search for: virtual_setprot

Interesting. In my app, the first exception appears to occur because the app tries to read memory at 0x456010 from a segment that had been declared c---- by a previous call to VIRTUAL_VirtProt. Pavel, I'm willing to bet your error is the same. So what gives? --Rob

Oh, I think I see now. There was a call to VIRTUAL_SetProt, which protected memory mapped regions of memory, before the first exception: 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c---- 0x459000 - 0x459fff c-r-- 0x45a000 - 0x758fff c...

...100 ret=051f:0d39 ds=02a7 0820ac28:trace:global:GlobalHandle16 0137 0820ac28:Call KERNEL.15: GLOBALALLOC(0002,00009100) ret=05ef:004f ds=02a7 0820ac28:trace:global:GLOBAL_Alloc 37120 flags=0002 0820ac28:trace:virtual:NtAllocateVirtualMemory 0x41120000 00010000 1000 00000040 0820ac28:trace:virtual:VIRTUAL_SetProt 0x41120000-0x4112ffff c-rWx View: 0x410f0000 - 0x411fffff (valloc) 0x410f0000 - 0x4112ffff c-rWx 0x41130000 - 0x411fffff ----- 0820ac28:trace:global:GlobalHandle16 0137 0820ac28:Ret KERNEL.15: GLOBALALLOC() retval=083e ret=05ef:004f ds=02a7 0820ac28:trace:global:GlobalHandle16 0137 082...

...s:.shrink1 00456000 ;org 456000h In addition, the trace of the last call to VirtualProtect shows this: 0806d398:Call kernel32.VirtualProtect(00459000,00000018,00000002,40616e74) ret=0075fd82 0806d398:trace:virtual:VirtualProtect 0x459000 00000018 00000002 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c---- <-- here is where the read is 0x459000 - 0x459fff c-r-- 0x45a000 - 0x758fff c---- 0x759000 - 0x765fff c-rw- 0806d398:Ret kernel32.VirtualProtect() retval...

...aafff (anonymous) 0x550a9000 - 0x550aafff c-rwx 0009:trace:virtual:NtAllocateVirtualMemory (nil) 00110000 2000 00000040 View: 0x551d0000 - 0x552dffff (anonymous) 0x551d0000 - 0x552dffff --rwx 0009:trace:virtual:NtAllocateVirtualMemory 0x551d0000 00010000 1000 00000040 0009:trace:virtual:VIRTUAL_SetProt 0x551d0000-0x551dffff c-rwx View: 0x551d0000 - 0x552dffff (valloc) 0x551d0000 - 0x551dffff c-rwx 0x551e0000 - 0x552dffff --rwx 0009:trace:heap:RtlAllocateHeap (0x551d0000,00000002,00000018): returning 551d0098 0009:trace:heap:RtlAllocateHeap (0x551d0000,00000002,00000050): returning 551...

.... If I search for queue_exception, I find that there is an exception raised before the LoadOEMCall, about 328klines in: 0806d398:Call kernel32.VirtualProtect(00459000,00000018,00000002,40616e74) ret=0075fd82 0806d398:trace:virtual:VirtualProtect 0x459000 00000018 00000002 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c---- 0x459000 - 0x459fff c-r-- 0x45a000 - 0x758fff c---- 0x759000 - 0x765fff c-rw- 0806d398:Ret kernel32.VirtualProtect() retval=00000001 ret=0075fd82 0806d398:tra...

...89 0009:Call kernel32.VirtualAlloc(046e0000,00004000,00001000,00000004) ret=0a93769a 0009:Call ntdll.NtAllocateVirtualMemory(ffffffff,007ffbc0,00000000,007ffbd8,00001000,00000004) ret=7eead507 0009:trace:virtual:NtAllocateVirtualMemory 0xffffffff 0x46e0000 00004000 1000 00000004 0009:trace:virtual:VIRTUAL_SetProt 0x46e0000-0x46e3fff c-rw- 0009:trace:virtual:VIRTUAL_DumpView View: 0x46e0000 - 0x46effff (valloc) 0009:trace:virtual:VIRTUAL_DumpView 0x46e0000 - 0x46e3fff c-rw- 0009:trace:virtual:VIRTUAL_DumpView 0x46e4000 - 0x46effff ----- 0009:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 re...