Hur sparkar man igång honom då?
I vilket fall, jag startade honom och noterade att den hade loggat kraschar tidigare. Så här kommer en logg.
Application exception occurred:
App: iexplore.exe (pid=452)
When: 2000-07-01 @ 14:03:17.667
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: MARCUS
User Name: Administrator
Number of Processors: 1
Processor Type: x86 Family 6 Model 7 Stepping 3
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: None
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Marcus E
*----> Task List <----*
0 Idle.exe
8 System.exe
132 smss.exe
160 csrss.exe
180 winlogon.exe
208 services.exe
220 lsass.exe
388 svchost.exe
448 svchost.exe
484 regsvc.exe
520 mstask.exe
568 inetinfo.exe
828 explorer.exe
892 internat.exe
1124 msdtc.exe
1104 msiexec.exe
1164 SPOOLSV.exe
420 MDM.exe
1408 IEXPLORE.exe
1520 Icq.exe
1744 napster.exe
452 IEXPLORE.exe
1580 IEXPLORE.exe
1384 dllhost.exe
1680 WINZIP32.exe
1084 IEXPLORE.exe
1140 IEXPLORE.exe
1312 OUTLOOK.exe
1036 agentsvr.exe
772 drwtsn32.exe
0 _Total.exe
(00400000 - 00412000)
(77F80000 - 77FF9000)
(77E80000 - 77F36000)
(77E10000 - 77E75000)
(77F40000 - 77F7C000)
(77C70000 - 77CBA000)
(77DB0000 - 77E0A000)
(77D40000 - 77DAF000)
(71500000 - 71611000)
(77B50000 - 77BDA000)
(775A0000 - 777E0000)
(77A50000 - 77B45000)
(6E420000 - 6E426000)
(75E60000 - 75E7A000)
(76E10000 - 76ED8000)
(77CC0000 - 77D40000)
(65340000 - 653D5000)
(78000000 - 78046000)
(76EE0000 - 76EEB000)
(63000000 - 63073000)
(77850000 - 7788C000)
(770C0000 - 770E3000)
(1A400000 - 1A472000)
(77820000 - 77827000)
(759B0000 - 759B6000)
(76D90000 - 76DE3000)
(75D50000 - 75DD2000)
(75050000 - 75058000)
(75030000 - 75044000)
(75020000 - 75028000)
(74FD0000 - 74FE1000)
(774E0000 - 77512000)
(774C0000 - 774D1000)
(77530000 - 77552000)
(77830000 - 7783E000)
(75AB0000 - 75AB5000)
(75010000 - 75017000)
(77C10000 - 77C6D000)
(75170000 - 751BF000)
(77BE0000 - 77BEF000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
(77950000 - 77979000)
(77980000 - 779A4000)
(77840000 - 7784C000)
(777E0000 - 777E8000)
(777F0000 - 777F5000)
(70000000 - 70242000)
(4A000000 - 4A02C000)
(4AA00000 - 4AA15000)
(75AC0000 - 75AE8000)
(75DE0000 - 75E57000)
(6B3D0000 - 6B40C000)
(75090000 - 750A0000)
(77570000 - 775A0000)
(77560000 - 77569000)
(77400000 - 77408000)
(77410000 - 77423000)
(75D40000 - 75D46000)
(75A30000 - 75A9B000)
(75230000 - 75245000)
(72200000 - 7220B000)
(64AD0000 - 64AE8000)
(76930000 - 7695B000)
(77440000 - 774B8000)
(77430000 - 77440000)
(77920000 - 77942000)
(76B30000 - 76B6E000)
(76FA0000 - 76FAF000)
(773E0000 - 773F2000)
(770F0000 - 772AD000)
(75160000 - 7516C000)
(75210000 - 75225000)
(751D0000 - 75208000)
(76710000 - 76719000)
(69000000 - 6900C000)
State Dump for Thread Id 0x664
eax=4a021088 ebx=00000002 ecx=0006dc64 edx=00000000 esi=77f87e6c edi=00000002
eip=77f87e77 esp=0006daf0 ebp=0006db3c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: ZwWaitForMultipleObjects
77f87e6c b8e9000000 mov eax,0xe9
77f87e71 8d542404 lea edx,[esp+0x4] ss:00b3b0c7=????????
