From time to time, in some user-mode crash dumps, I find it impossible to unassemble certain functions. Most likely in the call stack of the thread that caused the fault. I see something like:
0:000> u 0abcdefa
MyMod!MyClass::MyFunc
0abcdefa ?? ???
^ Memory access error in ‘u 0abcdefa’
The address 0abcdefa I am trying to unassemble is the beginning of a routine I obtained by running the ‘x’ command.
What exactly does this mean? The module (MyMod) does seem loaded in the dump.
If I run ‘!address 0abcdefa’, at the very end, I get:
Content source: 0 (invalid), length: 3fdd
The address was either paged out at the time of the system crash OR you’re
just looking at a minidump which doesn’t capture the code. In the latter
case you can use the executable image path (Ctrl+i) to point WinDbg to the
images that back the code.
If it was paged out then you’re pretty much out of luck. However, note that
you can open ANY executable file as a dump file in WinDbg (Ctrl+D) and
disassemble the code. Not quite the same, but good enough for looking at the
assembly.
I was aware you could open any exe to view the assembly
but this exercise was confined to analyzing a crash dump
which had that odd feature of not being able to unassemble
the function I was interested in seeing.
Strangely enough, the fault happened just one level above
the function that I was wanting to see, on the call stack
stack. I find it slightly impossible for it to have gotten paged
out so quickly. (or maybe I am wrong here?)