Skip to content

Instantly share code, notes, and snippets.

@cpuwolf
Last active March 17, 2024 22:52
Show Gist options
  • Save cpuwolf/37cf9ad7f60ba28d56d25b8f1b2da444 to your computer and use it in GitHub Desktop.
Save cpuwolf/37cf9ad7f60ba28d56d25b8f1b2da444 to your computer and use it in GitHub Desktop.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for WwiseLibPCx64P.dll
*** WARNING: Unable to verify checksum for libcrypto-1_1-x64.dll
*** WARNING: Unable to verify checksum for CoherentUIGT.dll
*** WARNING: Unable to verify checksum for WTF.dll
*** WARNING: Unable to verify checksum for CoherentGTJS.dll
*** WARNING: Unable to verify checksum for CoherentUIGTDevelopment.DLL
*** WARNING: Unable to verify checksum for XPlatCppWindows.dll
*** WARNING: Unable to verify checksum for RenoirCore.WindowsDesktop.dll
*** WARNING: Unable to verify checksum for CoherentGTCore.dll
*** WARNING: Unable to verify checksum for pixie.dll
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 7936
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 109317
Key : Analysis.Init.CPU.mSec
Value: 1218
Key : Analysis.Init.Elapsed.mSec
Value: 12961
Key : Analysis.Memory.CommitPeak.Mb
Value: 223
Key : Timeline.OS.Boot.DeltaSec
Value: 727
Key : Timeline.Process.Start.DeltaSec
Value: 163
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
Key : WER.Process.Version
Value: 1.36.2.0
FILE_IN_CAB: FlightSimulator.exe.15672.dmp
NTGLOBALFLAG: 400
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=000002c60c09b9b0 rcx=000002c148d30000
rdx=0000000000000000 rsi=000002c60c04b990 rdi=000002c60c04b9b8
rip=00007ff7f3a75f59 rsp=000000f5f5b7ecf0 rbp=0000000000000000
r8=000002c131d711a8 r9=000002c137e36e00 r10=0000000000000000
r11=0000000000000000 r12=0000000000000028 r13=0000000000000000
r14=0000000000000004 r15=00000011000f000d
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
FlightSimulator!FlightSimGetProcessId+0xf159:
00007ff7`f3a75f59 458b44af04 mov r8d,dword ptr [r15+rbp*4+4] ds:00000011`000f0011=????????
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff7f3a75f59 (FlightSimulator!FlightSimGetProcessId+0x000000000000f159)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000011000f0011
Attempt to read from address 00000011000f0011
PROCESS_NAME: FlightSimulator.exe
READ_ADDRESS: 00000011000f0011
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000011000f0011
STACK_TEXT:
000000f5`f5b7ecf0 00007ff7`f3a759c0 : 000002c1`3583e580 000002c1`48d30000 000002c1`31d711a8 00000000`00000003 : FlightSimulator!FlightSimGetProcessId+0xf159
000000f5`f5b7edc0 00007ff7`f3a88ee8 : 000002c1`353cdd40 00007ff7`f78fdae0 000002c1`3583dd00 00000000`00000010 : FlightSimulator!FlightSimGetProcessId+0xebc0
000000f5`f5b7ee10 00007ff7`f3a9b5ac : 000002c1`4fc6a7a4 000000f5`f5b7efa0 00000000`00000424 00000000`00000002 : FlightSimulator!FlightSimGetProcessId+0x220e8
000000f5`f5b7ee90 00007ff7`f3a64939 : 000002c1`4fc6a780 00007ff7`f000003c 000000f5`00000424 000000c0`00000004 : FlightSimulator!FlightSimGetProcessId+0x347ac
000000f5`f5b7f170 00007ff7`f3a4f929 : 00000000`00000002 00000000`00000000 00000000`00000001 000002c2`a4286d50 : FlightSimulator+0x14c4939
000000f5`f5b7f300 00007ff7`f2839f2f : bf774c00`be848698 00000000`00000000 bf774c00`3e848698 bf35086e`3f3508b4 : FlightSimulator+0x14af929
000000f5`f5b7f360 00007ff7`f4382188 : 000002c1`15c2ccc0 00000000`0002002a 00000000`0002002a 00000000`00000000 : FlightSimulator+0x299f2f