77f87e75 cd2e int 2e
77f87e77 c21400 ret 0x14
77f87e7a 668b08 mov cx,[eax] ds:4a021088=0910
77f87e7d 40 inc eax
77f87e7e 40 inc eax
77f87e7f 8945a4 mov [ebp+0xa4],eax ss:00b3b112=????????
77f87e82 6685c9 test cx,cx
77f87e85 75f3 jnz RtlExpandEnvironmentStrings_U+0x26 (77f8e57a)
77f87e87 663930 cmp [eax],si ds:4a021088=0910
77f87e8a 75ee jnz ZwFsControlFile+0x54 (77f8bf7a)
77f87e8c 40 inc eax
77f87e8d 40 inc eax
77f87e8e 8945a4 mov [ebp+0xa4],eax ss:00b3b112=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0006DB3C 77E9E68A 0006DB14 00000001 00000000 00000000 ntdll!ZwWaitForMultipleObjects
00000001 00000000 00000000 00000000 00000000 00000000 kernel32!WaitForMultipleObjects
*----> Raw Stack Dump <----*
0006daf0 b2 79 e8 77 02 00 00 00 - 14 db 06 00 01 00 00 00 .y.w............
0006db00 00 00 00 00 00 00 00 00 - 02 00 00 00 28 dc 06 00 ............(...
0006db10 50 64 b6 00 a8 02 00 00 - 9c 02 00 00 ea 9e fc 77 Pd.............w
0006db20 0e 02 00 00 01 3a 5d 02 - 28 20 e4 00 e0 d4 10 00 .....:].( ......
0006db30 20 d3 fc 77 00 00 00 00 - 98 98 f8 77 01 00 00 00 ..w.......w....
0006db40 8a e6 e9 77 14 db 06 00 - 01 00 00 00 00 00 00 00 ...w............
0006db50 00 00 00 00 00 00 00 00 - b7 28 01 4a 02 00 00 00 .........(.J....
0006db60 8c db 06 00 00 00 00 00 - ff ff ff ff 2b 29 01 4a ............+).J
0006db70 02 00 00 00 8c db 06 00 - ff ff ff ff 6c 64 b6 00 ............ld..
0006db80 50 64 b6 00 00 00 00 00 - 28 61 b6 00 a8 02 00 00 Pd......(a......
0006db90 9c 02 00 00 00 00 07 00 - 01 00 00 00 82 00 00 00 ................
0006dba0 60 02 ff 00 00 00 00 00 - 00 00 e4 00 18 20 e4 00 `............ ..
0006dbb0 00 00 00 00 a8 db 06 00 - 00 00 07 00 d8 db 06 00 ................
0006dbc0 d9 80 e1 77 0c dc 06 00 - d2 54 e1 77 20 07 02 00 ...w.....T.w ...
0006dbd0 82 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0006dbe0 45 24 00 70 20 07 02 00 - 82 00 00 00 00 00 00 00 E$.p ...........
0006dbf0 00 00 00 00 00 04 ff 00 - 60 02 ff 00 d0 29 08 00 ........`....)..
0006dc00 01 00 00 00 00 00 00 00 - 00 00 00 00 7b 29 01 4a ............{).J
0006dc10 00 00 00 00 01 00 00 00 - 24 dc 06 00 ff ff ff ff ........$.......
0006dc20 50 64 b6 00 a8 02 00 00 - 84 28 01 4a 00 00 00 00 Pd.......(.J....
State Dump for Thread Id 0x4c8
eax=00000005 ebx=77f8a117 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
eip=77f8a122 esp=00ebfacc ebp=00ebfb04 iopl=0 nv up ei ng nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000286
function: ZwWaitForSingleObject
77f8a117 b8ea000000 mov eax,0xea
77f8a11c 8d542404 lea edx,[esp+0x4] ss:0198d0a3=????????
77f8a120 cd2e int 2e
77f8a122 c20c00 ret 0xc
77f8a125 56 push esi
77f8a126 8b742408 mov esi,[esp+0x8] ss:0198d0a3=????????
77f8a12a 56 push esi
77f8a12b e8fab9ffff call RtlValidSid (77f85b2a)
77f8a130 3c01 cmp al,0x1
77f8a132 0f85949a0100 jne RtlCopySidAndAttributesArray+0x8b (77fa3bcc)
77f8a138 807e0200 cmp byte ptr [esi+0x2],0x0 ds:00acd5d6=??
