> The kernel crashes in lseek() , if that is what you are asking. i am asking not exactly for that. i would like to find out what call sequence was made in the wine thread that caused crash at point of making fatal call to system (call to kernel or glibc, maybe). and seems i can easily find that out using +relay. dumb me! > I would check memory and other hardware first. i would do the same, but it seems rather strange - i haven't changed neither software, nor hardware setup of my box. maybe my box was hacked and my kernel was patched? so, attaching the relay-log in a case someone is interested. i see wv97 installer is checking all drives for files "wordview.exe" and as my / is mapped by default to Z: installer looks also into Z:\dev\shm\ dir too. here we are getting crash with ntdll.NtQueryDirectoryFile(). i have never had this before while installing same app many times. eghm, how should i investigate into this further?
0009:Call kernel32.lstrlenA(4073f778 "sdz8") ret=1000e7fe 0009:Ret kernel32.lstrlenA() retval=00000004 ret=1000e7fe 0009:Call kernel32.lstrcatA(4073f9dc "Z:\\dev\\",4073f778 "sdz8") ret=1000e813 0009:Ret kernel32.lstrcatA() retval=4073f9dc ret=1000e813 0009:Call kernel32.FindNextFileA(40267040,4073f604) ret=10020ceb 0009:Ret kernel32.FindNextFileA() retval=00000001 ret=10020ceb 0009:Call kernel32.FileTimeToLocalFileTime(4073f608,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=0000001f ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f610,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=0000001f ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f618,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=0000001f ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.lstrlenA(4073f778 "sdz9") ret=1000e7fe 0009:Ret kernel32.lstrlenA() retval=00000004 ret=1000e7fe 0009:Call kernel32.lstrcatA(4073f9dc "Z:\\dev\\",4073f778 "sdz9") ret=1000e813 0009:Ret kernel32.lstrcatA() retval=4073f9dc ret=1000e813 0009:Call kernel32.FindNextFileA(40267040,4073f604) ret=10020ceb 0009:Ret kernel32.FindNextFileA() retval=00000001 ret=10020ceb 0009:Call kernel32.FileTimeToLocalFileTime(4073f608,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f610,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f618,4073f5e4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f510,4073f508) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f5e4,4073f5d4) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f504,4073f50c) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.lstrlenA(4073f778 "shm") ret=1000e7fe 0009:Ret kernel32.lstrlenA() retval=00000003 ret=1000e7fe 0009:Call kernel32.lstrcatA(4073f9dc "Z:\\dev\\",4073f778 "shm") ret=1000e813 0009:Ret kernel32.lstrcatA() retval=4073f9dc ret=1000e813 0009:Call user32.CharNextA(4073f9df "dev\\shm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e0 ret=10016702 0009:Call user32.CharNextA(4073f9e0 "ev\\shm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e1 ret=10016702 0009:Call user32.CharNextA(4073f9e1 "v\\shm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e2 ret=10016702 0009:Call user32.CharPrevA(4073f9dc "Z:\\dev\\shm",4073f9e2 "\\shm") ret=10016699 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharPrevA() retval=4073f9e1 ret=10016699 0009:Call user32.CharPrevA(4073f9dc "Z:\\dev\\shm",4073f9e2 "\\shm") ret=100166aa 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharPrevA() retval=4073f9e1 ret=100166aa 0009:Call user32.CharNextA(4073f9e2 "\\shm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e3 ret=10016702 0009:Call user32.CharNextA(4073f9e3 "shm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(00000073) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e4 ret=10016702 0009:Call user32.CharNextA(4073f9e4 "hm") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(00000068) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e5 ret=10016702 0009:Call user32.CharNextA(4073f9e5 "m") ret=10016702 0009:Call kernel32.IsDBCSLeadByte(0000006d) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e6 ret=10016702 0009:Call user32.CharPrevA(4073f9dc "Z:\\dev\\shm",4073f9e6 "") ret=10016728 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000073) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000068) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000006d) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharPrevA() retval=4073f9e5 ret=10016728 0009:Call user32.CharPrevA(4073f9dc "Z:\\dev\\shm",4073f9e6 "") ret=10016735 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000073) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(00000068) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Call kernel32.IsDBCSLeadByte(0000006d) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharPrevA() retval=4073f9e5 ret=10016735 0009:Call kernel32.lstrlenA(4073f9dc "Z:\\dev\\shm") ret=1000e741 0009:Ret kernel32.lstrlenA() retval=0000000a ret=1000e741 0009:Call user32.CharNextA(4073f9dc "Z:\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9dd ret=1001b138 0009:Call user32.CharNextA(4073f9dd ":\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9de ret=1001b138 0009:Call user32.CharNextA(4073f9de "\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9df ret=1001b138 0009:Call user32.CharNextA(4073f9df "dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e0 ret=1001b138 0009:Call user32.CharNextA(4073f9e0 "ev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e1 ret=1001b138 0009:Call user32.CharNextA(4073f9e1 "v\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e2 ret=1001b138 0009:Call user32.CharNextA(4073f9e2 "\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e3 ret=1001b138 0009:Call user32.CharNextA(4073f9e3 "shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000073) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e4 ret=1001b138 0009:Call user32.CharNextA(4073f9e4 "hm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000068) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e5 ret=1001b138 0009:Call user32.CharNextA(4073f9e5 "m") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000006d) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e6 ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(4073f96d) ret=100168df 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=100168df 0009:Call kernel32.lstrlenA(40256278 "wordview.exe") ret=100168fa 0009:Ret kernel32.lstrlenA() retval=0000000c ret=100168fa 0009:Call kernel32.lstrlenA(4073f9dc "Z:\\dev\\shm") ret=100168ff 0009:Ret kernel32.lstrlenA() retval=0000000a ret=100168ff 0009:Call kernel32.lstrcpyA(4025ec70,4073f9dc "Z:\\dev\\shm") ret=10016919 0009:Ret kernel32.lstrcpyA() retval=4025ec70 ret=10016919 0009:Call kernel32.lstrcatA(4025ec70 "Z:\\dev\\shm",10034924 "\\") ret=1001692f 0009:Ret kernel32.lstrcatA() retval=4025ec70 ret=1001692f 0009:Call kernel32.lstrcatA(4025ec70 "Z:\\dev\\shm\\",40256278 "wordview.exe") ret=10016943 0009:Ret kernel32.lstrcatA() retval=4025ec70 ret=10016943 0009:Call kernel32.GetLogicalDrives() ret=1002087e 0009:Ret kernel32.GetLogicalDrives() retval=0200003c ret=1002087e 0009:Call kernel32.SetErrorMode(00000001) ret=1000db47 0009:Ret kernel32.SetErrorMode() retval=00000000 ret=1000db47 0009:Call kernel32.GetFileAttributesA(4073f9dc "Z:\\dev\\shm\\wordview.exe") ret=1000db50 0009:Call ntdll.RtlCreateUnicodeStringFromAsciiz(4073f540,4073f9dc "Z:\\dev\\shm\\wordview.exe") ret=4036383f 0009:Ret ntdll.RtlCreateUnicodeStringFromAsciiz() retval=00000001 ret=4036383f 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,0000020c) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40263b08 ret=4038068e 0009:Call ntdll.RtlFreeHeap(40210000,00000000,40263b08) ret=403806b6 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=403806b6 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,0000020c) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40263b08 ret=4038068e 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263b08,0000040c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263b08 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263b08,0000080c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263b08 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263b08,0000100c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263b08 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263b08,0000200c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40269078 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40269078,0000400c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40269078 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40269078,0000800c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40269078 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40269078,0001000c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40269078 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40269078,0002000c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40269078 ret=403806e1 