forked from killbug2004/CodeMachineCourse
-
Notifications
You must be signed in to change notification settings - Fork 3
/
windbg.day2.log
2728 lines (2623 loc) · 128 KB
/
windbg.day2.log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Opened log file 'c:\course\windbg.day2.log'
Opened log file 'c:\course\windbg.day2.log'
1: kd> .load pykd
Opened log file 'c:\course\windbg.day2.log'
0: kd> bp nt!NtCreateFile
0: kd> bl
0 e fffff803`2cc2d3b0 0001 (0001) nt!NtCreateFile
0: kd> g
Breakpoint 0 hit
nt!NtCreateFile:
fffff803`2cc2d3b0 4881ec88000000 sub rsp,88h
0: kd> .reload
Connected to Windows 10 10586 x64 target at (Tue May 3 09:17:02.694 2016 (UTC + 10:00)), ptr64 TRUE
Loading Kernel Symbols
..................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................
................................................................
......................
Loading User Symbols
.........................................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.......
...............................
Loading unloaded module list
..........
0: kd> k
# Child-SP RetAddr Call Site
00 ffffd000`227a4a88 fffff803`2c9677a3 nt!NtCreateFile
01 ffffd000`227a4a90 00007ffb`6ffb57f4 nt!KiSystemServiceCopyEnd+0x13
02 00000052`44c7ec08 00007ffb`6cc14aa2 ntdll!NtCreateFile+0x14
03 00000052`44c7ec10 00007ffb`6cc140b1 cfgmgr32!CMP_Register_Notification+0x362
04 00000052`44c7f100 00007ffb`67962e53 cfgmgr32!CM_Register_Notification+0x11
05 00000052`44c7f140 00007ffb`692ae85c vmbuspipe!VmbusPipeClientReadyForChannelNotification+0xa3
06 00000052`44c7f320 00007ffb`6ffa4dfa rdpcorets!CUMRDPListenerVMBus::ControlIoCompletion+0x40c
07 00000052`44c7f420 00007ffb`6ff3ba2b ntdll!RtlpTpIoCallback+0xaa
08 00000052`44c7f460 00007ffb`6d328102 ntdll!TppWorkerThread+0x9db
09 00000052`44c7f870 00007ffb`6ff6c264 KERNEL32!BaseThreadInitThunk+0x22
0a 00000052`44c7f8a0 00000000`00000000 ntdll!RtlUserThreadStart+0x34
0: kd> bd *
0: kd> g
shell\ext\inputswitch\switch\ctfhandler.cpp(1976)\InputSwitch.dll!00007FFB6A4A2993: (caller: 00007FFB6FB8D533) LogHr(1) tid(bc4) 80004005 Unspecified error
CallContext:[\Startup]
internal\Base\inc\DeviceTicket.hpp(175)\diagtrack.dll!00007FFB62FCA323: (caller: 00007FFB62F299C5) ReturnHr[PreRelease](90) tid(844) 800704CF The network location cannot be reached. For information about network troubleshooting, see Windows Help.
Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPointWithStatus:
0033:00007ffb`6ffb8500 cc int 3
1: kd> be *
1: kd> g
base\diagnosis\diagtrack\matchengine\asimovuploader.cpp(1533)\diagtrack.dll!00007FFB62FBE0C5: (caller: 00007FFB62F9E051) ReturnHr[PreRelease](91) tid(844) 80070510 The requested file operation failed because the storage policy blocks that type of file. For more information, contact your system administrator.
Breakpoint 0 hit
nt!NtCreateFile:
fffff803`2cc2d3b0 4881ec88000000 sub rsp,88h
0: kd> .reload
Connected to Windows 10 10586 x64 target at (Tue May 3 09:19:41.669 2016 (UTC + 10:00)), ptr64 TRUE
Loading Kernel Symbols
............................................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
...
................................................................
......................
Loading User Symbols
..........................................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
...
Loading unloaded module list
....................
0: kd> k
# Child-SP RetAddr Call Site
00 ffffd000`243e5a88 fffff803`2c9677a3 nt!NtCreateFile
01 ffffd000`243e5a90 00007ffb`6ffb57f4 nt!KiSystemServiceCopyEnd+0x13
02 00000093`3f3fe638 00007ffb`690f58e7 ntdll!NtCreateFile+0x14
03 00000093`3f3fe640 00007ffb`690f2a75 IPHLPAPI!AllocateAndGetAdaptersAddresses+0xda7
04 00000093`3f3fecc0 00007ffb`68fd58c1 IPHLPAPI!GetAdaptersAddresses+0x55
05 00000093`3f3fed30 00007ffb`68fd5759 WINHTTP!WxGetAdaptersAddresses+0x89
06 00000093`3f3feda0 00007ffb`68fd59ca WINHTTP!GetActiveConnectionName+0x59
07 00000093`3f3fee20 00007ffb`62fa0d4a WINHTTP!WinHttpGetIEProxyConfigForCurrentUser+0xaa
08 00000093`3f3fef10 00007ffb`62f2c888 diagtrack!CHttpRequest::DiscoverProxyInfoForUrl+0xba
09 00000093`3f3fefe0 00007ffb`62f2b7b1 diagtrack!CHttpRequest::GetProxyInfoForUrl+0xec
0a 00000093`3f3ff050 00007ffb`62f2b361 diagtrack!CHttpRequest::CreateConnectionAndSendRequest+0x3b1
0b 00000093`3f3ff230 00007ffb`62f2ac63 diagtrack!CHttpRequest::UploadAndFetchResource+0x95
0c 00000093`3f3ff2a0 00007ffb`62f29b50 diagtrack!Microsoft::Diagnostics::CAsimovHttpClient::UploadEventBuffer+0x273
0d 00000093`3f3ff480 00007ffb`62f291a5 diagtrack!Microsoft::Diagnostics::CAsimovUploader::UploadBufferAndCalculateWaitTime+0x42c
0e 00000093`3f3ff6b0 00007ffb`62fa6ba2 diagtrack!Microsoft::Diagnostics::CAsimovUploader::UploaderThreadProc+0x2d1
0f 00000093`3f3ff9a0 00007ffb`6d328102 diagtrack!Microsoft::Diagnostics::CAsimovUploader::StaticUploaderThreadProc+0x12
10 00000093`3f3ff9e0 00007ffb`6ff6c264 KERNEL32!BaseThreadInitThunk+0x22
11 00000093`3f3ffa10 00000000`00000000 ntdll!RtlUserThreadStart+0x34
0: kd> r
rax=0000000000000000 rbx=ffffe0006f163080 rcx=000000933f3fe6e0
rdx=0000000000100001 rsi=000000933f3fe658 rdi=ffffd000243e5aa8
rip=fffff8032cc2d3b0 rsp=ffffd000243e5a88 rbp=ffffd000243e5b80
r8=000000933f3fe798 r9=000000933f3fe778 r10=fffff8032cc2d3b0
r11=fffff8032c967758 r12=0000000000000008 r13=0000027d9f438300
r14=0000000000000e46 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!NtCreateFile:
fffff803`2cc2d3b0 4881ec88000000 sub rsp,88h
0: kd> dg 10
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- ----------------- ----------------- ---------- - -- -- -- -- --------
0010 00000000`00000000 00000000`00000000 Code RE Ac 0 Nb By P Lo 0000029b
0: kd> dg 0x10
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- ----------------- ----------------- ---------- - -- -- -- -- --------
0010 00000000`00000000 00000000`00000000 Code RE Ac 0 Nb By P Lo 0000029b
0: kd> dt nt!*GTD*ENTRY*
0: kd> dt nt!*GDT*
ntkrnlmp!_KGDTENTRY64
0: kd> dt nt!*GDT*ENTRY*
ntkrnlmp!_KGDTENTRY64
0: kd> dt ntkrnlmp!_KGDTENTRY64
+0x000 LimitLow : Uint2B
+0x002 BaseLow : Uint2B
+0x004 Bytes : <unnamed-tag>
+0x004 Bits : <unnamed-tag>
+0x008 BaseUpper : Uint4B
+0x00c MustBeZero : Uint4B
+0x000 DataLow : Int8B
+0x008 DataHigh : Int8B
0: kd> dt ntkrnlmp!_KGDTENTRY64 Bits
+0x004 Bits : <unnamed-tag>
0: kd> dt ntkrnlmp!_KGDTENTRY64 Bits.
