Because we finished the list of 10 common mistakes some time ago we continue with “more” series. A year ago we discovered the need to pay attention to differences between 32-bit and 64-bit versions of critical section structures and the need for explicit symbol qualification in x86 mode to avoid mistakes. This post was in draft since then and we now publish it. Suppose we see the address of a critical section on a 32-bit stack trace
read more......http://www.dumpanalysis.org/blog/index.php/2013/03/22/more-10-common-mistakes-in-memory-analysis-part-1/
read more......http://www.dumpanalysis.org/blog/index.php/2013/03/22/more-10-common-mistakes-in-memory-analysis-part-1/