I am currently studying a Windows crash dump, and the Visual Studio debugger shows me an “illegal instruction 0xC000001D” when opening a dump file. The code position displaying this error shows a disassembly in the following example:
void g(int x) {
00401E80 push ebp
00401E81 mov ebp,esp
if(x > 20) {
00401E83 cmp dword ptr [x],14h
00401E87 jle g+14h (401E94h)
x *= 4;
>00401E89 db 0fh // illegal instruction here
00401E8A db 0fh
00401E8B xadd eax,esp
00401E8E add cl,byte ptr [ecx+9EB0845h]
x += 42;
00401E94 mov ecx,dword ptr [x]
...
I manually created the above example in the debugger, overwriting the function code with some invalid values in the debugger memory window, but the crash dump that I checked shows the same record db 0fh, apparently indicating an invalid instruction. The code is also similar to what my dump file shows, since the instructions before the invalid instruction seem valid and correspond to the source code.
++- - (Visual ++ 2005 Windows XP), ?
, , .
{
void* fnAddr = &g;
unsigned int x = 0xDEADBEEF;
memcpy((char*)fnAddr+4, &x, sizeof(x));
g(42);
}
- , - ?
, , , - .., , , , , , - , , .