+0x004 Bits :
+0x000 BaseMiddle : Pos 0, 8 Bits
+0x000 Type : Pos 8, 5 Bits
+0x000 Dpl : Pos 13, 2 Bits
+0x000 Present : Pos 15, 1 Bit
+0x000 LimitHigh : Pos 16, 4 Bits
+0x000 System : Pos 20, 1 Bit
+0x000 LongMode : Pos 21, 1 Bit
+0x000 DefaultBig : Pos 22, 1 Bit
+0x000 Granularity : Pos 23, 1 Bit
+0x000 BaseHigh : Pos 24, 8 Bits
0: kd> bl
0 e fffff803`2cc2d3b0 0001 (0001) nt!NtCreateFile
0: kd> k
# Child-SP RetAddr Call Site
00 ffffd000`243e5a88 fffff803`2c9677a3 nt!NtCreateFile
01 ffffd000`243e5a90 00007ffb`6ffb57f4 nt!KiSystemServiceCopyEnd+0x13
02 00000093`3f3fe638 00007ffb`690f58e7 ntdll!NtCreateFile+0x14
03 00000093`3f3fe640 00007ffb`690f2a75 IPHLPAPI!AllocateAndGetAdaptersAddresses+0xda7
04 00000093`3f3fecc0 00007ffb`68fd58c1 IPHLPAPI!GetAdaptersAddresses+0x55
05 00000093`3f3fed30 00007ffb`68fd5759 WINHTTP!WxGetAdaptersAddresses+0x89
06 00000093`3f3feda0 00007ffb`68fd59ca WINHTTP!GetActiveConnectionName+0x59
07 00000093`3f3fee20 00007ffb`62fa0d4a WINHTTP!WinHttpGetIEProxyConfigForCurrentUser+0xaa
08 00000093`3f3fef10 00007ffb`62f2c888 diagtrack!CHttpRequest::DiscoverProxyInfoForUrl+0xba
09 00000093`3f3fefe0 00007ffb`62f2b7b1 diagtrack!CHttpRequest::GetProxyInfoForUrl+0xec
0a 00000093`3f3ff050 00007ffb`62f2b361 diagtrack!CHttpRequest::CreateConnectionAndSendRequest+0x3b1
0b 00000093`3f3ff230 00007ffb`62f2ac63 diagtrack!CHttpRequest::UploadAndFetchResource+0x95
0c 00000093`3f3ff2a0 00007ffb`62f29b50 diagtrack!Microsoft::Diagnostics::CAsimovHttpClient::UploadEventBuffer+0x273
0d 00000093`3f3ff480 00007ffb`62f291a5 diagtrack!Microsoft::Diagnostics::CAsimovUploader::UploadBufferAndCalculateWaitTime+0x42c
0e 00000093`3f3ff6b0 00007ffb`62fa6ba2 diagtrack!Microsoft::Diagnostics::CAsimovUploader::UploaderThreadProc+0x2d1
0f 00000093`3f3ff9a0 00007ffb`6d328102 diagtrack!Microsoft::Diagnostics::CAsimovUploader::StaticUploaderThreadProc+0x12
10 00000093`3f3ff9e0 00007ffb`6ff6c264 KERNEL32!BaseThreadInitThunk+0x22
11 00000093`3f3ffa10 00000000`00000000 ntdll!RtlUserThreadStart+0x34
0: kd> bp ntdll!NtCreateFile
0: kd> g
Breakpoint 1 hit
ntdll!NtCreateFile:
0033:00007ffb`6ffb57e0 4c8bd1 mov r10,rcx
0: kd> r
rax=0000005244c7ec88 rbx=0000005244c7f2e0 rcx=0000020abd8fe440
rdx=0000000080000000 rsi=0000000000000000 rdi=0000020abd8fe250
rip=00007ffb6ffb57e0 rsp=0000005244c7ec08 rbp=0000005244c7f3b9
r8=0000005244c7ecb8 r9=0000005244c7eca8 r10=0000000000000000
r11=00007ffb6ffbb657 r12=00007ffb67962c30 r13=0000020ac1715be0
r14=0000020ac1715be8 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
ntdll!NtCreateFile:
0033:00007ffb`6ffb57e0 4c8bd1 mov r10,rcx
0: kd> dg 33
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- ----------------- ----------------- ---------- - -- -- -- -- --------
0033 00000000`00000000 00000000`00000000 Code RE Ac 3 Nb By P Lo 000002fb
0: kd> !pte fffff8032cc2d3b0
VA fffff8032cc2d3b0
PXE at FFFFF6FB7DBEDF80 PPE at FFFFF6FB7DBF0060 PDE at FFFFF6FB7E00CB30 PTE at FFFFF6FC01966168
contains 0000000000804063 contains 0000000000805063 contains 0000000000810063 contains 000000000282D121
pfn 804 ---DA--KWEV pfn 805 ---DA--KWEV pfn 810 ---DA--KWEV pfn 282d -G--A--KREV
0: kd> !pte 00007ffb6ffb57e0
VA 00007ffb6ffb57e0
PXE at FFFFF6FB7DBED7F8 PPE at FFFFF6FB7DAFFF68 PDE at FFFFF6FB5FFEDBF8 PTE at FFFFF6BFFDB7FDA8
contains 10E0000024591867 contains 0220000024526867 contains 087000002402E867 contains 6CA00000387E4025
pfn 24591 ---DA--UWEV pfn 24526 ---DA--UWEV pfn 2402e ---DA--UWEV pfn 387e4 ----A--UREV
0: kd> .load pykd
Opened log file 'c:\course\windbg.day2.log'
0: kd> .load pykd
Opened log file 'c:\course\windbg.day2.log'
0: kd> x nt!IO*complet*
fffff803`28a5c068 nt!IopFreeCompletionListPackets (<no parameter info>)
fffff803`28a97c98 nt!IopUserCompletion (<no parameter info>)
fffff803`286c3718 nt!IopDeleteIoCompletionInternal (<no parameter info>)
fffff803`28903d11 nt!IopInitSystemCompletedEnoughForReInitRoutines = <no type information>
fffff803`2865ea80 nt!IopfCompleteRequest (<no parameter info>)
fffff803`28921040 nt!IopCompletionLookasideList = <no type information>
fffff803`28988380 nt!IoCompletionObjectType = <no type information>
fffff803`286bcd90 nt!IoSetIoCompletionEx2 (<no parameter info>)
fffff803`2890960c nt!IopIrpCompletionTimeoutInSeconds = <no type information>
fffff803`2865ea70 nt!IoCompleteRequest (<no parameter info>)
fffff803`28a4c9a0 nt!IopAllocateMiniCompletionPacket (<no parameter info>)
fffff803`289fc660 nt!IopFreeMiniCompletionPacket (<no parameter info>)
fffff803`286e7df8 nt!IoSetCompletionRoutineEx (<no parameter info>)
fffff803`28909608 nt!IopBootDriverReinitCompleted = <no type information>
fffff803`286e8c3c nt!IopUnloadSafeCompletion (<no parameter info>)
fffff803`286f1078 nt!IopCompleteUnloadOrDelete (<no parameter info>)
fffff803`28a4c8c4 nt!IoAllocateMiniCompletionPacket (<no parameter info>)
fffff803`287c1d38 nt!IopPerfCompleteRequest (<no parameter info>)
