Published by OpenTask, Republic of Ireland
Copyright © 2015 by OpenTask
Copyright © 2015 by Software Diagnostics Services
Copyright © 2015 by Dmitry Vostokov
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted, in any form or by any means, without the prior written permission of the
publisher.
You must not circulate this book in any other binding or cover, and you must impose the same
condition on any acquirer.
Product and company names mentioned in this book may be trademarks of their owners.
OpenTask books and magazines are available through booksellers and distributors worldwide.
For further information or comments send requests to press@opentask.com.
A CIP catalog record for this book is available from the British Library.
ISBN-l3: 978-1-908043-97-9 (Paperback)
1st printing, 2015
Revision 1.01 (February, 2016)
2
Contents
Presentation Slides and Transcript ................................................................................................................................. 5
Core Dump Collection ................................................................................................................................................... 25
Practice Exercises ......................................................................................................................................................... 31
Exercise 0 .................................................................................................................................................................. 36
Exercise A1 ............................................................................................................................................................... 40
Exercise A2D ............................................................................................................................................................. 53
Exercise A2C ............................................................................................................................................................. 58
Exercise A3 ............................................................................................................................................................... 62
Exercise A4 ............................................................................................................................................................... 66
Exercise A5 ............................................................................................................................................................... 72
Exercise A6 ............................................................................................................................................................... 76
Exercise A7 ............................................................................................................................................................... 93
Exercise A8 ............................................................................................................................................................. 102
Exercise A9 ............................................................................................................................................................. 117
Exercise A10 ........................................................................................................................................................... 132
Exercise A11 ........................................................................................................................................................... 149
Exercise A12 ........................................................................................................................................................... 157
App Source Code ........................................................................................................................................................ 171
App0 ....................................................................................................................................................................... 173
App1 ....................................................................................................................................................................... 174
App2D ..................................................................................................................................................................... 175
App2C ..................................................................................................................................................................... 177
App3 ....................................................................................................................................................................... 179
App4 ....................................................................................................................................................................... 181
App5 ....................................................................................................................................................................... 183
App6 ....................................................................................................................................................................... 185
App7 ....................................................................................................................................................................... 187
App8 ....................................................................................................................................................................... 189
App9 ....................................................................................................................................................................... 191
App10 ..................................................................................................................................................................... 193
App11 / App12 ....................................................................................................................................................... 195
Selected Patterns ....................................................................................................................................................... 197
NULL Pointer (data) ................................................................................................................................................ 199
3
Incomplete Stack Trace .......................................................................................................................................... 200
Stack Trace ............................................................................................................................................................. 201
NULL Pointer (code) ................................................................................................................................................ 202
Spiking Thread ........................................................................................................................................................ 203
Dynamic Memory Corruption (process heap) ......................................................................................................... 204
Execution Residue .................................................................................................................................................. 205
Coincidental Symbolic Information ......................................................................................................................... 207
Stack Overflow (user mode) ................................................................................................................................... 208
Divide by Zero (user mode) .................................................................................................................................... 209
Local Buffer Overflow ............................................................................................................................................. 210
C++ Exception ......................................................................................................................................................... 211
Paratext .................................................................................................................................................................. 212
Active Thread ......................................................................................................................................................... 213
Lateral Damage....................................................................................................................................................... 214
Critical Region ......................................................................................................................................................... 215
4
Presentation Slides and Transcript
5
6
Hello, everyone, my name is Dmitry Vostokov, and I teach this training course.
7
The prerequisites are hard to define. Some of you have software development experience and some
not. However, one thing is certain that to get most of this training you are expected to have basic
troubleshooting experience. Another thing I expect you to be familiar with is hexadecimal notation
and that you have seen or can read programming source code in some language. The ability to read
assembly language has some advantages but not necessary for this training. Windows memory dump
analysis experience may really help here and ease the transition but not absolutely necessary. If you
have read either Accelerated Mac OS X Core Dump Analysis or Accelerated Windows Memory
Dump Analysis book or both, you may find the similar approach here.