Hi, Kai,
This is what you want, with -dH. If you need further information, please let me
know. Finch.
.........
.........
(8b8.8bc): Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntdll.dll -
ntdll!DbgBreakPoint:
00000000`77ef2aa0 cc int 3
0:000> p
ntdll!DbgBreakPoint+0x1:
00000000`77ef2aa1 c3 ret
0:000> p
ntdll!LdrInitShimEngineDynamic+0xcbc:
00000000`77f1bbcc 8b95bc000000 mov edx,dword ptr [rbp+0BCh]
ss:000007ff`fffde0bc=00000070
0:000> p
ntdll!LdrInitShimEngineDynamic+0xcc2:
00000000`77f1bbd2 d1ea shr edx,1
0:000> p
ntdll!LdrInitShimEngineDynamic+0xcc4:
00000000`77f1bbd4 80e201 and dl,1
0:000> p
ntdll!LdrInitShimEngineDynamic+0xcc7:
00000000`77f1bbd7 8815bdb30800 mov byte ptr
[ntdll!NlsMbOemCodePageTag+0x882 (00000000`77fa6f9a)],dl ds:00000000`77fa6f9a=00
0:000> p
ntdll!LdrInitShimEngineDynamic+0xccd:
00000000`77f1bbdd e9939bfbff jmp ntdll!CsrCaptureMessageBuffer+0x3b5
(00000000`77ed5775)
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3b5:
00000000`77ed5775 488bb42410010000 mov rsi,qword ptr [rsp+110h]
ss:00000000`0022f7e0=0000000000000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3bd:
00000000`77ed577d 4885f6 test rsi,rsi
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3c0:
00000000`77ed5780 0f855c640400 jne ntdll!LdrInitShimEngineDynamic+0xcd2
(00000000`77f1bbe2) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3c6:
00000000`77ed5786 498bcd mov rcx,r13
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3c9:
00000000`77ed5789 e852e2ffff call ntdll!CsrClientConnectToServer+0x2f0
(00000000`77ed39e0)
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3ce:
00000000`77ed578e 4533e4 xor r12d,r12d
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3d1:
00000000`77ed5791 498bcf mov rcx,r15
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3d4:
00000000`77ed5794 e8d78f0000 call ntdll!RtlDeregisterWait+0x640
(00000000`77ede770)
0:000> p
ModLoad: 000007ff`7d500000 000007ff`7d539000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 000007ff`7fee0000 000007ff`7ffe5000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 000007ff`7fd30000 000007ff`7fec9000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 000007ff`7e9c0000 000007ff`7e9e2000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 000007ff`69300000 000007ff`6930d000 C:\WINDOWS\system32\LPK.DLL
ModLoad: 000007ff`78e80000 000007ff`78f0e000 C:\WINDOWS\system32\USP10.dll
ntdll!CsrCaptureMessageBuffer+0x3d9:
00000000`77ed5799 85c0 test eax,eax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3db:
00000000`77ed579b 8bd8 mov ebx,eax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3dd:
00000000`77ed579d 0f8861640400 js ntdll!LdrInitShimEngineDynamic+0xcf4
(00000000`77f1bc04) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3e3:
00000000`77ed57a3 833d86ea0c0000 cmp dword ptr [ntdll!pow+0x2230
(00000000`77fa4230)],0 ds:00000000`77fa4230=00000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3ea:
00000000`77ed57aa 0f858e640400 jne ntdll!LdrInitShimEngineDynamic+0xd2e
(00000000`77f1bc3e) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3f0:
00000000`77ed57b0 488b8530020000 mov rax,qword ptr [rbp+230h]
ss:000007ff`fffde230=0000000000000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3f7:
00000000`77ed57b7 4885c0 test rax,rax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x3fa:
00000000`77ed57ba 0f85c7640400 jne ntdll!LdrInitShimEngineDynamic+0xd77
(00000000`77f1bc87) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x400:
00000000`77ed57c0 4d85ed test r13,r13
0:000> p
ntdll!CsrCaptureMessageBuffer+0x403:
00000000`77ed57c3 0f85c6640400 jne ntdll!LdrInitShimEngineDynamic+0xd7f
