0:005> ~0kb
ChildEBP RetAddr Args to Child
0012e924 7739bf53 7739610a 00000000 00000000 ntdll!KiFastSystemCallRet
0012e95c 7738965e 094700da 00000000 00000001 USER32!NtUserWaitMessage+0xc
0012e984 7739f762 77380000 001959b8 00000000 USER32!InternalDialogBox+0xd0
0012ec44 7739f047 0012eda0 00000000 ffffffff USER32!SoftModalMessageBox+0x94b
0012ed94 7739eec9 0012eda0 00000028 00000000 USER32!MessageBoxWorker+0x2ba
0012edec 773d7d0d 00000000 0017d938 00194e08 USER32!MessageBoxTimeoutW+0x7a
0012ee20 773c42c8 00000000 01d74e90 01d74e28 USER32!MessageBoxTimeoutA+0x9c
0012ee40 773c42a4 00000000 01d74e90 01d74e28 USER32!MessageBoxExA+0x1b
[...]
Dump ASCII contents:
0:005> da 01d74e90
01d74e90 "File does not exist:.C:\TEMP\FO"
01d74eb0 "LDER\DATA\FILE.DAT"
No comments:
Post a Comment