Raw Stack Dump of All Threads (Kernel Space)

Having done in the past with user space raw stack data analysis for 32-bit complete memory dumps (Volume 1, page 236) we found today the need to look at kernel raw stack data from all threads and created this fast script:

!for_each_thread "!thread @#Thread; r? $t1 = ((nt!_KTHREAD *) @#Thread )-
>StackLimit; r? $t2 = ((nt!_KTHREAD *) @#Thread )->InitialStack; dps @$t1
@$t2"

It can be run for kernel and complete memory dumps from both x86 and x64 systems. If you need correct symbolic mapping for user space in kernel space data you need to modify it a bit and it will be slower to run.

!for_each_thread "!thread @#Thread 3f; .thread /r /p @#Thread; r? $t1 =
((nt!_KTHREAD *) @#Thread )->StackLimit; r? $t2 = ((nt!_KTHREAD *)
@#Thread )->InitialStack; dps @$t1 @$t2"