77f8a13c 0f85949a0100 jne RtlCopySidAndAttributesArray+0x95 (77fa3bd6)
77f8a142 807e0300 cmp byte ptr [esi+0x3],0x0 ds:00acd5d6=??
77f8a146 0f858a9a0100 jne RtlCopySidAndAttributesArray+0x95 (77fa3bd6)
77f8a14c 6a0a push 0xa
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00EBFB04 74FD2D5D 000001F4 00000208 00000001 00000004 ntdll!ZwWaitForSingleObject
00EBFBF0 75032F2F 00000001 00EBFE84 00EBFC7C 00EBFD80 msafd!WSPGetSockOpt
00EBFC54 6301A54A 00000001 00EBFE84 00EBFC7C 00EBFD80 ws2_32!select
00EBFFB0 6301A2E2 77E92CA8 0009F7C0 7FFDE000 00000040 WININET!InternetSetStatusCallbackA
00EBFFEC 00000000 00000000 00000000 00000000 00000000 WININET!InternetSetStatusCallbackA
*----> Raw Stack Dump <----*
00ebfacc ca 2e fd 74 f4 01 00 00 - 01 00 00 00 f0 fa eb 00 ...t............
00ebfadc 84 fe eb 00 78 fb eb 00 - 68 fb eb 00 30 71 b9 53 ....x...h...0q.S
00ebfaec 54 e3 bf 01 c0 b4 b3 ff - ff ff ff ff e0 37 0a 00 T............7..
00ebfafc 00 00 00 00 00 00 00 00 - f0 fb eb 00 5d 2d fd 74 ............]-.t
00ebfb0c f4 01 00 00 08 02 00 00 - 01 00 00 00 04 00 00 00 ................
00ebfb1c 80 fd eb 00 18 6c 0a 00 - 7c fc eb 00 00 00 00 00 .....l..|.......
00ebfb2c 00 00 00 00 80 0f 05 fd - ff ff ff ff db 80 fb 77 ...............w
00ebfb3c d0 98 f8 77 ff ff ff ff - e4 fb eb 00 ec 9c fc 77 ...w...........w
00ebfb4c 88 0c 07 00 20 0b 14 00 - 1c 20 06 63 20 0b 14 00 .... .... .c ...
00ebfb5c 20 0b 14 00 00 00 00 00 - 00 00 00 00 80 0f 05 fd ...............
00ebfb6c ff ff ff ff 01 00 00 00 - 00 00 00 00 08 02 00 00 ................
00ebfb7c 19 00 00 00 00 00 07 00 - 07 00 00 00 00 00 07 00 ................
00ebfb8c 03 00 00 00 00 ae f8 77 - 01 ff ff ff 00 00 07 00 .......w........
00ebfb9c 01 00 00 00 00 ff eb 00 - 2c fb eb 00 30 0b 14 00 ........,...0...
00ebfbac e0 37 0a 00 00 00 07 00 - 00 00 00 00 68 fb eb 00 .7..........h...
00ebfbbc 2c 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ,...............
00ebfbcc 00 00 00 00 10 00 00 00 - 84 fb eb 00 1c fb eb 00 ................
00ebfbdc 24 fc eb 00 44 fc eb 00 - ad c8 fd 74 f8 2f fd 74 $...D......t./.t
00ebfbec ff ff ff ff 54 fc eb 00 - 2f 2f 03 75 01 00 00 00 ....T...//.u....
00ebfbfc 84 fe eb 00 7c fc eb 00 - 80 fd eb 00 90 ff eb 00 ....|...........
State Dump for Thread Id 0x5a8
eax=00000003 ebx=00000004 ecx=00000101 edx=00000000 esi=77f87e6c edi=00000004
eip=77f87e77 esp=00f3fd24 ebp=00f3fd70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: ZwWaitForMultipleObjects
77f87e6c b8e9000000 mov eax,0xe9
77f87e71 8d542404 lea edx,[esp+0x4] ss:01a0d2fb=????????
77f87e75 cd2e int 2e
77f87e77 c21400 ret 0x14
77f87e7a 668b08 mov cx,[eax] ds:00000003=????
77f87e7d 40 inc eax
77f87e7e 40 inc eax
77f87e7f 8945a4 mov [ebp+0xa4],eax ss:01a0d346=????????
