1

I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to help me with this. I think I am on the right track.

Using Windbg and showing the call stack, I don't understand a few lines that do not have addresses not associated to any known modules in the lm list.

For example:

...
2a 0017ce64 61500ad3 cxt+0x3280ad3
2b 0017ce98 61500ad3 cxt+0x32c0d8e
2c 0017d500 0f026cf0 0x168d6f12
2d 0017d56c 168d094f 0xf026cf0
2e 0017d5a8 6154b791 cxt+0x32cb781
...

From lm it shows a list of available modules, amongst which cxt is there with base image. But the address listed in frame 2c and 2d don't belong to any particular module. There are similar lines further down in the call stack.

I don't have the symbols available. I doubt this is the issue since a module has a base image and a size (and thusly an ending address). If the two strange addresses don't belong to the range within the module in memory, it isn't part of the module. (I would think).

There's a lot of knowledge I'm missing, so I appreciate if someone can enlighten me as to what I'm missing.

Thanks!

Ed

2
  • 1
    none of your frames have proper return address the very large offsets indicate bogus resolution the module cxt is probably the nearest symbol windbg could find so it simply added a very large offset to what it found the offset means the function in question is atleast~ 53 million bytes big
    – blabb
    Commented Nov 3, 2021 at 19:02
  • oh wow.. I thought I had c&p the code wrong when I looked at the offsets; but they were that big. does this mean this dump is corrupt? I had thought I had loaded a different platform minidump; but when I loaded it in windbg, it stated that it couldn't load the timestamp for a particular dll file. (so it is at least Windows)
    – ewokx
    Commented Nov 4, 2021 at 1:28

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.