fffff803`28cbd5bc nt!IovpLocalCompletionRoutine (<no parameter info>)
fffff803`28a5c048 nt!IopCloseIoCompletion (<no parameter info>)
fffff803`28c0b51c nt!IopDeviceRemovalForResetComplete (<no parameter info>)
fffff803`28d91200 nt!IopCompletionMapping = <no type information>
fffff803`286bc670 nt!IopCancelWaitCompletionPacket (<no parameter info>)
fffff803`28d032dc nt!IopUseCompletionOptimization = <no type information>
fffff803`286c3bc8 nt!IopFreeWaitCompletionPacket (<no parameter info>)
fffff803`28cc7544 nt!IovpCompleteRequest4 (<no parameter info>)
fffff803`28901600 nt!IopMountCompletionEvent = <no type information>
fffff803`28988570 nt!IopWaitCompletionPacketObjectType = <no type information>
fffff803`287c7090 nt!IopDeviceEjectComplete (<no parameter info>)
fffff803`287c0e74 nt!IopReplaceCompletionPort (<no parameter info>)
fffff803`287c1f64 nt!IopPerfCompletionRoutine (<no parameter info>)
fffff803`28a6a50c nt!IoWMICompleteRequest (<no parameter info>)
fffff803`286ecc88 nt!IopCompletePageWrite (<no parameter info>)
fffff803`286c3e1c nt!IoSetIoCompletionEx (<no parameter info>)
fffff803`289bb804 nt!IoInitializeMiniCompletionPacket (<no parameter info>)
fffff803`28cc7150 nt!IovpCompleteRequest2 (<no parameter info>)
fffff803`28cc77c8 nt!IovpInternalCompletionTrap (<no parameter info>)
fffff803`2867d5ac nt!IopCloseWaitCompletionPacket (<no parameter info>)
fffff803`2865fb60 nt!IopCompleteRequest (<no parameter info>)
fffff803`28d91210 nt!IopWaitCompletionMapping = <no type information>
fffff803`28cc74bc nt!IovpCompleteRequest3 (<no parameter info>)
fffff803`2899b900 nt!IopCompletionLock = <no type information>
fffff803`28cbcf3c nt!IovCompleteRequest (<no parameter info>)
fffff803`28aacef4 nt!IoFreeMiniCompletionPacket (<no parameter info>)
fffff803`286effdc nt!IopPnPCompleteRequest (<no parameter info>)
fffff803`2865cb10 nt!IoRemoveIoCompletion (<no parameter info>)
fffff803`28af7674 nt!IoSetIoCompletion (<no parameter info>)
fffff803`28a5c040 nt!IopDeleteIoCompletion (<no parameter info>)
fffff803`28cc7028 nt!IovpCompleteRequest1 (<no parameter info>)
fffff803`2865ea70 nt!IofCompleteRequest (<no parameter info>)
fffff803`28920dc0 nt!IopSafeCompletionLookasideList = <no type information>
fffff803`2892278c nt!IopMountCompletionWaiters = <no type information>
0: kd> !dh null
File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
8664 machine (X64)
9 number of sections
5632D166 time date stamp Fri Oct 30 13:09:42 2015
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
22 characteristics
Executable
App can handle >2gb addresses
OPTIONAL HEADER VALUES
20B magic #
12.10 linker version
600 size of code
1200 size of initialized data
0 size of uninitialized data
6000 address of entry point
1000 base of code
----- new -----
fffff801db360000 image base
1000 section alignment
200 file alignment
1 subsystem (Native)
10.00 operating system version
10.00 image version
10.00 subsystem version
A000 size of image
400 size of headers
2DC5 checksum
0000000000040000 size of stack reserve
0000000000001000 size of stack commit
0000000000100000 size of heap reserve
0000000000001000 size of heap commit
4160 DLL characteristics
High entropy VA supported
Dynamic base
NX compatible
Guard
0 [ 0] address [size] of Export Directory
5040 [ 28] address [size] of Import Directory
8000 [ 3E8] address [size] of Resource Directory
4000 [ 78] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
9000 [ 1C] address [size] of Base Relocation Directory
2000 [ 38] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
2060 [ A0] address [size] of Load Configuration Directory
0 [ 0] address [size] of Bound Import Directory
5000 [ 30] address [size] of Import Address Table Directory
0 [ 0] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
SECTION HEADER #1
.text name
2B7 virtual size
1000 virtual address
400 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
68000020 flags
Code
Not Paged
(no align specified)
Execute Read
SECTION HEADER #2
.rdata name
3B4 virtual size
2000 virtual address
400 size of raw data
800 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
48000040 flags
Initialized Data
Not Paged
(no align specified)
Read Only
Debug Directories(2)
Type Size Address Pointer
cv 21 2100 900 Format: RSDS, guid, 1, null.pdb
( 13) 1f8 2138 938
SECTION HEADER #3
.data name
10 virtual size
3000 virtual address
200 size of raw data
C00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C8000040 flags
Initialized Data
Not Paged
(no align specified)
Read Write
SECTION HEADER #4
.pdata name
78 virtual size
4000 virtual address
200 size of raw data
E00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
48000040 flags
Initialized Data
Not Paged
(no align specified)
Read Only
SECTION HEADER #5
.idata name
10E virtual size
5000 virtual address
200 size of raw data
1000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
48000040 flags