77f87e82 6685c9 test cx,cx
77f87e85 75f3 jnz RtlExpandEnvironmentStrings_U+0x26 (77f8e57a)
77f87e87 663930 cmp [eax],si ds:00000003=????
77f87e8a 75ee jnz ZwFsControlFile+0x54 (77f8bf7a)
77f87e8c 40 inc eax
77f87e8d 40 inc eax
77f87e8e 8945a4 mov [ebp+0xa4],eax ss:01a0d346=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00F3FD70 77E9E68A 00F3FD48 00000001 00000000 00000000 ntdll!ZwWaitForMultipleObjects
00F3FFB4 77E92CA8 00000005 000A3314 7FFDB000 00091410 kernel32!WaitForMultipleObjects
00F3FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x5f4
eax=00000000 ebx=00b6d9d4 ecx=00b69358 edx=00b6d9d4 esi=00b6a630 edi=00b6d9c4
eip=4a01259d esp=0142fe60 ebp=00000000 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: <nosymbols>
4a01258a 7416 jz 4a01b0a2
4a01258c 8b10 mov edx,[eax] ds:00000000=????????
4a01258e 50 push eax
4a01258f ff5204 call dword ptr [edx+0x4] ds:0163afaa=????????
4a012592 8b06 mov eax,[esi] ds:00b6a630=00000000
4a012594 50 push eax
4a012595 8b08 mov ecx,[eax] ds:00000000=????????
4a012597 ff5110 call dword ptr [ecx+0x10] ds:0163692e=????????
4a01259a 8b06 mov eax,[esi] ds:00b6a630=00000000
4a01259c 50 push eax
FAULT ->4a01259d 8b10 mov edx,[eax] ds:00000000=????????
4a01259f ff5208 call dword ptr [edx+0x8] ds:0163afaa=????????
4a0125a2 83c604 add esi,0x4
4a0125a5 ebc9 jmp 4a017970
4a0125a7 53 push ebx
4a0125a8 ff15f400024a call dword ptr [4a0200f4] ds:4a0200f4=77f8aa7d
4a0125ae 5f pop edi
4a0125af 5e pop esi
4a0125b0 33c0 xor eax,eax
4a0125b2 5b pop ebx
4a0125b3 c20400 ret 0x4
4a0125b6 90 nop
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0142FE6C 4A01275A 00B6D9B4 00B6ECD8 00000000 4A012FED pdm!<nosymbols> (FPO: [1,0,3])
0142FE7C 4A012FED 00B6D9B8 4A012B06 014ADE98 00000000 pdm!<nosymbols> (FPO: [1,0,2])
0142FE84 4A012B06 014ADE98 00000000 00000000 00000000 pdm!<nosymbols> (FPO: [4,0,0])
0142FE9C 4A0129DB 00000002 00000001 77E146FB 00000001 pdm!<nosymbols> (FPO: [0,0,1])
0142FEB4 4A00887B 00000000 00000000 00B66128 00000001 pdm!<nosymbols> (FPO: [EBP 0x00000002] [1,1,4])
State Dump for Thread Id 0x69c
eax=77562bdf ebx=00000002 ecx=00000000 edx=00000000 esi=77f87e6c edi=00000002
eip=77f87e77 esp=01d0ff24 ebp=01d0ff70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: ZwWaitForMultipleObjects
77f87e6c b8e9000000 mov eax,0xe9
77f87e71 8d542404 lea edx,[esp+0x4] ss:027dd4fb=????????
77f87e75 cd2e int 2e
77f87e77 c21400 ret 0x14
77f87e7a 668b08 mov cx,[eax] ds:77562bdf=8b55
77f87e7d 40 inc eax
77f87e7e 40 inc eax
77f87e7f 8945a4 mov [ebp+0xa4],eax ss:027dd546=????????
77f87e82 6685c9 test cx,cx
77f87e85 75f3 jnz RtlExpandEnvironmentStrings_U+0x26 (77f8e57a)
77f87e87 663930 cmp [eax],si ds:77562bdf=8b55
77f87e8a 75ee jnz ZwFsControlFile+0x54 (77f8bf7a)
77f87e8c 40 inc eax
77f87e8d 40 inc eax
77f87e8e 8945a4 mov [ebp+0xa4],eax ss:027dd546=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01D0FF70 77E9E68A 01D0FF48 00000001 00000000 00000000 ntdll!ZwWaitForMultipleObjects
01D0FFB4 77E92CA8 00000000 7FFDEBF8 00000000 00000000 kernel32!WaitForMultipleObjects
01D0FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x64c
eax=77570258 ebx=000003e8 ecx=00000074 edx=00000000 esi=01d4ff98 edi=77e193fe
eip=77e1414f esp=01d4ff58 ebp=01d4ff78 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: DispatchMessageW
77e14137 90 nop
77e14138 ffff ???
