Id: AVR:Free iexplore.exe!jscript.dll!RegExpBase::FBadHeader 6A0257
Description: Access violation while reading freed memory at 0x9A15E68
Process binary: iexplore.exe
Location: jscript.dll!RegExpBase::FBadHeader + 0x6
Security impact: Potentially exploitable security issue
jscript.dll!RegExpBase::FBadHeader + 0x6 (6A in id)
jscript.dll!RegExpExec::Exec + 0x3C (02 in id)
jscript.dll!RegExpExec::ReplaceUsingCallable + 0x2B3 (57 in id)
jscript.dll!RegExpObj::Exec + 0xAAE
jscript.dll!JsStrReplace + 0x1E8
jscript.dll!NatFncObj::Call + 0x106
jscript.dll!NameTbl::InvokeInternal + 0x2B4
jscript.dll!VAR::InvokeByDispID + 0x17F
jscript.dll!VAR::InvokeJSObj<SYM *> + 0xB8
jscript.dll!VAR::InvokeByName + 0x174
jscript.dll!VAR::InvokeDispName + 0x7D
jscript.dll!VAR::InvokeByDispID + 0xCE
jscript.dll!CScriptRuntime::Run + 0x2B80 (this symbol may not be correct)
jscript.dll!ScrFncObj::CallWithFrameOnStack + 0xCE
jscript.dll!ScrFncObj::Call + 0x8D
jscript.dll!CSession::Execute + 0x15F
jscript.dll!COleScript::ExecutePendingScripts + 0x1BD
jscript.dll!COleScript::ParseScriptTextCore + 0x2A4
jscript.dll!COleScript::ParseScriptText + 0x30
mshtml.dll!CScriptCollection::ParseScriptText + 0x231
mshtml.dll!CScriptElement::CommitCode + 0x3C2
mshtml.dll!CScriptElement::Execute + 0xD7
mshtml.dll!CHtmParse::Execute + 0x4A
mshtml.dll!CHtmPost::Broadcast + 0xF
mshtml.dll!CHtmPost::Exec + 0x618
mshtml.dll!CHtmPost::Run + 0x15
mshtml.dll!PostManExecute + 0x1FB
mshtml.dll!PostManResume + 0xF7
mshtml.dll!CHtmPost::OnDwnChanCallback + 0x10
mshtml.dll!CDwnChan::OnMethodCall + 0x19
mshtml.dll!GlobalWndOnMethodCall + 0x108
mshtml.dll!GlobalWndProc + 0x111
USER32.dll!InternalCallWinProc + 0x23
USER32.dll!UserCallWinProcCheckWow + 0x14B
USER32.dll!DispatchMessageWorker + 0x35E
USER32.dll!DispatchMessageW + 0xF
IEFRAME.dll!CTabWindow::_TabWindowThreadProc + 0x54B
IEFRAME.dll!LCIETab_ThreadProc + 0x2C1
iertutil.dll!CIsoScope::RegisterThread + 0xAB
kernel32.dll!BaseThreadInitThunk + 0xE
ntdll.dll!__RtlUserThreadStart + 0x70
ntdll.dll!_RtlUserThreadStart + 0x1B
Image path: iexplore.exe
Image name: iexplore.exe
Timestamp: Thu Jul 16 09:55:30 2015 (55A7E202)
CheckSum: 000A9DD0
ImageSize: 000A6000
File version: 8.0.7601.18934
Product version: 8.0.7601.18934
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Windows� Internet Explorer
InternalName: iexplore
OriginalFilename: IEXPLORE.EXE
ProductVersion: 8.00.7601.18934
FileVersion: 8.00.7601.18934 (win7sp1_gdr.150716-0600)
FileDescription: Internet Explorer
LegalCopyright: � Microsoft Corporation. All rights reserved.
Loaded symbol image file: C:\Windows\System32\jscript.dll
Image path: C:\Windows\System32\jscript.dll
Image name: jscript.dll
Timestamp: Thu Jul 16 12:04:48 2015 (55A80050)
CheckSum: 000B9049
ImageSize: 000B2000
File version: 5.8.7601.18934
Product version: 5.8.7601.18934
File flags: 0 (Mask 3)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft � JScript
InternalName: jscript.dll
OriginalFilename: jscript.dll
ProductVersion: 5.8.7601.18934
FileVersion: 5.8.7601.18934
FileDescription: Microsoft � JScript
LegalCopyright: � Microsoft Corporation. All rights reserved.
Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.
CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" http://W7-IE8:28876
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 013e0000 01486000 iexplore.exe
ModLoad: 77320000 77461000 ntdll.dll
ModLoad: 6be30000 6be90000 C:\Windows\system32\verifier.dll
Page heap: pid 0x32C: page heap enabled with flags 0x3.
ModLoad: 76050000 76124000 C:\Windows\system32\kernel32.dll
ModLoad: 75690000 756db000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 76550000 765f1000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 757f0000 7589c000 C:\Windows\system32\msvcrt.dll
ModLoad: 77480000 77499000 C:\Windows\SYSTEM32\sechost.dll
ModLoad: 75fa0000 76042000 C:\Windows\system32\RPCRT4.dll
ModLoad: 76600000 766c9000 C:\Windows\system32\USER32.dll
ModLoad: 75e10000 75e5e000 C:\Windows\system32\GDI32.dll
ModLoad: 75e00000 75e0a000 C:\Windows\system32\LPK.dll
ModLoad: 75b40000 75bdd000 C:\Windows\system32\USP10.dll
ModLoad: 75f40000 75f97000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 766d0000 7731b000 C:\Windows\system32\SHELL32.dll
ModLoad: 758a0000 759fc000 C:\Windows\system32\ole32.dll
ModLoad: 762f0000 764f1000 C:\Windows\system32\iertutil.dll
ModLoad: 75a00000 75b40000 C:\Windows\system32\urlmon.dll
ModLoad: 75730000 7575f000 C:\Windows\system32\XmlLite.dll
ModLoad: 75be0000 75cd5000 C:\Windows\system32\WININET.dll
ModLoad: 75760000 757ef000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 754a0000 755c1000 C:\Windows\system32\CRYPT32.dll
ModLoad: 75490000 7549c000 C:\Windows\system32\MSASN1.dll
(32c.208): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=001bf990 edx=773671b4 esi=fffffffe edi=00000000
eip=773c09c6 esp=001bf9ac ebp=001bf9d8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
773c09c6 cc int 3
0:000> .lastevent
Last event: 32c.208: Break instruction exception - code 80000003 (first chance)
debugger time: Fri Sep 4 15:46:14.922 2015 (UTC - 7:00)
0:000> .childdbg 1
Processes created by the current process will be debugged
0:000> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
0:000> g
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
eax=013e1b0a ebx=7ffd5000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=77367198 esp=001afe44 ebp=00000000 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000200
77367198 89442404 mov dword ptr [esp+4],eax ss:0023:001afe48=00000000
1:012> .lastevent
Last event: ab4.ac4: Create process 1:ab4
debugger time: Fri Sep 4 15:46:16.200 2015 (UTC - 7:00)
1:012> .childdbg 1
Processes created by the current process will be debugged
1:012> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
1:012> g
Page heap: pid 0xAB4: page heap enabled with flags 0x3.
(ab4.ac4): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=001af95c edx=773671b4 esi=fffffffe edi=00000000
eip=773c09c6 esp=001af978 ebp=001af9a4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
773c09c6 cc int 3
1:012> .lastevent
Last event: ab4.ac4: Break instruction exception - code 80000003 (first chance)
debugger time: Fri Sep 4 15:46:16.220 2015 (UTC - 7:00)
1:012> !sym quiet
quiet mode - symbol prompts off
1:012> |.