000000f5`f5b7f400 00007fff`b370ef75 : 00000000`00000001 00000000`00000000 00000000`00000111 00000000`00000000 : FlightSimulator!FlightSimGetProcessId+0x91b388
000000f5`f5b7f520 00007fff`b370e9ee : 00000000`0001058a 00007ff7`f4381aa0 00000000`00000111 ffffffff`ffffffff : user32!UserCallWinProcCheckWow+0x515
000000f5`f5b7f6b0 00007fff`27f6f825 : 00000000`00000001 00000000`00000000 00000000`00000111 42860000`00000067 : user32!CallWindowProcW+0x8e
000000f5`f5b7f700 00007fff`b370ef75 : 00000000`0000001b 00000000`0002002a 00000000`0001058a 00000000`80000012 : WwiseLibPCx64P!AK::SoundEngine::SetMedia+0x306365
000000f5`f5b7f750 00007fff`b370e9ee : 00000000`0001058a 00007fff`27c546e0 00000000`00000111 00007fff`b3789cd8 : user32!UserCallWinProcCheckWow+0x515
000000f5`f5b7f8e0 00007fff`6c5f5759 : 00007fff`27c546e0 00007fff`6c5f57b0 00000000`00000001 00000000`00000001 : user32!CallWindowProcW+0x8e
000000f5`f5b7f930 00007fff`6c5f58c4 : 00000000`00000000 00000000`00000000 00000000`0001058a 00007fff`6c5ecb88 : dinput8!CallNextSubclassProc+0x95
000000f5`f5b7f9a0 00007fff`6c5f5759 : 000002c2`9bd95128 00007fff`6c5ecb50 00000000`00000002 00000000`00000000 : dinput8!DefSubclassProc+0x94
000000f5`f5b7f9f0 00007fff`6c5f5ba6 : 00000000`00000000 00000000`0002002a 00000000`00000111 00000000`00000003 : dinput8!CallNextSubclassProc+0x95
000000f5`f5b7fa60 00007fff`b370ef75 : 00000000`00000001 000000f5`f5b7fd80 00000000`0001058a 00000000`0001058a : dinput8!MasterSubclassProc+0x96
000000f5`f5b7fac0 00007fff`b370e69d : 00000000`00000000 00007fff`6c5f5b10 000000f5`f5925800 00000000`00000000 : user32!UserCallWinProcCheckWow+0x515
000000f5`f5b7fc50 00007ff7`f4388b37 : 00007fff`6c5f5b10 00000000`00000001 80000000`00000000 00000000`00000001 : user32!DispatchMessageWorker+0x49d
000000f5`f5b7fcd0 00007ff7`f4aa03c0 : 000002c1`00000000 00007fff`5176a828 000000f5`f5b7fd80 80000000`00000000 : FlightSimulator!FlightSimGetProcessId+0x921d37
000000f5`f5b7fd40 00007ff7`f4a9fcad : 00000000`00000000 00000000`00000000 000000f5`f5b7fe80 000000f5`f5b7fec0 : FlightSimulator!FlightSimGetProcessId+0x10395c0
000000f5`f5b7fd90 00007ff7`f438510c : af358769`00009fe0 000000f5`f5b7fe80 00007ff7`f437fb40 00000000`00000000 : FlightSimulator!FlightSimGetProcessId+0x1038ead
000000f5`f5b7fe00 00007ff7`f437e9dd : 000000f5`f5b7fe88 00000000`0000000a 00000000`00000000 00000000`00000001 : FlightSimulator!FlightSimGetProcessId+0x91e30c
000000f5`f5b7fe60 00007ff7`f517af32 : 00007ff7`f25a0000 00000000`00000000 00000000`00000000 01da7857`0000000a : FlightSimulator!FlightSimGetProcessId+0x917bdd
000000f5`f5b7fec0 00007fff`b4317344 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : FlightSimulator!FlightSimGetProcessId+0x1714132
000000f5`f5b7ff00 00007fff`b4aa26b1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
000000f5`f5b7ff30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
STACK_COMMAND: ~0s; .ecxr ; kb
SYMBOL_NAME: FlightSimulator+f159
MODULE_NAME: FlightSimulator
IMAGE_NAME: FlightSimulator.exe
FAILURE_BUCKET_ID: INVALID_CLASS_PTR_READ_c0000005_FlightSimulator.exe!Unknown
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 1.36.2.0
FAILURE_ID_HASH: {b4db40f3-aa25-09e3-b7e9-dd7d950434c5}
Followup: MachineOwner
---------
@cpuwolf
Copy link
Author

cpuwolf commented Mar 17, 2024

cmd.exe /C start shell:AppsFolder\Microsoft.FlightSimulator_8wekyb3d8bbwe!App -AllowDebugger

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment