O'Reilly logo

Memory Dump Analysis Anthology, Volume 3 by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 4. Pattern Interaction

Early Crash Dump, Blocked Thread, Not My Version and Lost Opportunity

It was reported that one important Windows service stops responding from time to time. The customer was proactive in gathering memory dumps and we got several early crash dumps (Volume 1, page 465). Most of them were false positive showing normal error handling via throwing an exception:

0:042> kL
ChildEBP RetAddr
0f7bec6c 77c31e37 kernel32!RaiseException+0×53
0f7bec84 77c32042 rpcrt4!RpcpRaiseException+0×24
0f7bec94 77cb30e4 rpcrt4!NdrGetBuffer+0×46
0f7bf080 09a554a6 rpcrt4!NdrClientCall2+0×197
[...]

However, one such dump also had a clearly blocked thread (Volume 2, page 184) that was blocking 10 other different threads:

0:042> !locks CritSec MyService!MainCriticalSection+0 ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required