Memory Dump Analysis Anthology, Volume 5, Revised Edition
Memory Dump Analysis Anthology, Volume 5, Revised Edition
About the Book
This reference volume consists of revised, edited, cross-referenced, and thematically organized articles from Software Diagnostics Institute and Software Diagnostics Library (former Crash Dump Analysis blog) written in February 2010 - October 2010. In addition to various corrections, this major revision updates relevant links and removes obsolete references. Some articles are preserved for historical reasons. Most of the content, especially memory analysis and trace and log analysis pattern languages, is still relevant today and for the foreseeable future. The output of WinDbg commands is also remastered to include color highlighting. Crash dump analysis pattern names are also corrected to reflect the continued expansion of the catalog. The fifth volume features:
- 25 new crash dump analysis patterns
- 11 new pattern interaction case studies (including software tracing)
- 16 new trace analysis patterns
- 7 structural memory patterns
- 4 modeling case studies for memory dump analysis patterns
- Discussion of 3 common analysis mistakes
- Malware analysis case study
- Computer independent architecture of crash analysis report service
- Expanded coverage of software narratology
- Metaphysical and theological implications of memory dump worldview
- More pictures of memory space and physicalist art
- Classification of memory visualization tools
- Memory visualization case studies
- Close reading of the stories of Sherlock Holmes: Dr. Watson’s observational patterns
- Fully cross-referenced with Volumes 1 - 4
The primary audience for Memory Dump Analysis Anthology reference volumes is: software engineers developing and maintaining products on Windows platforms, technical support, escalation, and site reliability engineers dealing with complex software issues, quality assurance engineers testing software on Windows platforms, security and vulnerability researchers, reverse engineers, malware and memory forensics analysts. Trace and log analysis articles may be of interest to users of other platforms.
About the Author
Bundles that include this book
Table of Contents
Preface 17
Acknowledgements 19
About the Author 20
PART 1: Professional Crash Dump Analysis and Debugging 21
Common Mistakes 21
Not Double-Checking Symbolic Output 21
Not Looking Past the First Found Evidence 24
Not Recognizing Data as UNICODE or ASCII Fragments 26
Common Questions 28
What Service is This? 28
Complete Stack Traces from x64 System 30
Software Behavior Patterns 32
Crash and Hang Analysis Audit Service 33
Case Study: Extremely Inconsistent Dump and CPU Spike 34
Raw Stack Dump of All Thread Stacks 39
Architecture of CARE 41
PART 2: Crash Dump Analysis Patterns 43
Succession of Patterns 43
Wait Chain (Process Objects) 49
Coincidental Frames 55
Fault Context 59
Coupled Processes (Weak) 60
Hooked Functions (Kernel Space) 63
Hardware Activity 66
Incorrect Symbolic Information 71
Message Hooks 76
Blocked Thread (Hardware) 79
Coupled Machines 81
High Contention (Processors) 82
Thread Starvation (Normal Priority) 85
Coupled Processes (Semantics) 87
Abridged Dump 88
Exception Stack Trace 93
Wait Chain (RPC) 95
Distributed Spike 99
Instrumentation Information 108
Template Module 112
Invalid Exception Information 116
Shared Buffer Overwrite 120
Pervasive System 125
Problem Exception Handler 126
Deadlock (Self) 127
Same Vendor 128
PART 3: Crash Dump Analysis AntiPatterns 129
Wild Explanations 129
PART 4: Pattern Interaction 133
Inconsistent Dump, Stack Trace Collection, LPC, Thread, Process, Executive Resource Wait Chains, Missing Threads, and Waiting Thread Time 133
Fault Context, Wild Code, and Hardware Error 137
Main Thread, Critical Section Wait Chains, Critical Section Deadlock, Stack Trace Collection, Execution Residue, Data Contents Locality, Self-Diagnosis, and Not My Version 145
Strong Process Coupling, Stack Trace Collection, Critical Section Corruption, Wait Chains, Message Box, Self-Diagnosis, Hidden Exception, and Dynamic Memory Corruption 158
Object Distribution Anomaly, Inconsistent Dump, Execution Residue, Hardware Activity, Coincidental Symbolic Information, Not My Version, and Virtualized System 169
Spiking Thread, Main Thread, Message Hooks, Hooked Functions, Semantic Split, Coincidental Symbolic Information, and Not My Version 180
Stack Trace Collection, Special Process, LPC and Critical Section Wait Chains, Blocked Thread, Coupled Machines, Thread Waiting Time, and Object Distribution Anomaly 188