(00000000`77f1bc8f) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x409:
00000000`77ed57c9 33c0 xor eax,eax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x40b:
00000000`77ed57cb e92ee6ffff jmp ntdll!RtlSetThreadPoolStartFunc+0x10e
(00000000`77ed3dfe)
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x10e:
00000000`77ed3dfe 660f6fb424b0020000 movdqa xmm6,xmmword ptr [rsp+2B0h]
ss:00000000`0022f980=00000000000000000000000000000000
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x117:
00000000`77ed3e07 eb4a jmp
ntdll!RtlSetThreadPoolStartFunc+0x163(00000000`77ed3e53)
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x163:
00000000`77ed3e53 488bb424f0020000 mov rsi,qword ptr [rsp+2F0h]
ss:00000000`0022f9c0=0000000000000000
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x16b:
00000000`77ed3e5b eb2a jmp
ntdll!RtlSetThreadPoolStartFunc+0x197(00000000`77ed3e87)
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x197:
00000000`77ed3e87 4c8bbc24c8020000 mov r15,qword ptr [rsp+2C8h]
ss:00000000`0022f998={ntdll (00000000`77ec0000)}
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x19f:
00000000`77ed3e8f 4c8bb424d0020000 mov r14,qword ptr [rsp+2D0h]
ss:00000000`0022f9a0=000000000022fab0
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1a7:
00000000`77ed3e97 4c8bac24d8020000 mov r13,qword ptr [rsp+2D8h]
ss:00000000`0022f9a8=0000000000000003
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1af:
00000000`77ed3e9f 4c8ba424e0020000 mov r12,qword ptr [rsp+2E0h]
ss:00000000`0022f9b0=0000000000000001
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1b7:
00000000`77ed3ea7 488bbc24e8020000 mov rdi,qword ptr [rsp+2E8h]
ss:00000000`0022f9b8=000007fffffde000
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1bf:
00000000`77ed3eaf 488bac2418030000 mov rbp,qword ptr [rsp+318h]
ss:00000000`0022f9e8=0000000000000000
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1c7:
00000000`77ed3eb7 488b9c2410030000 mov rbx,qword ptr [rsp+310h]
ss:00000000`0022f9e0=0000000000000000
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1cf:
00000000`77ed3ebf 488b8c24a0020000 mov rcx,qword ptr [rsp+2A0h]
ss:00000000`0022f970=0000000077f8515f
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1d7:
00000000`77ed3ec7 e8b4fe0100 call ntdll!RtlAllocateHeap+0x1f0
(00000000`77ef3d80)
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1dc:
00000000`77ed3ecc 4881c4f8020000 add rsp,2F8h
0:000> p
ntdll!RtlSetThreadPoolStartFunc+0x1e3:
00000000`77ed3ed3 c3 ret
0:000> p
ntdll!CsrCaptureMessageBuffer+0x46f:
00000000`77ed582f 8bd8 mov ebx,eax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x471:
00000000`77ed5831 89442430 mov dword ptr [rsp+30h],eax
ss:00000000`0022fa00=00000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x475:
00000000`77ed5835 85c0 test eax,eax
0:000> p
ntdll!CsrCaptureMessageBuffer+0x477:
00000000`77ed5837 0f883a510400 js
ntdll!LdrSetAppCompatDllRedirectionCallback+0x197 (00000000`77f1a977) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x47d:
00000000`77ed583d 488b8f18030000 mov rcx,qword ptr [rdi+318h]
ds:000007ff`fffde318=0000000000000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x484:
00000000`77ed5844 4885c9 test rcx,rcx
0:000> p
ntdll!CsrCaptureMessageBuffer+0x487:
00000000`77ed5847 0f8563510400 jne
ntdll!LdrSetAppCompatDllRedirectionCallback+0x1d0 (00000000`77f1a9b0) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x48d:
00000000`77ed584d eb00 jmp ntdll!CsrCaptureMessageBuffer+0x48f
(00000000`77ed584f)
0:000> p
ntdll!CsrCaptureMessageBuffer+0x48f:
00000000`77ed584f c605ba160d0000 mov byte ptr
[ntdll!NlsMbOemCodePageTag+0x7f8 (00000000`77fa6f10)],0 ds:00000000`77fa6f10=01
