skip to main | skip to sidebar

Thinking in WinDbg

Thursday, March 6, 2008

Find crash position

Dump stack:

image

Launch IDA Pro:

image

Address  = 0x10480 -0x480 + 0x1a10 = 0x11a10

There we are:

image

Posted by Hannibal at 1:10 PM
Labels: WinDbg command

No comments:

Post a Comment

Newer Post Older Post Home
Subscribe to: Post Comments (Atom)

Labels

  • Emacs (1)
  • Kernel (1)
  • WinDbg command (3)
  • WinDbg Script (2)

Blog Archive

  • ▼  2008 (8)
    • ►  June (1)
    • ►  May (1)
    • ▼  March (6)
      • If some idiot send dump file to you but don't know...
      • Find crash position
      • Where is current IRQL?
      • PID Condition breakpoint
      • List ZwCreateFile file name
      • 我常用的一些WinDbg script

About Me

Hannibal
View my complete profile