77e1413a ffff ???
77e1413c 7407 jz DrawFrame+0xae4 (77e22545)
77e1413e e477 in al,77
77e14140 8707 xchg [edi],eax ds:77e193fe=8bec8b55
77e14142 e477 in al,77
77e14144 b89a110000 mov eax,0x119a
77e14149 8d542404 lea edx,[esp+0x4] ss:0281d52f=????????
77e1414d cd2e int 2e
77e1414f c21000 ret 0x10
77e14152 55 push ebp
77e14153 8bec mov ebp,esp
77e14155 53 push ebx
77e14156 56 push esi
77e14157 8b7508 mov esi,[ebp+0x8] ss:0281d54e=????????
77e1415a 8b450c mov eax,[ebp+0xc] ss:0281d54e=????????
77e1415d 57 push edi
77e1415e 33ff xor edi,edi
77e14160 0fb74e2a movzx ecx,word ptr [esi+0x2a] ds:0281d56f=????
77e14164 81e1ff3fffff and ecx,0xffff3fff
77e1416a 7521 jnz UnregisterClassA+0x13f (77e1c68d)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01D4FF78 77575C36 01D4FF98 00000000 00000000 00000000 user32!DispatchMessageW
01D4FFB4 77E92CA8 000003E8 77595428 0006A69C 000003E8 winmm!midiOutGetNumDevs
01D4FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x388
eax=02651a68 ebx=00040002 ecx=02651a68 edx=00000000 esi=0007e2f8 edi=00000100
eip=77f82eec esp=04b4fe28 ebp=04b4ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f82ee1 b8ac000000 mov eax,0xac
77f82ee6 8d542404 lea edx,[esp+0x4] ss:0561d3ff=????????
77f82eea cd2e int 2e
77f82eec c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
04B4FF74 77D4B407 77D4B7BF 0007E2F8 00000000 00000000 ntdll!ZwReplyWaitReceivePortEx
04B4FFA8 77D4B771 000A9E18 04B4FFEC 77E92CA8 0008B6A0 rpcrt4!RpcBindingSetOption
04B4FFB4 77E92CA8 0008B6A0 00000000 00000000 0008B6A0 rpcrt4!RpcBindingSetOption
04B4FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x5d0
eax=00000000 ebx=00040002 ecx=0007a248 edx=00000000 esi=0007e2f8 edi=00000100
eip=77f82eec esp=04b8fe28 ebp=04b8ff74 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: ZwReplyWaitReceivePortEx
77f82ee1 b8ac000000 mov eax,0xac
77f82ee6 8d542404 lea edx,[esp+0x4] ss:0565d3ff=????????
77f82eea cd2e int 2e
77f82eec c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
04B8FF74 77D4B407 77D4B7BF 0007E2F8 00000000 00000000 ntdll!ZwReplyWaitReceivePortEx
04B8FFA8 77D4B771 025D0EB8 04B8FFEC 77E92CA8 000FAB80 rpcrt4!RpcBindingSetOption
04B8FFB4 77E92CA8 000FAB80 00000000 00000000 000FAB80 rpcrt4!RpcBindingSetOption
04B8FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x650
eax=00000000 ebx=04d3ff74 ecx=0264a710 edx=00000000 esi=77f8a117 edi=00000718
eip=77f8a122 esp=04d3ff58 ebp=04d3ff7c iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000293
function: ZwWaitForSingleObject
77f8a117 b8ea000000 mov eax,0xea
77f8a11c 8d542404 lea edx,[esp+0x4] ss:0580d52f=????????
77f8a120 cd2e int 2e
77f8a122 c20c00 ret 0xc
77f8a125 56 push esi
77f8a126 8b742408 mov esi,[esp+0x8] ss:0580d52f=????????