Initialized Data
Not Paged
(no align specified)
Read Only
SECTION HEADER #6
INIT name
14A virtual size
6000 virtual address
200 size of raw data
1200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
62000020 flags
Code
Discardable
(no align specified)
Execute Read
SECTION HEADER #7
GFIDS name
20 virtual size
7000 virtual address
200 size of raw data
1400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
SECTION HEADER #8
.rsrc name
3E8 virtual size
8000 virtual address
400 size of raw data
1600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
SECTION HEADER #9
.reloc name
1C virtual size
9000 virtual address
200 size of raw data
1A00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
0: kd> x /a null!*
fffff801`db3610a0 Null!_security_check_cookie ()
fffff801`db3610c0 Null!guard_check_icall_nop ()
fffff801`db3610e0 Null!guard_dispatch_icall_nop ()
fffff801`db361100 Null!memset ()
fffff801`db361280 Null!NlsUnload ()
fffff801`db3612b0 Null!_report_gsfailure ()
fffff801`db362060 Null!load_config_used = <no type information>
fffff801`db363000 Null!_security_cookie_complement = <no type information>
fffff801`db363008 Null!_security_cookie = <no type information>
fffff801`db365000 Null!_imp_IoDeleteDevice = <no type information>
fffff801`db365008 Null!_imp_MmPageEntireDriver = <no type information>
fffff801`db365010 Null!_imp_IofCompleteRequest = <no type information>
fffff801`db365018 Null!_imp_IoCreateDevice = <no type information>
fffff801`db365020 Null!_imp_RtlInitUnicodeString = <no type information>
fffff801`db365028 Null!ntoskrnl_NULL_THUNK_DATA = <no type information>
fffff801`db365030 Null!_guard_check_icall_fptr = <no type information>
fffff801`db365038 Null!_guard_dispatch_icall_fptr = <no type information>
fffff801`db365040 Null!_IMPORT_DESCRIPTOR_ntoskrnl = <no type information>
fffff801`db365054 Null!_NULL_IMPORT_DESCRIPTOR = <no type information>
fffff801`db366000 Null!GsDriverEntry ()
fffff801`db366020 Null!DriverEntry ()
fffff801`db366100 Null!_security_init_cookie ()
fffff801`db366130 Null! ?? ::PBOPGDP::`string' ()
fffff801`db367000 Null!_guard_fids_table = <no type information>
0: kd> .fnent Null!_security_check_cookie
Debugger function entry 0000020c`8b01e560 for:
(fffff801`db3610a0) Null!_security_check_cookie | (fffff801`db3610c0) Null!guard_check_icall_nop
Exact matches:
Null!_security_check_cookie (<no parameter info>)
BeginAddress = 00000000`000010a0
EndAddress = 00000000`000010be
UnwindInfoAddress = 00000000`00002398
Unwind info at fffff801`db362398, 4 bytes
version 1, flags 0, prolog 0, codes 0
0: kd> ? 1 + 1
Evaluate expression: 2 = 00000000`00000002
0: kd> ? null
Evaluate expression: -8788120305664 = fffff801`db360000
0: kd> .load pykd
0: kd> bp @@masm(dbgeng!ExtensionInfo::Load) + 5ce
Opened log file 'c:\course\windbg.day2.log'
1: kd> x hyperkbd!HkEvt*
fffff800`d0ae14a0 hyperkbd!HkEvtInternalIoctl (<no parameter info>)
fffff800`d0ae1420 hyperkbd!HkEvtDeviceReleaseHardware (<no parameter info>)
fffff800`d0ae70e0 hyperkbd!HkEvtChannelSuspend (<no parameter info>)
fffff800`d0ae1000 hyperkbd!HkEvtDeviceAdd (<no parameter info>)
fffff800`d0ae708c hyperkbd!HkEvtChannelSetLedIndicators (<no parameter info>)
fffff800`d0ae12f0 hyperkbd!HkEvtDevicePrepareHardware (<no parameter info>)
fffff800`d0ae1480 hyperkbd!HkEvtFileCreate (<no parameter info>)
fffff800`d0ae7000 hyperkbd!HkEvtChannelPostResume (<no parameter info>)
fffff800`d0ae1840 hyperkbd!HkEvtChannelProcessPacket (<no parameter info>)
1: kd> bp hyperkbd!HkEvtChannelProcessPacket
1: kd> bl
0 e fffff800`d0ae1840 0001 (0001) hyperkbd!HkEvtChannelProcessPacket
1: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
0: kd> k
# Child-SP RetAddr Call Site
00 fffff801`4e50ead8 fffff800`cf492f36 hyperkbd!HkEvtChannelProcessPacket
01 fffff801`4e50eae0 fffff800`cf49511e vmbkmcl!InpFillAndProcessQueue+0x266
02 fffff801`4e50eb70 fffff800`cf2a10b7 vmbkmcl!PkSetInterruptMaskSkipCount+0xcd6
03 fffff801`4e50ebb0 fffff801`4c855df0 vmbus!ChildInterruptDpc+0xb7
04 fffff801`4e50ec10 fffff801`4c855509 nt!KiExecuteAllDpcs+0x270
05 fffff801`4e50ed60 fffff801`4c952cb5 nt!KiRetireDpcList+0xe9
06 fffff801`4e50efb0 fffff801`4c952ac0 nt!KxRetireDpcList+0x5
07 ffffd001`adc2bac0 fffff801`4c951595 nt!KiDispatchInterruptContinue
08 ffffd001`adc2baf0 fffff801`4c9521c2 nt!KiDpcInterruptBypass+0x25
09 ffffd001`adc2bb00 00007ffc`0a0fad3b nt!KiVmbusInterrupt2+0x212
0a 00000033`eeb7d230 0000014c`4a730c90 0x00007ffc`0a0fad3b
0b 00000033`eeb7d238 0000014c`3f7607a0 0x0000014c`4a730c90
0c 00000033`eeb7d240 0000014c`3e4b6640 0x0000014c`3f7607a0
0d 00000033`eeb7d248 02d44294`2097c300 0x0000014c`3e4b6640
0e 00000033`eeb7d250 00000033`eeb7d260 0x02d44294`2097c300
0f 00000033`eeb7d258 00000000`00000000 0x00000033`eeb7d260
0: kd> .reload /user
Loading User Symbols
.................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
........................
