Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Weird looking entry at top of stack

DilipDilip Member Posts: 10
I am staring at a crash dump that is running into an access violation exception while executing a mov instruction in VCRUNTIME140!MoveSmall (which is part of memcpy.asm code.)

My question is MoveSmall doesn't even look like a *function*. Its a jump label where control can be transferred if necessary. I am unable to reconcile why it shows up on 'kv'. The previous function that supposedly transferred control there is not even meant to call anything in VCRUNTIME140.

Sorry I am unable to post anything of value here because of propreitory reasons. If the question cannot be answered as is, please feel free to let me know.

Comments

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,496
    On Oct 21, 2017, at 8:16 AM, [email protected] [email protected] wrote:
    >
    > I am staring at a crash dump that is running into an access violation exception while executing a mov instruction in VCRUNTIME140!MoveSmall (which is part of memcpy.asm code.)
    >
    > My question is MoveSmall doesn't even look like a *function*. Its a jump label where control can be transferred if necessary. I am unable to reconcile why it shows up on 'kv'. The previous function that supposedly transferred control there is not even meant to call anything in VCRUNTIME140.

    The debugger doesn't know whether something is a function or not. All has are symbols and addresses. It shows you the closest symbol to the address.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA