Hello
I have a crash dump which reports a SOFTWARE_NX_FAULT_c0000005 (NX = No eXecution) on Flash.ocx module. I don't have the Flash symbols, but the callstack at the time of the fault looks something like the below. (Here's more info on SOFTWARE_NX_FAULT for reference: http://www.osronline.com/showthread.cfm?link=99537)
ExceptionAddress: 27102a20
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 27102a20
Attempt to execute non-executable address 27102a20
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
4b33f6bc 67506c69 00000000 27102a20 3d347000 0x27102a20
4b33f8f4 6767cb73 27102a20 263240a0 286f97d0 Flash+0x1c6c69
4b33f94c 6773ed4a 3d347000 3d353a70 00000000 Flash+0x33cb73
4b33f9c4 6773ebff 000000f6 00000000 4b33f9e8 Flash+0x3fed4a
4b33f9dc 6773ed7e 00000081 4b33fa14 63edbcf2 Flash+0x3febff
4b33f9e8 63edbcf2 3d353a70 00000000 6773ed70 Flash+0x3fed7e
4b33fa14 75bb919f 085a5148 4b33fa64 774fa22b IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x71
4b33fa20 774fa22b 085a5148 15119a80 00000000 kernel32!BaseThreadInitThunk+0xe
4b33fa64 774fa201 ffffffff 774ef233 00000000 ntdll!__RtlUserThreadStart+0x20
4b33fa74 00000000 63edbc81 085a5148 00000000 ntdll!_RtlUserThreadStart+0x1b
The versions of Flash, Internet Explorer and OS are as given below (note the T referenced in the Flash module name section - not sure what that is - i have posted a separate question on that).
// Windbg command output
0:284> lmvm Flash
start end module name
67340000 68563000 Flash T (no symbols)
Loaded symbol image file: Flash.ocx
Image path: C:\Windows\System32\Macromed\Flash\Flash.ocx
Image name: Flash.ocx
Timestamp: Wed Aug 27 20:23:58 2014 (53FEA0CE)
CheckSum: 0113703E
ImageSize: 01223000
File version: 15.0.0.152
Product version: 15.0.0.152
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0:284> lmv m iexplore
start end module name
012c0000 01386000 iexplore (private pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\sym\iexplore.pdb\FDEF472E36AD47D6A14CB20361C574A22\iexplore.pdb
Loaded symbol image file: iexplore.exe
Mapped memory image file: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\sym\iexplore.exe\53EEA0C3c6000\iexplore.exe
Image path: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Image name: iexplore.exe
Timestamp: Fri Aug 15 17:07:31 2014 (53EEA0C3)
CheckSum: 000D3B5A
ImageSize: 000C6000
File version: 11.0.9600.17278
Product version: 11.0.9600.17278
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
InternalName: iexplore
OriginalFilename: IEXPLORE.EXE
ProductVersion: 11.00.9600.17278
FileVersion: 11.00.9600.17278 (winblue_r2.140815-1500)
FileDescription: Internet Explorer
LegalCopyright: © Microsoft Corporation. All rights reserved.
Windows 8 Version 9600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS Personal
Built by: 6.3.9600.17031 (winblue_gdr.140221-1952)
Any help on the above is really appreciated!
Thanks!
Mohan