0009:Call ntdll.RtlFreeHeap(40210000,00000000,40269078) ret=403806b6 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=403806b6 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,0000020c) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40263b08 ret=4038068e 0009:Call ntdll.RtlFreeHeap(40210000,00000000,40263b08) ret=403806b6 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=403806b6 0009:Call ntdll.RtlFreeUnicodeString(4073f540) ret=4036386c 0009:Ret ntdll.RtlFreeUnicodeString() retval=00000001 ret=4036386c 0009:Ret kernel32.GetFileAttributesA() retval=ffffffff ret=1000db50 0009:Call kernel32.SetErrorMode(00000000) ret=1000db55 0009:Ret kernel32.SetErrorMode() retval=00000001 ret=1000db55 0009:Call user32.CharNextA(4073f9dc "Z:\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9dd ret=1001b138 0009:Call user32.CharNextA(4073f9dd ":\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000003a) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9de ret=1001b138 0009:Call user32.CharNextA(4073f9de "\\dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9df ret=1001b138 0009:Call user32.CharNextA(4073f9df "dev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000064) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e0 ret=1001b138 0009:Call user32.CharNextA(4073f9e0 "ev\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000065) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e1 ret=1001b138 0009:Call user32.CharNextA(4073f9e1 "v\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000076) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e2 ret=1001b138 0009:Call user32.CharNextA(4073f9e2 "\\shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000005c) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e3 ret=1001b138 0009:Call user32.CharNextA(4073f9e3 "shm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000073) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e4 ret=1001b138 0009:Call user32.CharNextA(4073f9e4 "hm") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(00000068) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e5 ret=1001b138 0009:Call user32.CharNextA(4073f9e5 "m") ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(0000006d) ret=4080b5b5 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=4080b5b5 0009:Ret user32.CharNextA() retval=4073f9e6 ret=1001b138 0009:Call kernel32.IsDBCSLeadByte(4073f96d) ret=100168df 0009:Ret kernel32.IsDBCSLeadByte() retval=00000000 ret=100168df 0009:Call kernel32.lstrlenA(10034bd8 "xxx") ret=100168fa 0009:Ret kernel32.lstrlenA() retval=00000003 ret=100168fa 0009:Call kernel32.lstrlenA(4073f9dc "Z:\\dev\\shm") ret=100168ff 0009:Ret kernel32.lstrlenA() retval=0000000a ret=100168ff 0009:Call kernel32.lstrcpyA(4025ec70,4073f9dc "Z:\\dev\\shm") ret=10016919 0009:Ret kernel32.lstrcpyA() retval=4025ec70 ret=10016919 0009:Call kernel32.lstrcatA(4025ec70 "Z:\\dev\\shm",10034924 "\\") ret=1001692f 0009:Ret kernel32.lstrcatA() retval=4025ec70 ret=1001692f 0009:Call kernel32.lstrcatA(4025ec70 "Z:\\dev\\shm\\",10034bd8 "xxx") ret=10016943 0009:Ret kernel32.lstrcatA() retval=4025ec70 ret=10016943 0009:Call kernel32.GetLogicalDrives() ret=1002087e 0009:Ret kernel32.GetLogicalDrives() retval=0200003c ret=1002087e 0009:Call kernel32.lstrlenA(4073f9dc "Z:\\dev\\shm\\xxx") ret=1000e7b4 0009:Ret kernel32.lstrlenA() retval=0000000e ret=1000e7b4 0009:Call kernel32.lstrlenA(10034bd4 "*.*") ret=1000e7c1 0009:Ret kernel32.lstrlenA() retval=00000003 ret=1000e7c1 0009:Call kernel32.lstrcatA(4073f9dc "Z:\\dev\\shm\\",10034bd4 "*.*") ret=1000e7d3 0009:Ret kernel32.lstrcatA() retval=4073f9dc ret=1000e7d3 0009:Call kernel32.FindFirstFileA(4073f9dc "Z:\\dev\\shm\\*.*",4073f4c4) ret=10020bf0 0009:Call ntdll.RtlCreateUnicodeStringFromAsciiz(4073f180,4073f9dc "Z:\\dev\\shm\\*.*") ret=4037c7ab 0009:Ret ntdll.RtlCreateUnicodeStringFromAsciiz() retval=00000001 ret=4037c7ab 0009:Call ntdll.RtlGetFullPathName_U(40263ad0 L"Z:\\dev\\shm\\*.*",00000208,4073ef40,4073ef3c) ret=4037c1de 0009:Ret ntdll.RtlGetFullPathName_U() retval=0000001c ret=4037c1de 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,00002030) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40269078 ret=4038068e 0009:Call ntdll.RtlCreateUnicodeString(40269094,4073ef56 L"*.