In alt.comp.microsoft.windows Maria Sophia <
mariasophia@comprehension.com> wrote:
Because the DLL had already been ripped out of RAM, that address was no longer a valid code block since it was just dead, unallocated space. The
CPU read the address, realized it was violating NX protection rules, threw the c0000005 Access Violation and collapsed the program.
...
Since this is my first crash debug attempt, I am wondering what others on this newsgroup use to debug crash logs found in %LOCALAPPDATA%\CrashDumps
I still use WinDbg classic, not WinDbgX. But for a first attempt, that
was a great analysis. I think to be "strictly correct" you'd want to
check the exception record/context record (.exr/.cxr) to see which
address was accessed, but it's 99%+ likely that it's unloaded code.
In the spirit of "IRC is for people with mutual interests", this is my
intro to WinDbg:
http://www.malsmith.net/blog/patching-closed-software/
- M
--- PyGate Linux v1.5.15
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)