Intro to Debugging a Memory Dump

I was discussing debugging with some folk internally that didn’t really have much exposure to it, but wanted to learn.  I considered the items pretty basic and didn’t really dive into to much, but I had a few comments that the information was good.  One thing I found that was interesting was that I did some searching around, and couldn’t really find a good reference that summed up the items below.  I found some information on the individual items, but I knew what to go look for.  From the perspective of someone just getting started, it wasn’t obvious.  So, I figured I would share out what I put together as it may be helpful for someone else.

NOTE:  All examples below are using the public Debugger along with public symbols and extensions.  These are available to everyone.

Intro to the Intro

There are some concepts that go along with Debugging that are sometimes not addressed directly when we look at the topic of debugging itself.  These concepts are extremely helpful when we start going through dumps and understand how to connect the dots.  Foundational knowledge really helps in this complex topic.  I will try to add some public references to some items you can read up on, but this shouldn’t be where you stop.  If you really are interested in this topic, there is a wealth of information out there that can help with some of the background. 

A good place to start is the Windows Internals book by David Solomon and Mark Russinovich.  Specifically the chapter on Memory Management and how this works. When talking about Dumps and Debugging, we are working with the contents of Memory. Understanding how memory works is extremely helpful.  Note:  Volume 6 Part 1 was just recently release, but it looks like the Memory Management pieces for Volume 6 will be in Part 2. 

Having some development experience is also helpful.  While you may not need to look at Code directly in a dump, you are looking at the results of code.  The concept of Pointers is sometimes hard for someone to grasp that doesn’t necessarily have a programming background, but when dealing with a memory dump, or debugging, the understanding of how Pointers work can be very helpful.  Even when we are debugging a Managed (.NET) application instead of a Native (C++ or non-managed) Application.  Another good book is Windows via C/C++ by Jeffrey Rickter and Christophe Nasarre. 

The last book I will mention is Debugging Applications by John Robbins.  It should be obvious why I’m recommending it – having to do with Debugging and all.

The above books are not for the feint of heart, but do provide a lot of great information.  From a support perspective, these are two books you see on most people’s bookshelves.  I definitely recommend them for yours and will really help with regards to this topic.

Read more: CSS SQL Server Engineers 

QR: 

Posted via email from Jasper-net