*") ret=4037c290 0009:Ret ntdll.RtlCreateUnicodeString() retval=00000001 ret=4037c290 0009:Call ntdll.RtlIsDosDeviceName_U(4073ef40 L"Z:\\dev\\shm\\") ret=40363146 0009:Ret ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=40363146 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,0000020c) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40263af8 ret=4038068e 0009:Call ntdll.RtlFreeHeap(40210000,00000000,40263af8) ret=403806b6 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=403806b6 0009:Call ntdll.RtlAllocateHeap(40210000,00000000,0000020c) ret=4038068e 0009:Ret ntdll.RtlAllocateHeap() retval=40263af8 ret=4038068e 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263af8,0000040c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263af8 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263af8,0000080c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263af8 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263af8,0000100c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=40263af8 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,40263af8,0000200c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=4026b0b0 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,4026b0b0,0000400c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=4026b0b0 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,4026b0b0,0000800c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=4026b0b0 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,4026b0b0,0001000c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=4026b0b0 ret=403806e1 0009:Call ntdll.RtlReAllocateHeap(40210000,00000000,4026b0b0,0002000c) ret=403806e1 0009:Ret ntdll.RtlReAllocateHeap() retval=4026b0b0 ret=403806e1 0009:Call ntdll.RtlFreeHeap(40210000,00000000,4026b0b0) ret=403806b6 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=403806b6 0009:Call ntdll.RtlInitializeCriticalSection(4026907c) ret=4037c2fd 0009:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=4037c2fd 0009:Call ntdll.NtQueryDirectoryFile(00000058,00000000,00000000,00000000,4073ef0c,402690a8,00002000,00000003,00000000,40269094,00000000) ret=4037c5b8 0009:Ret ntdll.NtQueryDirectoryFile() retval=00000000 ret=4037c5b8 0009:Call ntdll.RtlFreeUnicodeString(4073f180) ret=4037c7f6 0009:Ret ntdll.RtlFreeUnicodeString() retval=00000001 ret=4037c7f6 0009:Ret kernel32.FindFirstFileA() retval=40269078 ret=10020bf0 0009:Call kernel32.FileTimeToLocalFileTime(4073f4c8,4073f4a4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d0,4073f3c8) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a4,4073f494) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c4,4073f3cc) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f4d0,4073f4a4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d0,4073f3c8) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a4,4073f494) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c4,4073f3cc) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f4d8,4073f4a4) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d0,4073f3c8) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a4,4073f494) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c4,4073f3cc) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FindNextFileA(40269078,4073f4c8) ret=10020ceb 0009:Ret kernel32.FindNextFileA() retval=00000001 ret=10020ceb 0009:Call kernel32.FileTimeToLocalFileTime(4073f4cc,4073f4a8) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d4,4073f3cc) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a8,4073f498) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c8,4073f3d0) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f4d4,4073f4a8) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d4,4073f3cc) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a8,4073f498) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c8,4073f3d0) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FileTimeToLocalFileTime(4073f4dc,4073f4a8) ret=10020e08 0009:Call ntdll.RtlSystemTimeToLocalTime(4073f3d4,4073f3cc) ret=403b012f 0009:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=403b012f 0009:Ret kernel32.FileTimeToLocalFileTime() retval=00000001 ret=10020e08 0009:Call kernel32.FileTimeToSystemTime(4073f4a8,4073f498) ret=10020e1a 0009:Call ntdll.RtlTimeToTimeFields(4073f3c8,4073f3d0) ret=403b0196 0009:Ret ntdll.RtlTimeToTimeFields() retval=00000001 ret=403b0196 0009:Ret kernel32.FileTimeToSystemTime() retval=00000001 ret=10020e1a 0009:Call kernel32.FindNextFileA(40269078,4073f4c8) ret=10020ceb 0009:Call ntdll.NtQueryDirectoryFile(00000058,00000000,00000000,00000000,4073f190,402690a8,00002000,00000003,00000000,40269094,00000000) ret=4037c5b8 Segmentation fault