0: kd> k
# Child-SP RetAddr Call Site
00 fffff801`4e50ead8 fffff800`cf492f36 hyperkbd!HkEvtChannelProcessPacket
01 fffff801`4e50eae0 fffff800`cf49511e vmbkmcl!InpFillAndProcessQueue+0x266
02 fffff801`4e50eb70 fffff800`cf2a10b7 vmbkmcl!PkSetInterruptMaskSkipCount+0xcd6
03 fffff801`4e50ebb0 fffff801`4c855df0 vmbus!ChildInterruptDpc+0xb7
04 fffff801`4e50ec10 fffff801`4c855509 nt!KiExecuteAllDpcs+0x270
05 fffff801`4e50ed60 fffff801`4c952cb5 nt!KiRetireDpcList+0xe9
06 fffff801`4e50efb0 fffff801`4c952ac0 nt!KxRetireDpcList+0x5
07 ffffd001`adc2bac0 fffff801`4c951595 nt!KiDispatchInterruptContinue
08 ffffd001`adc2baf0 fffff801`4c9521c2 nt!KiDpcInterruptBypass+0x25
09 ffffd001`adc2bb00 00007ffc`0a0fad3b nt!KiVmbusInterrupt2+0x212
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mpengine.dll -
0a 00000033`eeb7d230 0000014c`4a730c90 mpengine!GetSigFiles+0x64c0b
0b 00000033`eeb7d238 0000014c`3f7607a0 0x0000014c`4a730c90
0c 00000033`eeb7d240 0000014c`3e4b6640 0x0000014c`3f7607a0
0d 00000033`eeb7d248 02d44294`2097c300 0x0000014c`3e4b6640
0e 00000033`eeb7d250 00000033`eeb7d260 0x02d44294`2097c300
0f 00000033`eeb7d258 00000000`00000000 0x00000033`eeb7d260
0: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> k
# Child-SP RetAddr Call Site
00 fffff801`4e50ead8 fffff800`cf492f36 hyperkbd!HkEvtChannelProcessPacket
01 fffff801`4e50eae0 fffff800`cf49511e vmbkmcl!InpFillAndProcessQueue+0x266
02 fffff801`4e50eb70 fffff800`cf2a10b7 vmbkmcl!PkSetInterruptMaskSkipCount+0xcd6
03 fffff801`4e50ebb0 fffff801`4c855df0 vmbus!ChildInterruptDpc+0xb7
04 fffff801`4e50ec10 fffff801`4c855509 nt!KiExecuteAllDpcs+0x270
05 fffff801`4e50ed60 fffff801`4c952cb5 nt!KiRetireDpcList+0xe9
06 fffff801`4e50efb0 fffff801`4c952ac0 nt!KxRetireDpcList+0x5
07 ffffd001`adc2bac0 fffff801`4c951595 nt!KiDispatchInterruptContinue
08 ffffd001`adc2baf0 fffff801`4c9521c2 nt!KiDpcInterruptBypass+0x25
09 ffffd001`adc2bb00 00007ffc`0a0fad3b nt!KiVmbusInterrupt2+0x212
0a 00000033`eeb7d230 0000014c`4a730c90 mpengine!GetSigFiles+0x64c0b
0b 00000033`eeb7d238 0000014c`3f7607a0 0x0000014c`4a730c90
0c 00000033`eeb7d240 0000014c`3e4b6640 0x0000014c`3f7607a0
0d 00000033`eeb7d248 02d44294`2097c300 0x0000014c`3e4b6640
0e 00000033`eeb7d250 00000033`eeb7d260 0x02d44294`2097c300
0f 00000033`eeb7d258 00000000`00000000 0x00000033`eeb7d260
0: kd> .reload /user
Loading User Symbols
.................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
........................
0: kd> k
# Child-SP RetAddr Call Site
00 fffff801`4e50ead8 fffff800`cf492f36 hyperkbd!HkEvtChannelProcessPacket
01 fffff801`4e50eae0 fffff800`cf49511e vmbkmcl!InpFillAndProcessQueue+0x266
02 fffff801`4e50eb70 fffff800`cf2a10b7 vmbkmcl!PkSetInterruptMaskSkipCount+0xcd6
03 fffff801`4e50ebb0 fffff801`4c855df0 vmbus!ChildInterruptDpc+0xb7
04 fffff801`4e50ec10 fffff801`4c855509 nt!KiExecuteAllDpcs+0x270
05 fffff801`4e50ed60 fffff801`4c952cb5 nt!KiRetireDpcList+0xe9
06 fffff801`4e50efb0 fffff801`4c952ac0 nt!KxRetireDpcList+0x5
07 ffffd001`adc2bac0 fffff801`4c951595 nt!KiDispatchInterruptContinue
08 ffffd001`adc2baf0 fffff801`4c9521c2 nt!KiDpcInterruptBypass+0x25
09 ffffd001`adc2bb00 00007ffc`0a0fad3b nt!KiVmbusInterrupt2+0x212
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mpengine.dll -
0a 00000033`eeb7d230 0000014c`4a730c90 mpengine!GetSigFiles+0x64c0b
0b 00000033`eeb7d238 0000014c`3f7607a0 0x0000014c`4a730c90
0c 00000033`eeb7d240 0000014c`3e4b6640 0x0000014c`3f7607a0
0d 00000033`eeb7d248 02d44294`2097c300 0x0000014c`3e4b6640
0e 00000033`eeb7d250 00000033`eeb7d260 0x02d44294`2097c300
0f 00000033`eeb7d258 00000000`00000000 0x00000033`eeb7d260
0: kd> bd *
0: kd> g
PID=784 TID=3144 DismApi.dll: - DismInitializeInternal
PID=784 TID=3144 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
PID=784 TID=3144 DismApi.dll: - DismInitializeInternal
PID=784 TID=3144 DismApi.dll: Version 10.0.10586.0 - DismInitializeInternal
PID=784 TID=3144 DismApi.dll: Parent process command line: C:\Windows\system32\cleanmgr.exe /autoclean /d C: - DismInitializeInternal
PID=784 TID=3144 Enter DismInitializeInternal - DismInitializeInternal
PID=784 TID=3144 Input parameters: LogLevel: 2, LogFilePath: (null), ScratchDirectory: (null) - DismInitializeInternal
PID=784 TID=3144 Initialized GlobalConfig - DismInitializeInternal
PID=784 TID=3144 Initialized SessionTable - DismInitializeInternal
PID=784 TID=3144 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
PID=784 TID=3144 Waiting for m_pInternalThread to start - CCommandThread::Start
PID=784 TID=2384 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
PID=784 TID=3144 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
PID=784 TID=3144 m_pInternalThread started - CCommandThread::Start
PID=784 TID=2384 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
PID=784 TID=3144 Created g_internalDismSession - DismInitializeInternal
