns 390
Dynamic Memory Corruption Patterns 390
Deadlock Patterns 390
Index of WinDbg Commands 391
Cover Images 394
Other books by this author
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Do Well. Do Good.
Authors have earned$10,462,200writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
- #1
Functional Programming Made Easier
Charles ScalfaniA Functional Programming book from beginner to advanced without skipping a single step along the way.
In my 40 years of programming, I've felt that programming books always let me down, especially Functional Programming books. So, I wrote the book I wish I had 5 years ago.
Functional Programming will never be easy, but it can be easier.
- #2
Rector - The Power of Automated Refactoring
Matthias Noback and Tomas VotrubaLearn how to automatically and continuously upgrade and improve your PHP code base
- #3
CCIE SP v5.0
Łukasz Bromirski, Piotr Jablonski, and Nicholas RussoAre you striving to prepare to and pass CCIE SP lab exam? Take the opportunity and get this workbook! With the attached initial cfg files you will prepare yourself for the CCIE SP exam as well as learn SP technologies applicable to all kinds of today modern networks! This workbook covers blueprint topics and provides challenging examples.
- #4
Atomic Kotlin
Bruce Eckel and Svetlana IsakovaFor both beginning and experienced programmers! From the author of the multi-award-winning Thinking in C++ and Thinking in Java and a Kotlin team member comes a book that breaks concepts into small, easy-to-digest "atoms," along with exercises supported by hints and solutions directly inside IntelliJ IDEA! Full support at www.AtomicKotlin.com.
- #5
Continuous Delivery Pipelines
Dave FarleyThis practical handbook provides a step-by-step guide for you to get the best continuous delivery pipeline for your software.
- #6
CCIE Service Provider Version 4 Written and Lab Exam Comprehensive Guide
Nicholas RussoThe service provider landscape has changed rapidly over the past several years. Networking vendors are continuing to propose new standards, techniques, and procedures for overcoming new challenges while concurrently reducing costs and delivering new services. Cisco has recently updated the CCIE Service Provider track to reflect these changes; this book represents the author's personal journey in achieving that certification.
- #7
The Hundred-Page Machine Learning Book
Andriy BurkovEverything you really need to know in Machine Learning in a hundred pages.
- #8
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
- #9
R Programming for Data Science
Roger D. PengThis book brings the fundamentals of R programming to you, using the same material developed as part of the industry-leading Johns Hopkins Data Science Specialization. The skills taught in this book will lay the foundation for you to begin your journey learning data science. Printed copies of this book are available through Lulu.
- #10
Introducing EventStorming
Alberto BrandoliniThe deepest tutorial and explanation about EventStorming, straight from the inventor.
- #11
The Book of TameFlow
Steve TendonDo you need a high performance enterprise governance approach improving management, execution and delivery while dealing with multiple projects/products, events, stakeholders and teams? Giving you better bottom line results, faster time to market, less work, better predictability, happier employees, and delighted clients? Then learn about TameFlow!
- #12
Hands-On Quantum Machine Learning With Python
Frank ZickertYou're interested in quantum computing and machine learning...
But you don't know how to get started? Let me help.
Hands-On Quantum Machine Learning With Python is your comprehensive guide to get started with Quantum Machine Learning - the use of quantum computing for computation of machine learning algorithms.
- #13
Practical FP in Scala: A hands-on approach
Gabriel VolpeA practical book aimed for those familiar with functional programming in Scala who are yet not confident about architecting an application from scratch.
Together, we will develop a purely functional application using the best libraries in the Cats ecosystem, while learning about design patterns and best practices.
- #14
Deep Learning with PyTorch Step-by-Step
Daniel Voigt GodoyIn 2019, I published a PyTorch tutorial on Towards Data Science and I was amazed by the reaction from the readers! Their feedback motivated me to write this book to help beginners start their journey into Deep Learning and PyTorch. I hope you enjoy reading this book as much as I enjoy writing it.
- #15
Technical leadership and the balance with agility
Simon BrownA developer-friendly, practical and pragmatic guide to lightweight software architecture, technical leadership and the balance with agility.
- #16
Visualise, document and explore your software architecture
Simon BrownA short guide to visualising, documenting and exploring your software architecture.
- #17
The Simple Haskell Handbook
Marco SampellegriniA project-driven approach to practical Haskell development. Start from zero lines of code and finish with a working CI Server. Step by step. One type error at a time.
- #18
C++20
Rainer GrimmC++20 is the next big C++ standard after C++11. As C++11 did it, C++20 changes the way we program modern C++. This change is, in particular, due to the big four of C++20: ranges, coroutines, concepts, and modules.
- #19
Ansible for Kubernetes
Jeff GeerlingAnsible is a powerful infrastructure automation tool. Kubernetes is a powerful application deployment platform. Learn how to use these tools to automate massively-scalable, highly-available infrastructure.
- #20
Advanced Web Application Architecture
Matthias NobackThe missing manual for making your web applications future-proof
Top Bundles
- #1
CCIE Service Provider Ultimate Study Bundle
2 Books
Piotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification... - #2
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books
"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before... - #3
All the Books of The Medical Futurist
6 Books
We put together the most popular books from The Medical Futurist to provide a clear picture about the major trends shaping the future of medicine and healthcare. Digital health technologies, artificial intelligence, the future of 20 medical specialties, big pharma, data privacy, digital health investments and how technology giants such as Amazon... - #6
9 Books-Bundle: Shut Up and Code!
9 Books
"Shut up and code." Laughter in the audience. The hacker had just plugged in his notebook and started sharing his screen to present his super-smart Python script. "Shut up and code" The letters written in a white literal coding font on black background was the hackers' home screen background mantra. At the time, I was a first-year computer... - #9
Development and Deployment of Multiplayer Online Games, Part ARCH. Architecture (Vol. I-III)
3 Books
What's the Big Idea? The idea behind this book is to summarize the body of knowledge that already exists on multiplayer games but is not available in one single place.And quite a fewof the issues discussed within this series (planned as three nine volumes ~300 pages each), while known in the industry, have not been published at all (except for... - #10
Mastering Containers
2 Books
Docker and Kubernetes are taking the world by storm! These books will get you up-to-speed fast! Docker Deep Dive is over 400 pages long, and covers all objectives on the Docker Certified Associate exam.The Kubernetes Book includes everything you need to get up and running with Kubernetes!