77f8a12a 56 push esi
77f8a12b e8fab9ffff call RtlValidSid (77f85b2a)
77f8a130 3c01 cmp al,0x1
77f8a132 0f85949a0100 jne RtlCopySidAndAttributesArray+0x8b (77fa3bcc)
77f8a138 807e0200 cmp byte ptr [esi+0x2],0x0 ds:78a576ed=??
77f8a13c 0f85949a0100 jne RtlCopySidAndAttributesArray+0x95 (77fa3bd6)
77f8a142 807e0300 cmp byte ptr [esi+0x3],0x0 ds:78a576ed=??
77f8a146 0f858a9a0100 jne RtlCopySidAndAttributesArray+0x95 (77fa3bd6)
77f8a14c 6a0a push 0xa
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
04D3FF7C 77E88787 00000718 000927C0 00000000 700E8863 ntdll!ZwWaitForSingleObject
77F8AA7D 4AFFC033 B3850F08 89FFFFA9 FF900C42 8D0F044A kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000 <nosymbols>
State Dump for Thread Id 0x4ac
eax=00000001 ebx=00000002 ecx=00000002 edx=00000000 esi=77f87e6c edi=00000002
eip=77f87e77 esp=04d7fe5c ebp=04d7fea8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
function: ZwWaitForMultipleObjects
77f87e6c b8e9000000 mov eax,0xe9
77f87e71 8d542404 lea edx,[esp+0x4] ss:0584d433=????????
77f87e75 cd2e int 2e
77f87e77 c21400 ret 0x14
77f87e7a 668b08 mov cx,[eax] ds:00000001=????
77f87e7d 40 inc eax
77f87e7e 40 inc eax
77f87e7f 8945a4 mov [ebp+0xa4],eax ss:0584d47e=????????
77f87e82 6685c9 test cx,cx
77f87e85 75f3 jnz RtlExpandEnvironmentStrings_U+0x26 (77f8e57a)
77f87e87 663930 cmp [eax],si ds:00000001=????
77f87e8a 75ee jnz ZwFsControlFile+0x54 (77f8bf7a)
77f87e8c 40 inc eax
77f87e8d 40 inc eax
77f87e8e 8945a4 mov [ebp+0xa4],eax ss:0584d47e=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
04D7FEA8 77E1464C 04D7FE80 00000001 00000000 04D7FEA0 ntdll!ZwWaitForMultipleObjects
04D7FF04 77E14718 04D7FED0 77CB4170 0000EA60 00000041 user32!MsgWaitForMultipleObjectsEx
04D7FF20 77C71991 00000001 77CB4170 00000000 0000EA60 user32!MsgWaitForMultipleObjects
04D7FF74 77C75E56 04D7FFA0 04D7FFA4 04D7FFA8 04D7FF9C shlwapi!Ordinal195
04D7FFAC 77C75DBC 00EBFA10 77E92CA8 00000000 00000200 shlwapi!AssocQueryKeyW
04D7FFEC 00000000 00000000 00000000 00000000 00000000 shlwapi!AssocQueryKeyW
State Dump for Thread Id 0x4d0
eax=77a84075 ebx=00000102 ecx=00000000 edx=00000000 esi=77f90328 edi=04f1ff74
eip=77f90333 esp=04f1ff60 ebp=04f1ff7c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: ZwDelayExecution
77f90328 b832000000 mov eax,0x32
77f9032d 8d542404 lea edx,[esp+0x4] ss:059ed537=????????
77f90331 cd2e int 2e
77f90333 c20800 ret 0x8
77f90336 33c0 xor eax,eax
77f90338 e99ac6ffff jmp RtlCopySid+0x64 (77f8c9d7)
77f9033d 23d1 and edx,ecx
77f9033f 8a06 mov al,[esi] ds:77f90328=b8
77f90341 8807 mov [edi],al ds:04f1ff74=00
77f90343 8a4601 mov al,[esi+0x1] ds:78a5d8fe=??
77f90346 884701 mov [edi+0x1],al ds:059ed54a=??
77f90349 8a4602 mov al,[esi+0x2] ds:78a5d8fe=??
77f9034c c1e902 shr ecx,0x2
77f9034f 884702 mov [edi+0x2],al ds:059ed54a=??
77f90352 83c603 add esi,0x3
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
04F1FF7C 77E84B7F 0000EA60 00000000 77A80A62 0000EA60 ntdll!ZwDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep
------------------
- Swey
Bäst, vackrast, styggast...