. 1 id: ab4 child name: iexplore.exe
1:012> .exr -1
ExceptionAddress: 773c09c6 (ntdll!LdrpDoDebuggerBreak+0x0000002c)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 85726918
Parameter[2]: 773671b4
1:012> kn 0x32
# ChildEBP RetAddr
00 001af9a4 773a1180 ntdll!LdrpDoDebuggerBreak+0x2c
01 001afb04 7738638f ntdll!LdrpInitializeProcess+0x11a9
02 001afb54 77383921 ntdll!_LdrpInitialize+0x78
03 001afb64 00000000 ntdll!LdrInitializeThunk+0x10
1:012> lm on
start end module name
013e0000 01486000 iexplore iexplore.exe
6be30000 6be90000 verifier verifier.dll
75490000 7549c000 MSASN1 MSASN1.dll
754a0000 755c1000 CRYPT32 CRYPT32.dll
75690000 756db000 KERNELBASE KERNELBASE.dll
75730000 7575f000 XmlLite XmlLite.dll
75760000 757ef000 OLEAUT32 OLEAUT32.dll
757f0000 7589c000 msvcrt msvcrt.dll
758a0000 759fc000 ole32 ole32.dll
75a00000 75b40000 urlmon urlmon.dll
75b40000 75bdd000 USP10 USP10.dll
75be0000 75cd5000 WININET WININET.dll
75e00000 75e0a000 LPK LPK.dll
75e10000 75e5e000 GDI32 GDI32.dll
75f40000 75f97000 SHLWAPI SHLWAPI.dll
75fa0000 76042000 RPCRT4 RPCRT4.dll
76050000 76124000 kernel32 kernel32.dll
762f0000 764f1000 iertutil iertutil.dll
76550000 765f1000 ADVAPI32 ADVAPI32.dll
76600000 766c9000 USER32 USER32.dll
766d0000 7731b000 SHELL32 SHELL32.dll
77320000 77461000 ntdll ntdll.dll
77480000 77499000 sechost sechost.dll
1:012> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
1:012> g
(ab4.b8c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=09a15e64 ebx=04b7cf80 ecx=04b7ce50 edx=000000fc esi=04b7ce50 edi=09a15e64
eip=708b2701 esp=04b7ccb4 ebp=04b7cce4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
jscript!RegExpBase::FBadHeader+0x6:
708b2701 395004 cmp dword ptr [eax+4],edx ds:0023:09a15e68=????????
1:021> .lastevent
Last event: ab4.b8c: Access violation - code c0000005 (first chance)
debugger time: Fri Sep 4 15:46:19.279 2015 (UTC - 7:00)
1:021> !sym quiet
quiet mode - symbol prompts off
1:021> |.
. 1 id: ab4 child name: iexplore.exe
1:021> .exr -1
ExceptionAddress: 708b2701 (jscript!RegExpBase::FBadHeader+0x00000006)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 09a15e68
Attempt to read from address 09a15e68
1:021> kn 0x32
# ChildEBP RetAddr
00 04b7ccb4 708b25a7 jscript!RegExpBase::FBadHeader+0x6
01 04b7cce4 708bf7ec jscript!RegExpExec::Exec+0x3c
02 04b7cda0 708ce2ec jscript!RegExpExec::ReplaceUsingCallable+0x2b3
03 04b7cfd0 7089d5cb jscript!RegExpObj::Exec+0xaae
04 04b7d0d4 708a594a jscript!JsStrReplace+0x1e8
05 04b7d13c 708a5820 jscript!NatFncObj::Call+0x106
06 04b7d1c0 708a4f34 jscript!NameTbl::InvokeInternal+0x2b4
07 04b7d1f4 708af2cb jscript!VAR::InvokeByDispID+0x17f
08 04b7d234 708adccb jscript!VAR::InvokeJSObj<SYM *>+0xb8
09 04b7d270 708ad978 jscript!VAR::InvokeByName+0x174
0a 04b7d2bc 708ada1f jscript!VAR::InvokeDispName+0x7d
0b 04b7d2e8 708ae497 jscript!VAR::InvokeByDispID+0xce
0c 04b7d484 708a5d1f jscript!CScriptRuntime::Run+0x2b80
0d 04b7d56c 708a5c7d jscript!ScrFncObj::CallWithFrameOnStack+0xce
0e 04b7d5b4 708a5e93 jscript!ScrFncObj::Call+0x8d
0f 04b7d630 708a61b2 jscript!CSession::Execute+0x15f
10 04b7d67c 708ac389 jscript!COleScript::ExecutePendingScripts+0x1bd
11 04b7d6e0 708ac1a1 jscript!COleScript::ParseScriptTextCore+0x2a4
12 04b7d708 6f31c2fb jscript!COleScript::ParseScriptText+0x30
13 04b7d768 6f31c601 mshtml!CScriptCollection::ParseScriptText+0x231
14 04b7d82c 6f31c3d1 mshtml!CScriptElement::CommitCode+0x3c2