PID=784 TID=3144 Leave DismInitializeInternal - DismInitializeInternal
PID=784 TID=3144 Enter DismOpenSessionInternal - DismOpenSessionInternal
PID=784 TID=3144 Input parameters: ImagePath: DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}, WindowsDirectory: (null), SystemDrive: (null) - DismOpenSessionInternal
PID=784 TID=3144 Lookup in table by path failed for: DRIVE_C - CTransactionalImageTable::LookupImagePath
PID=784 TID=3144 Waiting for m_pInternalThread to start - CCommandThread::Start
PID=784 TID=4832 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
PID=784 TID=4832 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
PID=784 TID=3144 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
PID=784 TID=3144 m_pInternalThread started - CCommandThread::Start
PID=784 TID=3144 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
PID=784 TID=4832 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
PID=784 TID=4832 Successfully dequeued command object - CCommandThread::DequeueCommandObject
PID=784 TID=4832 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStorePID=784 TID=4832 Initializing a provider store for the LOCAL session type. - CDISMProviderStore::Final_OnConnectPID=784 TID=4832 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnectPID=784 TID=4832 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProviderPID=784 TID=4832 Loading Provider from location C:\Windows\system32\Dism\LogProvider.dll - CDISMProviderStore::Internal_GetProviderPID=784 TID=4832 Connecting to the provider located at C:\Windows\system32\Dism\LogProvider.dll. - CDISMProviderStore::Internal_LoadProviderBreak instruction exception - code 80000003 (first chance)
*******************************************************************************
* *
* You are seeing this message because you pressed either *
* CTRL+C (if you run console kernel debugger) or, *
* CTRL+BREAK (if you run GUI kernel debugger), *
* on your debugger machine's keyboard. *
* *
* THIS IS NOT A BUG OR A SYSTEM CRASH *
* *
* If you did not intend to break into the debugger, press the "g" key, then *
* press the "Enter" key now. This message might immediately reappear. If it *
* does, press "g" and "Enter" again. *
* *
*******************************************************************************
nt!DbgBreakPointWithStatus:
fffff801`4c9536d0 cc int 3
0: kd> be *
0: kd> g
Breakpoint 0 hit
hyperkbd!HkEvtChannelProcessPacket:
fffff800`d0ae1840 48895c2408 mov qword ptr [rsp+8],rbx
0: kd> k
# Child-SP RetAddr Call Site
00 fffff801`4e507788 fffff800`cf492f36 hyperkbd!HkEvtChannelProcessPacket
01 fffff801`4e507790 fffff800`cf49511e vmbkmcl!InpFillAndProcessQueue+0x266
02 fffff801`4e507820 fffff800`cf2a10b7 vmbkmcl!PkSetInterruptMaskSkipCount+0xcd6
03 fffff801`4e507860 fffff801`4c855df0 vmbus!ChildInterruptDpc+0xb7
04 fffff801`4e5078c0 fffff801`4c855509 nt!KiExecuteAllDpcs+0x270
05 fffff801`4e507a10 fffff801`4c950d3a nt!KiRetireDpcList+0xe9
06 fffff801`4e507c60 00000000`00000000 nt!KiIdleLoop+0x5a
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
0: kd> bc *
0: kd> bp nt!NtCreateFile
0: kd> g
Breakpoint 0 hit
nt!NtCreateFile:
fffff801`4cc1e3b0 4881ec88000000 sub rsp,88h
0: kd> k
# Child-SP RetAddr Call Site
00 ffffd000`23da9a88 fffff801`4c9587a3 nt!NtCreateFile
01 ffffd000`23da9a90 00007ffc`1b2b57f4 nt!KiSystemServiceCopyEnd+0x13
02 00000001`073fee28 00007ffc`1826a484 ntdll!NtCreateFile+0x14
03 00000001`073fee30 00007ffc`1826a156 KERNELBASE!CreateFileInternal+0x314
04 00000001`073fefb0 00007ffc`182981f3 KERNELBASE!CreateFileW+0x66
05 00000001`073ff010 00007ffc`1829726c KERNELBASE!BasepCopyFileExW+0x333
06 00000001`073ff600 00007ffc`182968f1 KERNELBASE!CopyFileExW+0xbc
07 00000001`073ff6b0 00007ffb`ff7e377e KERNELBASE!CopyFileW+0x21
08 00000001`073ff6f0 00002fa1`7c6dfe5d 0x00007ffb`ff7e377e
09 00000001`073ff6f8 00000000`00000001 0x00002fa1`7c6dfe5d
0a 00000001`073ff700 00000001`073ffad0 0x1
0b 00000001`073ff708 00000001`073ff840 0x00000001`073ffad0
0c 00000001`073ff710 00000001`073ff840 0x00000001`073ff840
0d 00000001`073ff718 00007ffb`ff709ebb 0x00000001`073ff840
0e 00000001`073ff720 00000000`00000000 0x00007ffb`ff709ebb
0: kd> .reload
Connected to Windows 10 10586 x64 target at (Tue May 3 11:42:48.955 2016 (UTC + 10:00)), ptr64 TRUE
Loading Kernel Symbols
.........................................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
......
................................................................
.......................
Loading User Symbols
........................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
........................
................................................................
................................................................
.................................
Loading unloaded module list
..................................