ALPC Wait Chains, Missing Threads, Waiting Thread Time and Semantic Process Coupling 200
Insufficient Kernel Pool Memory, Spiking Thread, and Data Contents Locality 201
Incorrect Stack Trace, Stack Overflow, Early Crash Dump, Nested Exception, Problem Exception Handler, and Same Vendor 206
PART 5: A Bit of Science and Philosophy 213
Memory Systems Language 213
Categories for the Working Software Defect Researcher 214
Collective Pointer 214
Notes on Memoidealism 217
Archaeological Foundations for Memory Analysis 218
On God and Miracles 220
Psychoanalysis of Software Troubleshooting and Debugging 221
Ontological and Epistemological Memoidealism 222
On Unconscious 223
Ruminations on Automated Debugging 224
General Memory Analysis 225
Notation for Memory and Trace Analysis 226
Category Theory and Troubleshooting 227
Software Chorography and Chorology: A Definition 229
PART 6: Fun with Crash Dumps 231
Music for Debugging 231
Retry, Abort, Escape 231
Debugging Slang 232
STUPID 232
On the Same Page 233
.SYS 234
PLOT 235
Freedom 236
Free Verse 237
BCE, BC, and CE 238
HCI 239
Blog 240
Inherit a Fortune 241
Dr. Watson’s Observational Patterns 242
Memory Dumps in Myths 245
Bus Debugging 246
Debugging the Debugger (16-bit) 247
Dr. DebugLove and Nature 249
Sailing Memory Spaces under an RGB Flag 253
Don’t Name Your Driver a “Missile” 254
Notepad Debugging 255
!analyze -vostokov 263
Contemplating Crash Dumps in Unicode 264
Memory Dump Analysis Services Cap and T-Shirt 266
Troubleshooting Poem in Six Stanzas 267
On the Interpretation of M-Theory 268
Check the Name of Your Driver in Reverse 269
PART 7: Software Trace Analysis 271
Pattern Interaction 271
Adjoint Threads, Discontinuity, and Time Delta 271
Basic Software PLOTs 272
Two Readings of a Software Trace 274
CDFMarker Tool 276
The Extended Software Trace 277
Presenting a Software Story 278
Adjoint Threading in Process Monitor 279
PART 8: Software Trace Analysis Patterns 281
Significant Event 281
Time Delta 282
Adjoint Thread of Activity 283
Trace Acceleration 284
Incomplete History 286
Background and Foreground Components 287
Defamiliarizing Effect 290
Anchor Messages 293
No Trace Metafile 296
No Activity 297
Trace Partition 299
Truncated Trace 301
Diegetic Messages 302
False Positive Error 303
Guest Component 304
Message Change 305
Layered Periodization 306
PART 9: Models of Software Behaviour 311
Multiple Exceptions Pattern 311
Memory Leak (Process Heap) Pattern 315
Message Hooks Pattern 326
Modeling C++ Object Corruption 330
PART 10: The Origin of Crash Dumps 335
More on Demystifying First-chance Exceptions 335
PART 11: Structural Memory Patterns 343
Memory Snapshot 343
Aggregate Snapshot 345
Snapshot Collection 346
Memory Region 347
Region Boundary 348
Memory Hierarchy 350
Anchor Region 351
PART 12: Memory Visualization 353
Memory Map Visualization Tools (Revised) 353
Decomposing Memory Dumps via DumpFilter 355
Can a Memory Dump be Blue? 359
Virtual to Physical Memory Mapping 360
The Memory Visualization Question 363
PART 13: Art 375
Sweet Oil of Memory 375
Night Sky 376
Component Trace 377
Ana-Trace-Log-Lyzer and Closed Session 378
Computer Memory Gardens 380
Debugging Venue 381
Inside a Memory File 382
Fabric of Memory Dumps 383
Race Condition in a Kernel Pool 394
Memory Interfaces 395
Bleeding Memory 396
Picture Frame for Memory Dumps 398
Front Cover Glitch 399
Chance Exceptions in a Turing Machine 400
PART 14: Security and Malware Analysis 401
Crash Dumps and Password Exposure 401
Crash Dump Analysis of Defective Malware 406
PART 15: Miscellaneous 411
Native Script Debugging 411
Component Heap 414
Attached Processes 416
User/Kernel Diagramming Styles 419
Appendix 423
Contention Patterns 423
Raw Stack Analysis Scripts 424
Crash Dump Analysis Checklist 425
Index of WinDbg Commands 429
Cover Images 431
Other books by this author
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Do Well. Do Good.
Authors have earned$10,913,181writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
- #1
Learning Algorithms Through Programming and Puzzle Solving
Alexander S. Kulikov and Pavel PevznerThis book powers our MicroMasters program on edX and specialization on Coursera, one of the ten most popular computer science courses on Coursera. Over half a million students have tried to solve many programming challenges and algorithmic puzzles described in this book. We invite you to join them! See the webpage of the book for more details.
