title: Why can’t windbg display my user-mode call stack in a kernel mode dump?
body: <p>I wrote a program with Visual C++ and it crashes Windows. Luckily, I have a crash dump!</p>
  <p><code>!analyze -v</code> states that the faulty process is indeed my program and shows me a kernel-mode call stack. However, I need to understand the state of my user-mode program to make sense of it.</p>
  <p>According to some other answers here (e.g. <a href="https://stackoverflow.com/a/22261932/3091755">this one</a>), it should just work.</p>
  <p>But I cannot get any such information out of windbg. All call stacks simply end at <code>nt!KiSystemServiceCopyEnd+0x28</code>. As a minimal example, the call stack for an idle worker thread of mine from the standard Win32 thread pool:</p>
  <pre><code>nt!KiSwapContext+0x76
  nt!KiSwapThread+0xbfd
  nt!KiCommitThreadWait+0x144
  nt!KeRemoveQueueEx+0x27e
  nt!IoRemoveIoCompletion+0x99
  nt!NtWaitForWorkViaWorkerFactory+0x25e
  nt!KiSystemServiceCopyEnd+0x28 (TrapFrame @ ffff820d`2a2dfb00)
  0x00007ff8`08a1fa54
  </code></pre>
  <p>I would at least expect <code>RtlUserThreadStart</code> somewhere, but nothing in sight.</p>
  <p>The program in question was compiled in Visual C++ 2019 for x64 with debug information. The program and the PDB files are still in place, untouched since the crash. The Visual Studio debugger was attached at the time of the crash, but I have another one without a debugger and it’s no better.</p>
  <p>Interestingly, if I select other processes which ran during the crash and if I happen to hit one which wasn’t paged out (e.g. firefox), their callstacks end at <code>nt!KiSystemServiceCopyEnd+0x28</code> as well.</p>
  <p>What can I do to retrieve the state of my program during the crash?</p>