0:000> p
ntdll!CsrCaptureMessageBuffer+0x496:
00000000`77ed5856 85db test ebx,ebx
0:000> p
ntdll!CsrCaptureMessageBuffer+0x498:
00000000`77ed5858 0f88794c0200 js ntdll!wcsrchr+0x197
(00000000`77efa4d7) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x49e:
00000000`77ed585e 833d8b1b0d0000 cmp dword ptr
[ntdll!NlsMbOemCodePageTag+0xcd8 (00000000`77fa73f0)],0
ds:00000000`77fa73f0=00000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x4a5:
00000000`77ed5865 0f8566510400 jne
ntdll!LdrSetAppCompatDllRedirectionCallback+0x1f1 (00000000`77f1a9d1) [br=0]
0:000> p
ntdll!CsrCaptureMessageBuffer+0x4ab:
00000000`77ed586b f0ff05821b0d00 lock inc dword ptr
[ntdll!NlsMbOemCodePageTag+0xcdc (00000000`77fa73f4)]
ds:00000000`77fa73f4=00000001
0:000> p
ntdll!CsrCaptureMessageBuffer+0x4b2:
00000000`77ed5872 8b5c2430 mov ebx,dword ptr [rsp+30h]
ss:00000000`0022fa00=00000000
0:000> p
ntdll!CsrCaptureMessageBuffer+0x4b6:
00000000`77ed5876 e95c4c0200 jmp ntdll!wcsrchr+0x197
(00000000`77efa4d7)
0:000> p
ntdll!wcsrchr+0x197:
00000000`77efa4d7 e8e476ffff call ntdll!NtTestAlert (00000000`77ef1bc0)
0:000> p
ntdll!wcsrchr+0x19c:
00000000`77efa4dc 85db test ebx,ebx
0:000> p
ntdll!wcsrchr+0x19e:
00000000`77efa4de 0f8877050200 js
ntdll!LdrSetAppCompatDllRedirectionCallback+0x27b (00000000`77f1aa5b) [br=0]
0:000> p
ntdll!wcsrchr+0x1a4:
00000000`77efa4e4 eb00 jmp ntdll!wcsrchr+0x1a6
(00000000`77efa4e6)
0:000> p
ntdll!wcsrchr+0x1a6:
00000000`77efa4e6 488b9c24f8000000 mov rbx,qword ptr [rsp+0F8h]
ss:00000000`0022fac8=0000000000000000
0:000> p
ntdll!wcsrchr+0x1ae:
00000000`77efa4ee 488bb424d0000000 mov rsi,qword ptr [rsp+0D0h]
ss:00000000`0022faa0=0000000000000000
0:000> p
ntdll!wcsrchr+0x1b6:
00000000`77efa4f6 488bbc24c8000000 mov rdi,qword ptr [rsp+0C8h]
ss:00000000`0022fa98=0000000000000000
0:000> p
ntdll!wcsrchr+0x1be:
00000000`77efa4fe 4c8ba424c0000000 mov r12,qword ptr [rsp+0C0h]
ss:00000000`0022fa90=0000000000000000
0:000> p
ntdll!wcsrchr+0x1c6:
00000000`77efa506 4c8bac24b8000000 mov r13,qword ptr [rsp+0B8h]
ss:00000000`0022fa88=0000000000000000
0:000> p
ntdll!wcsrchr+0x1ce:
00000000`77efa50e 4c8bb424b0000000 mov r14,qword ptr [rsp+0B0h]
ss:00000000`0022fa80=0000000000000000
0:000> p
ntdll!wcsrchr+0x1d6:
00000000`77efa516 4c8bbc24a8000000 mov r15,qword ptr [rsp+0A8h]
ss:00000000`0022fa78=0000000000000000
0:000> p
ntdll!wcsrchr+0x1de:
00000000`77efa51e 4881c4d8000000 add rsp,0D8h
0:000> p
ntdll!wcsrchr+0x1e5:
00000000`77efa525 c3 ret
0:000> p
ntdll!KiUserApcDispatcher+0x15:
00000000`77ef30a5 488bcc mov rcx,rsp
0:000> p
ntdll!KiUserApcDispatcher+0x18:
00000000`77ef30a8 b201 mov dl,1
0:000> k
Child-SP RetAddr Call Site
00000000`0022fab0 00000000`77d59620 ntdll!KiUserApcDispatcher+0x18
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
00000000`0022ffa8 00000000`00000000 kernel32!BaseProcessStart
0:000> p
ntdll!KiUserApcDispatcher+0x1a:
00000000`77ef30aa e861ddffff call ntdll!NtContinue (00000000`77ef0e10)
0:000> k
Child-SP RetAddr Call Site
00000000`0022fab0 00000000`77d59620 ntdll!KiUserApcDispatcher+0x1a
00000000`0022ffa8 00000000`00000000 kernel32!BaseProcessStart
0:000> p
c.f90: In function 'MAIN__':
c.f90:1: internal compiler error: Segmentation fault
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
gfortran: Internal error: Aborted (program f951)
Please submit a full bug report.
See for instructions.
ntdll!ZwTerminateProcess+0xa:
00000000`77ef0caa c3 ret
0:000>
_________________________________________________________________
Watch “Cause Effect,” a show about real people making a real difference.
http://im.live.com/Messenger/IM/MTV/?source=text_watchcause
