What's new Search

Recent content by kd2024

K
[SOLVED] When setting a hardware breakpoint on access, do we need to do it per CPU core?

I'm testing this on an Arch64 CPU with multiple cores. Say, when in WinDbg I do: ba r 1 <addr> It sets a hardware breakpoint on read/write access to one byte at the <addr>. But does it mean that I'm limiting it only to the current CPU core? If so, how do I set this bp for all the cores?
- kd2024
- Thread
- Apr 18, 2024
- Replies: 1
- Forum: BSOD Crashes, Kernel Debugging
K
Question about stack frames in a postmortem crash dump

so going back to my original question about the .frame command. Here's a slightly different bugcheck. If I do: for the 0-th frame, which is the bugcheck function itself (the register output is what you see above.) Then if I do: As you can see it couldn't get Arg1. Let's try to check why...
- kd2024
- Post #9
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Question about stack frames in a postmortem crash dump

I'm still not fully understanding how it does it. I'll follow up on it with the next post. For now let me answer your points. Yeah, frame /r 0 will give more info. In this case though I clicked the blue link on the left in the call stack, so .frame 0n0;dv /t /v was WinDbg's built in...
- kd2024
- Post #8
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Question about stack frames in a postmortem crash dump

Yeah, thanks. I know most of that stuff. My question was about implementation of the .frame command. Does the extension walk the stack back to retrieve all the local parameters for the calls? Sure, you can walk the stack (on Aarch64) by reading FP and LR registers from the stack. But how does...
- kd2024
- Post #5
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Any suggestions how to triage PROCESS_HAS_LOCKED_PAGES bugcheck?

Hmm, thanks. !lockedpages is a good idea. I'll try. As for that registry setting, I will try it too if I have a repro. Usually I just get a crash dump and nothing else.
- kd2024
- Post #5
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Question about stack frames in a postmortem crash dump

Thanks for the link. I'll read it. I guess I should've pointed out that I'm asking it for an Aarch64 CPU, as it is architecture dependent.
- kd2024
- Post #3
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Any suggestions how to triage PROCESS_HAS_LOCKED_PAGES bugcheck?

Thanks, @ubuysa. I can't upload a .dmp file because of these reasons: The client I work for will not like the idea of me uploading these dumps. Privacy concerns of the people whose system crashed. The dumps are usually 16GB, 32GB or 64GB in size. At this point I can only blame a memory...
- kd2024
- Post #3
- Apr 9, 2024
- Forum: BSOD Crashes, Kernel Debugging
K
Any suggestions how to triage PROCESS_HAS_LOCKED_PAGES bugcheck?

I'm analyzing a kernel crash dump with the PROCESS_HAS_LOCKED_PAGES bugcheck. Here's what I get from WinDbg: (I don't get all parameters for this bugcheck. Only the ones that I'm showing below.) In this case Arg1 is 0, which means "Locked memory pages found in process being terminated". So...
- kd2024
- Thread
- Apr 8, 2024
- Replies: 4
- Forum: BSOD Crashes, Kernel Debugging
K
hello

Guys, where do I post a question about triaging/debugging a bugcheck? In other words I'm trying to do it myself (in WinDbg) but need to ask a few things if I get stuck.
- kd2024
- Post #8
- Apr 8, 2024
- Forum: Introductions - New Members
K
Question about stack frames in a postmortem crash dump

Say, I have a full kernel memory dump (.dmp file.) After I open it in WinDbg, and run the k command to get the callstack: I can click on some of the links that WinDbg provides on the left (00, 01, etc.) or just run: to retrieve stack frame 00. We usually get something like this for that...
- kd2024
- Thread
- Apr 6, 2024
- Replies: 8
- Forum: BSOD Crashes, Kernel Debugging
K
hello

Hey everyone: My line of work involves triaging and debugging Windows bugchecks (BSODs.) I came here from finding a very helpful blog by the user "x BlueRobot". I am here to expand my knowledge of Windows internals and probably to ask questions about triaging some bugchecks that I am not...
- kd2024
- Thread
- Apr 6, 2024
- Replies: 8
- Forum: Introductions - New Members

kd2024