{"id":91711,"date":"2015-08-28T07:00:00","date_gmt":"2015-08-28T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/20150828-00\/?p=91711\/"},"modified":"2019-03-13T12:18:57","modified_gmt":"2019-03-13T19:18:57","slug":"20150828-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20150828-00\/?p=91711","title":{"rendered":"Debugging walkthrough: Access violation on nonsense instruction, episode 3"},"content":{"rendered":"<p>A colleague of mine asked for help debugging a strange failure. Execution halted on what appeared to be a nonsense instruction. <!--more--><\/p>\n<pre>\neax=022b13a0 ebx=00000000 ecx=02570df4 edx=769f4544 esi=02570dec edi=05579748\neip=76c49131 esp=05cce038 ebp=05cce07c iopl=0         nv up ei pl nz na po nc\ncs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202\nKERNELBASE!GetFileAttributesExW+0x2:\n76c49131 ec              in      al,dx\n<\/pre>\n<p>This is clearly an invalid instruction. But observe that the offset is +2, which is normally the start of the function, because the first two bytes of Windows operating system functions are <a HREF=\"http:\/\/blogs.msdn.com\/b\/oldnewthing\/archive\/2011\/09\/21\/10214405.aspx\">a <code>mov edi, edi<\/code> instruction<\/a>. Therefore, the function is corrupted. Lets look back two bytes to see if it gives any clues. <\/p>\n<pre>\n0:006&gt; u 76c49131-2\nKERNELBASE!GetFileAttributesExW:\n76c4912f e95aecebf3      jmp     IoLog!Mine_GetFileAttributesExW (6ab07d8e)\n<\/pre>\n<p>Oh look, somebody is doing API patching (already unsupported) and they did a bad job. They tried to patch code while a thread was in the middle of executing it, resulting in a garbage instruction. <\/p>\n<p>This is a bug in IoLog. The great thing about API patching is that when you screw up, it looks like an OS bug. That way, nobody ever files bugs against you! <\/p>\n<p>(In this case, IoLog is a diagnostic tool which is logging file I\/O performed by an application which is being instrumented.) <\/p>\n<p>My colleague replied, &#8220;Thanks. Looks like a missing lock in IoLog. It doesn&#8217;t surprise me that API patching isn&#8217;t supported&#8230;&#8221; <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ow, that patch hurts.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-91711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>Ow, that patch hurts.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=91711"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91711\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=91711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=91711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=91711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}