Windows 10 教育版 22H2(19045.6456)

微信版本：4.1.5.30

dump文件 Windbg分析

0:000> !analyze -v

..*** WARNING: Unable to verify checksum for ntdll.dll

..............................................................

................................................................

................

Loading unloaded module list

............

*** WARNING: Unable to verify checksum for KERNELBASE.dll

*******************************************************************************

*                                                                             *

*                        Exception Analysis                                   *

*                                                                             *

*******************************************************************************

*** WARNING: Unable to verify checksum for Weixin.exe

*** WARNING: Unable to verify checksum for KERNEL32.DLL

*** WARNING: Unable to verify checksum for USER32.dll

*** WARNING: Unable to verify checksum for ole32.dll

*** WARNING: Unable to verify checksum for twinapi.appcore.dll

KEY_VALUES_STRING: 1

    Key  : AV.Type

    Value: Read

    Key  : Analysis.CPU.mSec

    Value: 890

    Key  : Analysis.Elapsed.mSec

    Value: 31613

    Key  : Analysis.IO.Other.Mb

    Value: 0

    Key  : Analysis.IO.Read.Mb

    Value: 1

    Key  : Analysis.IO.Write.Mb

    Value: 50

    Key  : Analysis.Init.CPU.mSec

    Value: 1906

    Key  : Analysis.Init.Elapsed.mSec

    Value: 83161

    Key  : Analysis.Memory.CommitPeak.Mb

    Value: 370

    Key  : Analysis.Version.DbgEng

    Value: 10.0.29482.1003

    Key  : Analysis.Version.Description

    Value: 10.2509.29.03 amd64fre

    Key  : Analysis.Version.Ext

    Value: 1.2509.29.3

    Key  : Failure.Bucket

    Value: INVALID_POINTER_READ_c0000005_Weixin.dll!Unknown

    Key  : Failure.Exception.Code

    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address

    Value: 0x7ff9cb1dc557

    Key  : Failure.Exception.IP.Module

    Value: Weixin

    Key  : Failure.Exception.IP.Offset

    Value: 0x22c557

    Key  : Failure.Hash

    Value: {8a98e502-46c3-5184-6117-0c42e85e735f}

    Key  : Failure.ProblemClass.Primary

    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type

    Value: Paged

    Key  : Timeline.Process.Start.DeltaSec

    Value: 9778

    Key  : WER.Process.Version

    Value: 4.1.5.30

FILE_IN_CAB:  Weixin_52962be4-2af7-433c-a9f8-3b05cbf6f655.dmp

NTGLOBALFLAG:  0

CONTEXT:  (.ecxr)

rax=0000000000000000 rbx=0000023df72b7040 rcx=0000023df8d88860

rdx=0000000000000011 rsi=0000023d00000060 rdi=0000023df32675d0

rip=00007ff9cb1dc557 rsp=000000df4f72be50 rbp=000000df4f72bed0

 r8=0000000000000000  r9=0000000000000000 r10=00007ff9d2407190

r11=0000000000000000 r12=0000023de9e026f0 r13=0000000000000000

r14=0000023deb36e350 r15=0000023debf92790

iopl=0         nv up ei pl nz na po nc

cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010206

Weixin!WeChatMain+0x22b557:

00007ff9`cb1dc557 8b4620          mov     eax,dword ptr [rsi+20h] ds:0000023d`00000080=????????

Resetting default scope

EXCEPTION_RECORD:  (.exr -1)

ExceptionAddress: 00007ff9cb1dc557 (Weixin!WeChatMain+0x000000000022b557)

   ExceptionCode: c0000005 (Access violation)

  ExceptionFlags: 00000000

NumberParameters: 2

   Parameter[0]: 0000000000000000

   Parameter[1]: 0000023d00000080

Attempt to read from address 0000023d00000080

PROCESS_NAME:  Weixin.exe

READ_ADDRESS:  0000023d00000080 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000023d00000080

STACK_TEXT:  

000000df`4f72be50 00007ff9`cb0f0f96     : 00000000`00000002 00000000`00000000 00000000`00000000 00001b3a`9ec501eb : Weixin!WeChatMain+0x22b557

000000df`4f72bf70 00007ff9`cb6851fa     : 00000000`00000000 0000023d`eb36e4f0 000000df`4f72c0e0 00007ff9`ccf7801d : Weixin!WeChatMain+0x13ff96

000000df`4f72c010 00007ff9`cc18facd     : 00000000`00000001 000000df`4f72c0e0 00000000`00000024 0000023d`ebfe0ed0 : Weixin!HostStartupExceptionReport+0x6206a

000000df`4f72c060 00007ff9`ccf78004     : 00000000`00000000 000000df`4f72f290 0000023d`e9e026f0 00000000`00000000 : Weixin!GetHandleVerifier+0x1ce61d

000000df`4f72f1a0 00007ff9`cb65fc52     : 0000023d`e9df92d8 000000df`4f72f710 000000df`4f72f250 00007ff9`cb65f99c : Weixin!GetHandleVerifier+0xfb6b54

000000df`4f72f1e0 00007ff9`cb0dec87     : 0000023d`f133cc18 0000023d`f133cbe0 0000023d`f133cc18 00000000`00000001 : Weixin!HostStartupExceptionReport+0x3cac2

000000df`4f72f270 00007ff9`cb50ecb0     : 0000023d`e8180000 00000000`00000006 00000000`00000000 0000023d`e9df9378 : Weixin!WeChatMain+0x12dc87

000000df`4f72f2f0 00007ff9`cc1c4953     : 000000df`4f72f400 00007ff9`d0df22c0 00000000`00000000 00000000`00000008 : Weixin!SetWeixinCallbackFunc+0x281cf0

000000df`4f72f360 00007ff9`cb0b67d6     : 00000000`00000000 00007ff9`d0df225c 000000df`4f72f710 00007ff9`d44db8f0 : Weixin!GetHandleVerifier+0x2034a3

000000df`4f72f420 00007ff9`cafb497d     : 000000df`4f72f560 00000000`00000000 00000000`00000000 00000000`00000279 : Weixin!WeChatMain+0x1057d6

000000df`4f72f4e0 00007ff6`54461c8d     : 0000023d`e7fcad90 00007ff9`cb28cfc0 000000df`4f72f940 00000000`084de937 : Weixin!WeChatMain+0x397d

000000df`4f72f8c0 00007ff6`54463142     : 00000000`00000000 00000c01`00000000 00000000`00000001 00000000`00000000 : Weixin_exe+0x1c8d

000000df`4f72faf0 00007ff6`54625d92     : 00007ff6`54663868 00007ff6`54625e09 00000000`00000000 00000000`00000000 : Weixin_exe+0x3142

000000df`4f72fb40 00007ffa`5ffd7374     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Weixin_exe!GetHandleVerifier+0x17f882

000000df`4f72fb80 00007ffa`61e3cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14

000000df`4f72fbb0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21

STACK_COMMAND: ~0s; .ecxr ; kb

IP_IN_PAGED_CODE: 

Weixin!WeChatMain+22b557

00007ff9`cb1dc557 8b4620          mov     eax,dword ptr [rsi+20h]

SYMBOL_NAME:  Weixin+22c557

MODULE_NAME: Weixin

IMAGE_NAME:  Weixin.dll

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_Weixin.dll!Unknown

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  4.1.5.30

FAILURE_ID_HASH:  {8a98e502-46c3-5184-6117-0c42e85e735f}

Followup:     MachineOwner

---------