15 04b7d860 6f300373 mshtml!CScriptElement::Execute+0xd7
16 04b7d8ac 6f2f9836 mshtml!CHtmParse::Execute+0x4a
17 04b7d8c4 6f2fa396 mshtml!CHtmPost::Broadcast+0xf
18 04b7d984 6f2fbeec mshtml!CHtmPost::Exec+0x618
19 04b7d99c 6f2fbe50 mshtml!CHtmPost::Run+0x15
1a 04b7d9bc 6f2fbdb5 mshtml!PostManExecute+0x1fb
1b 04b7d9d8 6f30035f mshtml!PostManResume+0xf7
1c 04b7d9e8 6f2f93b2 mshtml!CHtmPost::OnDwnChanCallback+0x10
1d 04b7d9f8 6f2f8239 mshtml!CDwnChan::OnMethodCall+0x19
1e 04b7da34 6f34b1f8 mshtml!GlobalWndOnMethodCall+0x108
1f 04b7da54 7661c4e7 mshtml!GlobalWndProc+0x111
20 04b7da80 7661c5e7 USER32!InternalCallWinProc+0x23
21 04b7daf8 7661cc19 USER32!UserCallWinProcCheckWow+0x14b
22 04b7db58 7661cc70 USER32!DispatchMessageWorker+0x35e
23 04b7db68 6e7c38fc USER32!DispatchMessageW+0xf
24 04b7fc78 6e7d3c1a IEFRAME!CTabWindow::_TabWindowThreadProc+0x54b
25 04b7fd30 7645a523 IEFRAME!LCIETab_ThreadProc+0x2c1
26 04b7fd40 7609ee6c iertutil!CIsoScope::RegisterThread+0xab
27 04b7fd4c 77383ab3 kernel32!BaseThreadInitThunk+0xe
28 04b7fd8c 77383a86 ntdll!__RtlUserThreadStart+0x70
29 04b7fda4 00000000 ntdll!_RtlUserThreadStart+0x1b
1:021> lm on
start end module name
013e0000 01486000 iexplore iexplore.exe
6bc60000 6bccf000 ieapfltr ieapfltr.dll
6bd70000 6bda6000 IEShims IEShims.dll
6bdb0000 6bddb000 ieproxy ieproxy.dll
6be30000 6be90000 verifier verifier.dll
6e6f0000 6f179000 IEFRAME IEFRAME.dll
6f180000 6f745000 mshtml mshtml.dll
70550000 70558000 winrnr winrnr.dll
70890000 70942000 jscript jscript.dll
714e0000 714f2000 pnrpnsp pnrpnsp.dll
71520000 71530000 napinsp napinsp.dll
71530000 71536000 rasadhlp rasadhlp.dll
71620000 7164e000 MLANG MLANG.dll
71740000 7176a000 msls31 msls31.dll
719d0000 71a0c000 OLEACC OLEACC.dll
72a20000 72a34000 MSACM32 MSACM32.dll
72a40000 72a72000 WINMM WINMM.dll
72e20000 72f54000 msxml3 msxml3.dll
73510000 73548000 fwpuclnt fwpuclnt.dll
735a0000 735a7000 WINNSI WINNSI.DLL
735e0000 735fc000 iphlpapi iphlpapi.DLL
73640000 7364b000 msimtf msimtf.dll
737d0000 737da000 slc slc.dll
73820000 7382f000 wkscli wkscli.dll
73840000 73849000 netutils netutils.dll
73b20000 73b45000 rdpendp rdpendp.dll
73b50000 73b56000 sensapi sensapi.dll
73b70000 73b85000 rasman rasman.dll
73b90000 73be2000 RASAPI32 RASAPI32.dll
73d60000 73d70000 NLAapi NLAapi.dll
73dc0000 73dcd000 WTSAPI32 WTSAPI32.dll
73e00000 73e39000 MMDevAPI MMDevAPI.DLL
73ec0000 73ecd000 rtutils rtutils.dll
73f50000 73f63000 DWMAPI DWMAPI.DLL
74230000 74325000 propsys propsys.dll
74480000 744a1000 ntmarta ntmarta.dll
744b0000 7464e000 comctl32 comctl32.dll
747d0000 74810000 UxTheme UxTheme.dll
74910000 74919000 VERSION VERSION.dll
749a0000 749a5000 wshtcpip wshtcpip.dll
74b70000 74bad000 bcryptprimitives bcryptprimitives.dll
74c30000 74c6b000 rsaenh rsaenh.dll
74d10000 74d54000 dnsapi dnsapi.DLL
74e40000 74e46000 wship6 wship6.dll
74e50000 74e8c000 mswsock mswsock.dll
74e90000 74ea7000 CRYPTSP CRYPTSP.dll
74fa0000 74fb7000 bcrypt bcrypt.dll
751b0000 751b8000 Secur32 Secur32.dll
75300000 7531b000 SspiCli SspiCli.dll
75320000 7536c000 apphelp apphelp.dll
75370000 7537c000 CRYPTBASE CRYPTBASE.DLL
75380000 753df000 SXS SXS.DLL
753e0000 75409000 WINSTA WINSTA.dll
75410000 7541e000 RpcRtRemote RpcRtRemote.dll
75420000 7542b000 profapi profapi.dll
75490000 7549c000 MSASN1 MSASN1.dll
754a0000 755c1000 CRYPT32 CRYPT32.dll
75690000 756db000 KERNELBASE KERNELBASE.dll
