Met ecxr krijg ik dit:
0:000> .ecxr
eax=003a0043 ebx=7ffd4000 ecx=00e57ae8 edx=0015fe90 esi=00000000 edi=0360d680
eip=00000000 esp=0013fff8 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
00000000 ?? ???
*** WARNING: Unable to verify checksum for KM_TPR.EXE
*** ERROR: Module load completed but symbols could not be loaded for KM_TPR.EXE
Met die analyse krijg ik dit:
***** OS symbols are WRONG. Please fix symbols to do analysis.
en daaronder een hele lijst met wat ik mis, en dan:
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: IMAGE_NT_HEADERS32 ***
en daar nog 2 andere van.
Als laatste krijg ik dit:
FAULTING_IP:
+29f952f01f3df74
43b32c66 ?? ???
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 43b32c66
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 43b32c66
Attempt to read from address 43b32c66
PROCESS_NAME: KM_TPR.EXE
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: KM_TPR
FAULTING_MODULE: 7c900000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP: 3df36d52
ERROR_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het geheugen is mislukt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het geheugen is mislukt.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 43b32c66
READ_ADDRESS: 43b32c66
FOLLOWUP_IP:
KM_TPR+9a1a3
0049a1a3 55 push ebp
FAILED_INSTRUCTION_ADDRESS:
+29f952f01f3df74
43b32c66 ?? ???
FAULTING_THREAD: 000008fc
BUGCHECK_STR: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_INVALID_POINTER_READ_WRONG_SYMBOLS
PRIMARY_PROBLEM_CLASS: BAD_INSTRUCTION_PTR
DEFAULT_BUCKET_ID: BAD_INSTRUCTION_PTR
LAST_CONTROL_TRANSFER: from 0049a1a3 to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013fff4 0049a1a3 00000000 00000000 00000000 0x0
00000000 00000000 00000000 00000000 00000000 KM_TPR+0x9a1a3
STACK_COMMAND: ~0s; .ecxr ; kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: KM_TPR+9a1a3
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: KM_TPR.EXE
BUCKET_ID: WRONG_SYMBOLS
WATSON_IBUCKET: 273534712
WATSON_IBUCKETTABLE: 1
FAILURE_BUCKET_ID: BAD_INSTRUCTION_PTR_c0000005_KM_TPR.EXE!Unknown
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOn...0_0/bbbbbbb4/c0000005/43b32c66.htm?Retriage=1
Followup: MachineOwner
---------
Als ik dit missing OB files moet posten zeg je het maar.