0: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 ffffd000`23da9a88 fffff801`4c9587a3 : fffff6fb`7dafff80 fffff6fb`5fff06c8 fffff6bf`fe0d9428 ffff24e3`a4decb77 : nt!NtCreateFile
01 ffffd000`23da9a90 00007ffc`1b2b57f4 : 00007ffc`1826a484 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23da9b00)
02 00000001`073fee28 00007ffc`1826a484 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000003 : ntdll!NtCreateFile+0x14
03 00000001`073fee30 00007ffc`1826a156 : 00000130`d4bb0000 00000000`00000015 00002fa1`7c6dd58d 00000000`00000000 : KERNELBASE!CreateFileInternal+0x314
04 00000001`073fefb0 00007ffc`182981f3 : 00000001`00000000 00000000`00000130 00000000`00001b00 00000130`d662da50 : KERNELBASE!CreateFileW+0x66
05 00000001`073ff010 00007ffc`1829726c : 00000000`00000000 00000130`d66f5360 00000000`c0000034 00007ffc`182b7faf : KERNELBASE!BasepCopyFileExW+0x333
06 00000001`073ff600 00007ffc`182968f1 : 00000000`00000000 00000130`d66b46d0 00000000`00000000 00000001`00000100 : KERNELBASE!CopyFileExW+0xbc
07 00000001`073ff6b0 00007ffb`ff7e377e : 00002fa1`7c6dfe5d 00000000`00000001 00000001`073ffad0 00000001`073ff840 : KERNELBASE!CopyFileW+0x21
08 00000001`073ff6f0 00007ffb`ff709ebb : 00000000`00000000 00000000`0000004d 00000001`073ff800 00000001`073ff800 : wuaueng!SusCopyFileRetryIfSharingViolation+0x62
09 00000001`073ff720 00007ffb`ff7e3f31 : 00000130`d6c07a60 00000001`073ff810 00000130`d623d7bc 00000001`073ff808 : wuaueng!CAppxAppFamiliesCache::IsAppFamilyInstalled+0x503
0a 00000001`073ff7b0 00007ffb`ff767fae : 00000130`d66b0990 00000130`d4d7fad0 00000000`00000000 00000130`d4d8a510 : wuaueng!SusMoveFileRetryIfSharingViolation+0x1b9
0b 00000001`073ff840 00007ffb`ff7297db : 00000130`d4d4dd90 00000000`00000005 00000001`073ffd68 00000000`00000000 : wuaueng!CAgentDownloadManager::GenerateDownloadRequest+0x3ca
0c 00000001`073ffd30 00007ffb`ff6c389e : 00000130`d4d46bc0 00000130`00000001 00000000`00000000 00000000`00000000 : wuaueng!CUHWinSetupSession::Release+0x1c31b
0d 00000001`073ffdb0 00007ffb`ff6d0c99 : 00000000`00000000 00000000`00000000 00000130`d4d3f3a8 00007ffb`ff6c3780 : wuaueng!CAgentDownloadManager::ProcessWorkItem+0x11e
0e 00000001`073ffe70 00007ffb`ff6cf555 : 00000000`00000000 00000000`00000000 00000130`d4d40168 00000000`00000000 : wuaueng!CWorkItemManager::ExecuteNonCallbackWorkItem+0x1ad
0f 00000001`073ffee0 00007ffc`18a18102 : 00007ffb`ff6cf510 00000000`00000000 00000000`00000000 00000000`00000000 : wuaueng!CWorkItemManager::ExecuteWorkItemWrapper+0x45
10 00000001`073fff10 00007ffc`1b26c264 : 00007ffc`18a180e0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x22
11 00000001`073fff40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34
0: kd> .load pykd
Opened log file 'c:\course\windbg.day2.log'
0: kd> dt nt!_KTRAP_FRAME
+0x000 P1Home : Uint8B
+0x008 P2Home : Uint8B
+0x010 P3Home : Uint8B
+0x018 P4Home : Uint8B
+0x020 P5 : Uint8B
+0x028 PreviousMode : Char
+0x029 PreviousIrql : UChar
+0x02a FaultIndicator : UChar
+0x02b ExceptionActive : UChar
+0x02c MxCsr : Uint4B
+0x030 Rax : Uint8B
+0x038 Rcx : Uint8B
+0x040 Rdx : Uint8B
+0x048 R8 : Uint8B
+0x050 R9 : Uint8B
+0x058 R10 : Uint8B
+0x060 R11 : Uint8B
+0x068 GsBase : Uint8B
+0x068 GsSwap : Uint8B
+0x070 Xmm0 : _M128A
+0x080 Xmm1 : _M128A
+0x090 Xmm2 : _M128A
+0x0a0 Xmm3 : _M128A
+0x0b0 Xmm4 : _M128A
+0x0c0 Xmm5 : _M128A
+0x0d0 FaultAddress : Uint8B
+0x0d0 ContextRecord : Uint8B
+0x0d0 TimeStampCKCL : Uint8B
+0x0d8 Dr0 : Uint8B
+0x0e0 Dr1 : Uint8B
+0x0e8 Dr2 : Uint8B
+0x0f0 Dr3 : Uint8B
+0x0f8 Dr6 : Uint8B
+0x100 Dr7 : Uint8B
+0x108 DebugControl : Uint8B
+0x110 LastBranchToRip : Uint8B
+0x118 LastBranchFromRip : Uint8B
+0x120 LastExceptionToRip : Uint8B
+0x128 LastExceptionFromRip : Uint8B
+0x130 SegDs : Uint2B
+0x132 SegEs : Uint2B
+0x134 SegFs : Uint2B
+0x136 SegGs : Uint2B
+0x138 TrapFrame : Uint8B
+0x140 Rbx : Uint8B
+0x148 Rdi : Uint8B
+0x150 Rsi : Uint8B
+0x158 Rbp : Uint8B
+0x160 ErrorCode : Uint8B
+0x160 ExceptionFrame : Uint8B
+0x160 TimeStampKlog : Uint8B
+0x168 Rip : Uint8B
+0x170 SegCs : Uint2B
+0x172 Fill0 : UChar
+0x173 Logging : UChar
+0x174 Fill1 : [2] Uint2B
+0x178 EFlags : Uint4B
+0x17c Fill2 : Uint4B
+0x180 Rsp : Uint8B
+0x188 SegSs : Uint2B
+0x18a Fill3 : Uint2B
+0x18c Fill4 : Uint4B
0: kd> bp nt!NtCreateFile
0: kd> g
Breakpoint 0 hit
nt!NtCreateFile:
fffff801`4cc1e3b0 4881ec88000000 sub rsp,88h
0: kd> .reload
Connected to Windows 10 10586 x64 target at (Tue May 3 11:46:36.694 2016 (UTC + 10:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
....
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
............................................................
.......................
Loading User Symbols
.......................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.........................
................................................................
................................................................
.................................
Loading unloaded module list
..................................