756e0000 756f2000 DEVOBJ DEVOBJ.dll
75700000 75727000 CFGMGR32 CFGMGR32.dll
75730000 7575f000 XmlLite XmlLite.dll
75760000 757ef000 OLEAUT32 OLEAUT32.dll
757f0000 7589c000 msvcrt msvcrt.dll
758a0000 759fc000 ole32 ole32.dll
75a00000 75b40000 urlmon urlmon.dll
75b40000 75bdd000 USP10 USP10.dll
75be0000 75cd5000 WININET WININET.dll
75ce0000 75d15000 ws2_32 ws2_32.DLL
75d20000 75d25000 PSAPI PSAPI.DLL
75d30000 75dfc000 MSCTF MSCTF.dll
75e00000 75e0a000 LPK LPK.dll
75e10000 75e5e000 GDI32 GDI32.dll
75e60000 75edb000 comdlg32 comdlg32.dll
75f40000 75f97000 SHLWAPI SHLWAPI.dll
75fa0000 76042000 RPCRT4 RPCRT4.dll
76050000 76124000 kernel32 kernel32.dll
76130000 7614f000 IMM32 IMM32.DLL
76150000 762ed000 SETUPAPI SETUPAPI.dll
762f0000 764f1000 iertutil iertutil.dll
76500000 76545000 WLDAP32 WLDAP32.dll
76550000 765f1000 ADVAPI32 ADVAPI32.dll
76600000 766c9000 USER32 USER32.dll
766d0000 7731b000 SHELL32 SHELL32.dll
77320000 77461000 ntdll ntdll.dll
77470000 77473000 Normaliz Normaliz.dll
77480000 77499000 sechost sechost.dll
774d0000 77553000 CLBCatQ CLBCatQ.DLL
77560000 77566000 NSI NSI.dll
1:021> !heap -p -a 0x9A15E68
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_UNCOMMMTTED_RANGE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_UNCOMMMTTED_RANGE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_SEGMENT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_SEGMENT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_LOOKASIDE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_LOOKASIDE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_VIRTUAL_ALLOC_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_VIRTUAL_ALLOC_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_ENTRY_EXTRA ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_ENTRY_EXTRA ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_RTL_PROCESS_MODULE_INFORMATION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_RTL_PROCESS_MODULE_INFORMATION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_STACK_TRACE_DATABASE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_STACK_TRACE_DATABASE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_HEAP_ROOT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_HEAP_ROOT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_HEAP_BLOCK ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_HEAP_BLOCK ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_BLOCK_INFORMATION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_DPH_BLOCK_INFORMATION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_RTL_STACK_TRACE_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_RTL_STACK_TRACE_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_LFH_HEAP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_LFH_HEAP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_LFH_BLOCK_ZONE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_LFH_BLOCK_ZONE ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_SUBSEGMENT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_SUBSEGMENT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_USERDATA_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_USERDATA_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_UCR_DESCRIPTOR ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_UCR_DESCRIPTOR ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_STACK_TRACE_LOG_ENTRY ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_HEAP_STACK_TRACE_LOG_ENTRY ***