- #2
入門 日本語自然言語処理
Masato Hagiwara and Paul O'Leary McCann日本語テキストを処理したい全てのプログラマ・エンジニアの方へ。分かち書きなどの基本から、自然言語生成などの最新の話題までをカバー。動かして学べるコードや、参照文献も付いています。言語学や機械学習の知識が無くても問題ありません。
- #3
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
- #4
Cloud Strategy
Gregor Hohpe“Strategy is the difference between making a wish and making it come true.” A successful migration to the cloud can transform your organization, but it shouldn’t be driven by wishes. This book tells you how to develop a sound strategy guided by frameworks and decision models without being overly abstract nor getting lost in product details.
- #5
Scrum Product Ownership - Navigating the Forest AND the Trees, 3'rd Edition
Robert GalenIn 2009, I published Scrum Product Ownership - Ed. 1. Then the 2'nd Ed. in 2013. This is the 3'rd edition, celebrating the 10th anniversary of the original book. It's evolved from a beginners guide to be a more balanced reference for beginners, practitioner, and expert Product Owners.
- #6
OpenIntro Statistics
David Diez, Christopher Barr, Mine Cetinkaya-Rundel, and OpenIntroA complete foundation for Statistics, also serving as a foundation for Data Science.
Leanpub revenue supports OpenIntro (US-based nonprofit) so we can provide free desk copies to teachers interested in using OpenIntro Statistics in the classroom and expand the project to support free textbooks in other subjects.
More resources: openintro.org.
- #7
Atomic Kotlin
Bruce Eckel and Svetlana IsakovaFor both beginning and experienced programmers! From the author of the multi-award-winning Thinking in C++ and Thinking in Java and a Kotlin team member comes a book that breaks concepts into small, easy-to-digest "atoms," along with exercises supported by hints and solutions directly inside IntelliJ IDEA! Full support at www.AtomicKotlin.com.
- #8
Introducing EventStorming
Alberto BrandoliniThe deepest tutorial and explanation about EventStorming, straight from the inventor.
- #9
Visualise, document and explore your software architecture
Simon BrownA short guide to visualising, documenting and exploring your software architecture.
- #10
Functional event-driven architecture: Powered by Scala 3
Gabriel VolpeExplore the event-driven architecture (EDA) in a purely functional way, mainly powered by Fs2 streams in Scala 3!
Leverage your functional programming skills by designing and writing stateless microservices that scale, powered by stateful message brokers.
Top Bundles
- #1
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books
"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before... - #2
The Indie Python Extravaganza
5 Books
The Indie Python Extravaganza! A collection of books that will help you to improve your knowledge of the Python programming language one page at a time. Join four indie authors in a journey from the basics of Python to the structure of production-ready systems, going through the core features of the language, some intermediate projects and a... - #3
CCIE Service Provider Ultimate Study Bundle
2 Books
Piotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification... - #4
Modern C++ Collection
3 Books
Get All about Modern C++C++ Standard Library, including C++20Concurrency with Modern C++, including C++20C++20Each book has about 200 complete code examples. Updates are included. When I update one of the books, you immediately get the updated bundle. You can expect significant updates to each new C++ standard (C++23, C++26, .. ) and also... - #6
Abandon Your Job - Leaving the Rat Race with Python
8 Books
Now, get all the great Python and Freelancing books from finxter.com in one single bundle!Coffee Break Python - All Python BasicsCoffee Break Python Workbook - Practice the basics of PythonCoffee Break Python Mastery Workouts - Practice advanced Python conceptsCoffee Break Python Slicing - All about SlicingCoffee Break Python NumPy - Get started... - #7
10 Books Bundle - A New Career in Tech 🚀
10 Books
Do you want to create yourself a new and profitable skillset - in one year or less? Do you want to position yourself on the right side of change finally? Do you want to work from home and set your own work schedule while choosing fun and interesting coding projects? Software developers and freelance developersearn six figuresin the US, according... - #8
The Python Craftsman
3 Books
The Python Craftsman series comprises The Python Apprentice, The Python Journeyman, and The Python Master. The first book is primarily suitable for for programmers with some experience of programming in another language. If you don't have any experience with programming this book may be a bit daunting. You'll be learning not just a programming... - #10
Pattern-Oriented Memory Forensics and Malware Detection
2 Books
This training bundle for security engineers and researchers, malware and memory forensics analysts includes two accelerated training courses for Windows memory dump analysis using WinDbg. It is also useful for technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible...