0: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 ffffd000`23da9a88 fffff801`4c9587a3 : fffff6fb`7dafff80 00000001`073fdff0 00000001`073fe08c ffff24e3`00000004 : nt!NtCreateFile
01 ffffd000`23da9a90 00007ffc`1b2b57f4 : 00007ffc`1829b6cd 00000000`00000001 00000001`073ff250 00000000`00000001 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23da9b00)
02 00000001`073fdde8 00007ffc`1829b6cd : 00000000`00000001 00000001`073ff250 00000000`00000001 00000000`00000000 : ntdll!NtCreateFile+0x14
03 00000001`073fddf0 00007ffc`1829864f : 00000001`00000000 00000000`00000130 00000000`00001b00 00000130`d662da50 : KERNELBASE!BaseCopyStream+0x17d9
04 00000001`073ff010 00007ffc`1829726c : 00000000`00000000 00000130`d66f5360 00000000`c0000034 00007ffc`182b7faf : KERNELBASE!BasepCopyFileExW+0x78f
05 00000001`073ff600 00007ffc`182968f1 : 00000000`00000000 00000130`d66b46d0 00000000`00000000 00000001`00000100 : KERNELBASE!CopyFileExW+0xbc
06 00000001`073ff6b0 00007ffb`ff7e377e : 00002fa1`7c6dfe5d 00000000`00000001 00000001`073ffad0 00000001`073ff840 : KERNELBASE!CopyFileW+0x21
07 00000001`073ff6f0 00007ffb`ff709ebb : 00000000`00000000 00000000`0000004d 00000001`073ff800 00000001`073ff800 : wuaueng!SusCopyFileRetryIfSharingViolation+0x62
08 00000001`073ff720 00007ffb`ff7e3f31 : 00000130`d6c07a60 00000001`073ff810 00000130`d623d7bc 00000001`073ff808 : wuaueng!CAppxAppFamiliesCache::IsAppFamilyInstalled+0x503
09 00000001`073ff7b0 00007ffb`ff767fae : 00000130`d66b0990 00000130`d4d7fad0 00000000`00000000 00000130`d4d8a510 : wuaueng!SusMoveFileRetryIfSharingViolation+0x1b9
0a 00000001`073ff840 00007ffb`ff7297db : 00000130`d4d4dd90 00000000`00000005 00000001`073ffd68 00000000`00000000 : wuaueng!CAgentDownloadManager::GenerateDownloadRequest+0x3ca
0b 00000001`073ffd30 00007ffb`ff6c389e : 00000130`d4d46bc0 00000130`00000001 00000000`00000000 00000000`00000000 : wuaueng!CUHWinSetupSession::Release+0x1c31b
0c 00000001`073ffdb0 00007ffb`ff6d0c99 : 00000000`00000000 00000000`00000000 00000130`d4d3f3a8 00007ffb`ff6c3780 : wuaueng!CAgentDownloadManager::ProcessWorkItem+0x11e
0d 00000001`073ffe70 00007ffb`ff6cf555 : 00000000`00000000 00000000`00000000 00000130`d4d40168 00000000`00000000 : wuaueng!CWorkItemManager::ExecuteNonCallbackWorkItem+0x1ad
0e 00000001`073ffee0 00007ffc`18a18102 : 00007ffb`ff6cf510 00000000`00000000 00000000`00000000 00000000`00000000 : wuaueng!CWorkItemManager::ExecuteWorkItemWrapper+0x45
0f 00000001`073fff10 00007ffc`1b26c264 : 00007ffc`18a180e0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x22
10 00000001`073fff40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34
0: kd> r
rax=0000000000000000 rbx=ffffe000777c8080 rcx=00000001073fde70
rdx=00000000c0150081 rsi=00000001073fde08 rdi=ffffd00023da9aa8
rip=fffff8014cc1e3b0 rsp=ffffd00023da9a88 rbp=ffffd00023da9b80
r8=00000001073fe150 r9=00000001073fdff0 r10=fffff8014cc1e3b0
r11=fffff8014c958758 r12=00000000c0150081 r13=0000000000000020
r14=00000000ffffffff r15=0000000000000064
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!NtCreateFile:
fffff801`4cc1e3b0 4881ec88000000 sub rsp,88h
0: kd> .trap ffffd000`23da9b00
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffc1b2b57f4 rsp=00000001073fdde8 rbp=00000130d66b0990
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
ntdll!NtCreateFile+0x14:
0033:00007ffc`1b2b57f4 c3 ret
0: kd> r
Last set context:
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffc1b2b57f4 rsp=00000001073fdde8 rbp=00000130d66b0990
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 efl=00000246
ntdll!NtCreateFile+0x14:
0033:00007ffc`1b2b57f4 c3 ret
0: kd> .trap
Resetting default scope
0: kd> r
rax=0000000000000000 rbx=ffffe000777c8080 rcx=00000001073fde70
rdx=00000000c0150081 rsi=00000001073fde08 rdi=ffffd00023da9aa8
rip=fffff8014cc1e3b0 rsp=ffffd00023da9a88 rbp=ffffd00023da9b80
r8=00000001073fe150 r9=00000001073fdff0 r10=fffff8014cc1e3b0
r11=fffff8014c958758 r12=00000000c0150081 r13=0000000000000020
r14=00000000ffffffff r15=0000000000000064
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!NtCreateFile:
fffff801`4cc1e3b0 4881ec88000000 sub rsp,88h
0: kd> dt nt!_KTRAP_FRAME ffffd000`23da9b00
+0x000 P1Home : 0xffffe000`777c8080
+0x008 P2Home : 0
+0x010 P3Home : 0xffffe000`777c8080
+0x018 P4Home : 0xffffd000`23da9b80
+0x020 P5 : 0x00000130`00000000
+0x028 PreviousMode : 0 ''
+0x029 PreviousIrql : 0 ''
+0x02a FaultIndicator : 0x8 ''
+0x02b ExceptionActive : 0x2 ''
+0x02c MxCsr : 0x1fa0
+0x030 Rax : 0x1000
+0x038 Rcx : 0x00007ffc`1b353880
+0x040 Rdx : 0x3ef3d539`6bfa223a
+0x048 R8 : 0x00000001`073fefc8
+0x050 R9 : 0
+0x058 R10 : 0x10
+0x060 R11 : 0x00000001`073ff008
+0x068 GsBase : 0x00000001`00224000
+0x068 GsSwap : 0x00000001`00224000
+0x070 Xmm0 : _M128A
+0x080 Xmm1 : _M128A
+0x090 Xmm2 : _M128A
+0x0a0 Xmm3 : _M128A
+0x0b0 Xmm4 : _M128A
+0x0c0 Xmm5 : _M128A
+0x0d0 FaultAddress : 0x00007ffc`1b2374c0
+0x0d0 ContextRecord : 0x00007ffc`1b2374c0
+0x0d0 TimeStampCKCL : 0x00007ffc`1b2374c0
+0x0d8 Dr0 : 0
+0x0e0 Dr1 : 0
+0x0e8 Dr2 : 0
+0x0f0 Dr3 : 0
+0x0f8 Dr6 : 0
+0x100 Dr7 : 0
+0x108 DebugControl : 0
+0x110 LastBranchToRip : 0
+0x118 LastBranchFromRip : 0
+0x120 LastExceptionToRip : 0
+0x128 LastExceptionFromRip : 0
+0x130 SegDs : 0
+0x132 SegEs : 0
+0x134 SegFs : 0
+0x136 SegGs : 0
+0x138 TrapFrame : 0
+0x140 Rbx : 0
+0x148 Rdi : 5
+0x150 Rsi : 0x00000001`073ff250
+0x158 Rbp : 0x00000130`d66b0990
+0x160 ErrorCode : 0x14
+0x160 ExceptionFrame : 0x14
+0x160 TimeStampKlog : 0x14
+0x168 Rip : 0x00007ffc`1b2b57f4
+0x170 SegCs : 0x33
+0x172 Fill0 : 0 ''
+0x173 Logging : 0 ''
+0x174 Fill1 : [2] 0
+0x178 EFlags : 0x246
+0x17c Fill2 : 0
+0x180 Rsp : 0x00000001`073fdde8
+0x188 SegSs : 0x2b
+0x18a Fill3 : 0
+0x18c Fill4 : 0
Opened log file 'c:\course\windbg.day2.log'
1: kd> x nt!IO*complet*request*
fffff801`4c861a80 nt!IopfCompleteRequest (<no parameter info>)
fffff801`4c861a70 nt!IoCompleteRequest (<no parameter info>)
fffff801`4c9c4d38 nt!IopPerfCompleteRequest (<no parameter info>)