*** ***
*************************************************************************
address 09a15e68 found in
_DPH_HEAP_ROOT @ 11b1000
in free-ed allocation ( DPH_HEAP_BLOCK: VirtAddr VirtSize)
99f1b2c: 9a15000 2000
6be390b2 verifier!AVrfDebugPageHeapFree+0x000000c2
773e6dbc ntdll!RtlDebugFreeHeap+0x0000002f
773aa4c7 ntdll!RtlpFreeHeap+0x0000005d
77376896 ntdll!RtlFreeHeap+0x00000142
758f6e6a ole32!CRetailMalloc_Free+0x0000001c
7576449b OLEAUT32!APP_DATA::FreeCachedMem+0x000000c1
75763ea3 OLEAUT32!SysFreeString+0x0000006b
75764870 OLEAUT32!VariantClear+0x000000c3
6e7ecd03 IEFRAME!Detour_VariantClear+0x0000002f
708b72e5 jscript!VAR::Clear+0x0000009c
708b6fb6 jscript!GcContext::Reclaim+0x000000b6
708b44ca jscript!GcContext::CollectCore+0x00000133
708b4cc2 jscript!CScriptRuntime::Run+0x000039dc
708a5d1f jscript!ScrFncObj::CallWithFrameOnStack+0x000000ce
708a5c7d jscript!ScrFncObj::Call+0x0000008d
708bf66b jscript!RegExpExec::CallEntryPoint+0x00000022
708bf747 jscript!RegExpExec::ReplaceUsingCallable+0x00000214
708ce2ec jscript!RegExpObj::Exec+0x00000aae
7089d5cb jscript!JsStrReplace+0x000001e8
708a594a jscript!NatFncObj::Call+0x00000106
708a5820 jscript!NameTbl::InvokeInternal+0x000002b4
708a4f34 jscript!VAR::InvokeByDispID+0x0000017f
708af2cb jscript!VAR::InvokeJSObj<SYM *>+0x000000b8
708adccb jscript!VAR::InvokeByName+0x00000174
708ad978 jscript!VAR::InvokeDispName+0x0000007d
708ada1f jscript!VAR::InvokeByDispID+0x000000ce
708ae497 jscript!CScriptRuntime::Run+0x00002b80
708a5d1f jscript!ScrFncObj::CallWithFrameOnStack+0x000000ce
708a5c7d jscript!ScrFncObj::Call+0x0000008d
708a5e93 jscript!CSession::Execute+0x0000015f
708a61b2 jscript!COleScript::ExecutePendingScripts+0x000001bd
708ac389 jscript!COleScript::ParseScriptTextCore+0x000002a4
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_STACK_TRACE_DATABASE ***
*** ***
*************************************************************************
1:021> lm M *iexplore.exe
start end module name
013e0000 01486000 iexplore (deferred)
1:021> lmv m *iexplore
start end module name
013e0000 01486000 iexplore (deferred)
Image path: iexplore.exe
Image name: iexplore.exe
Timestamp: Thu Jul 16 09:55:30 2015 (55A7E202)
CheckSum: 000A9DD0
ImageSize: 000A6000
File version: 8.0.7601.18934
Product version: 8.0.7601.18934
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Windows� Internet Explorer
InternalName: iexplore
OriginalFilename: IEXPLORE.EXE
ProductVersion: 8.00.7601.18934
FileVersion: 8.00.7601.18934 (win7sp1_gdr.150716-0600)
FileDescription: Internet Explorer
LegalCopyright: � Microsoft Corporation. All rights reserved.
1:021> lmv m *jscript
start end module name
70890000 70942000 jscript (pdb symbols) c:\symbols\jscript.pdb\58109943E5154F55AFC6AB3B329A28132\jscript.pdb
Loaded symbol image file: C:\Windows\System32\jscript.dll
Image path: C:\Windows\System32\jscript.dll
Image name: jscript.dll
Timestamp: Thu Jul 16 12:04:48 2015 (55A80050)
CheckSum: 000B9049
ImageSize: 000B2000
File version: 5.8.7601.18934
Product version: 5.8.7601.18934
File flags: 0 (Mask 3)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft � JScript
InternalName: jscript.dll
OriginalFilename: jscript.dll
ProductVersion: 5.8.7601.18934
FileVersion: 5.8.7601.18934
FileDescription: Microsoft � JScript
LegalCopyright: � Microsoft Corporation. All rights reserved.
1:021>