why do kernel dump(full dump) can't get user stack trace most of time?

NTFSD
1

why do kernel dump(full dump) can’t get user stack trace most of time?
windbg command: !process 0x87654321(process address). or !thread
0x87654321(thread address).
windbg version: 6.11

2

Hi!

Please note that kernel memory dump != complete(full) memory dump.
If you choose complete memory dump, you would not face this problem.

Regards,
Ayush Gupta
http://windows-internals.blogspot.com/

Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

3

It’s my fault that I don’t write clearly. I choose full memory dump and
I am sure I choose complete memory dump. Because my physical memory is 2G,
the dump is 2G.

2009/3/2 Ayush Gupta

>
> Hi!
>
> Please note that kernel memory dump != complete(full) memory dump.
> If you choose complete memory dump, you would not face this problem.
>
> Regards,
> Ayush Gupta
> http://windows-internals.blogspot.com/
>
>
> Add more friends to your messenger and enjoy! Go to
> http://messenger.yahoo.com/invite/
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

Did you use .process /p /r to set the page directory contents properly and process the user mode loaded module list?

- S

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of ke li
Sent: Monday, March 02, 2009 7:16 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] why do kernel dump(full dump) can’t get user stack trace most of time?

It’s my fault that I don’t write clearly. I choose full memory dump and I am sure I choose complete memory dump. Because my physical memory is 2G, the dump is 2G.

2009/3/2 Ayush Gupta >

Hi!

Please note that kernel memory dump != complete(full) memory dump.
If you choose complete memory dump, you would not face this problem.

Regards,
Ayush Gupta
http://windows-internals.blogspot.com/

Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTFSD is sponsored by OSR For our schedule of debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

I tried the command “.process /p /r ” and then solved the
problem. Many thanks for your kind help.

2009/3/3 Skywing

> Did you use .process /p /r to set the page directory contents
> properly and process the user mode loaded module list?
>
>
>
> - S
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *ke li
> Sent: Monday, March 02, 2009 7:16 AM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] why do kernel dump(full dump) can’t get user stack
> trace most of time?
>
>
>
> It’s my fault that I don’t write clearly. I choose full memory dump and
> I am sure I choose complete memory dump. Because my physical memory is 2G,
> the dump is 2G.
>
>
> 2009/3/2 Ayush Gupta
>
>
> Hi!
>
> Please note that kernel memory dump != complete(full) memory dump.
> If you choose complete memory dump, you would not face this problem.
>
> Regards,
> Ayush Gupta
> http://windows-internals.blogspot.com/
>
>
> Add more friends to your messenger and enjoy! Go to
> http://messenger.yahoo.com/invite/
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>