====================================================================== Summary ====================================================================== Exception: 0xE06D7363 - C++ exception (class std::length_error) Details: string too long errno: 0x00000000 - No error LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000F - {Файл не найден} Файл %hs не существует. Address: +00025369 KERNELBASE.dll!RaiseException+0x69 Location: mainImpl, main.cpp(944) Module: C:\Program Files\Far\Far.exe Plugin: N/A ====================================================================== System information ====================================================================== Far: 3.0.6575.0 x64 (c554345) Compiler: Microsoft Visual C++, version 19.41.33923.0 Library: Microsoft STL, version 14.3.202404 PE time: 2025-10-21 00:12:54.000 File time: 2025-10-20 18:12:56.000 Time: 2025-11-18 10:58:09.991 Local: 2025-11-18 17:58:09.991 +0700, Новосибирское стандартное время Uptime: 00:00:30 OS: Windows NT Workstation 10.0.19045, 0x100/0x30 (Windows 10 Pro, version 22H2, OS build 19045.6575) Locale: ru-RU | LCID=00000419 (Lang=0419 (Primary=019 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866 Host: C:\Windows\System32\conhost.exe 10.0.19041.4522 (WinBuild.160101.0800) Parent: C:\Windows\explorer.exe 10.0.19041.4522 (WinBuild.160101.0800) Command: "C:\Program Files\Far\Far.exe" Elevated: No (Limited) Memory: 14.1 G out of 48.0 G free (29%); 12.1 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00025369 KERNELBASE.dll!RaiseException+0x69 +003677EF Far.exe!_CxxThrowException+0x97 (libvcruntime:throw.obj) +00360AB2 Far.exe!std::_Xlength_error(char const * __ptr64)+0x22 (libcpmt:xthrow.obj) +00015AA0 Far.exe!std::_Xlen_string(void)+0x10 (cddrv.obj) +00021A0E Far.exe!std::basic_string,class std::allocator >::_Reallocate_grow_by,class std::allocator >::append(unsigned __int64,wchar_t) __ptr64'::`2'::,unsigned __int64,wchar_t>(unsigned __int64,class `std::basic_string,class std::allocator >::append(unsigned __int64,wchar_t) __ptr64'::`2'::,unsigned __int64,wchar_t) __ptr64+0x16E (cmdline.obj) +0033A55D Far.exe!FillUserMenu(class VMenu2 & __ptr64,class std::list > & __ptr64,int,class std::array & __ptr64,class subst_context const & __ptr64)+0x81D (usermenu.obj) +0033AD2C Far.exe!UserMenu::ProcessSingleMenu(class std::list > & __ptr64,int,class std::list > & __ptr64,class std::basic_string_view >,class std::basic_string,class std::allocator > const & __ptr64) __ptr64+0x40C (usermenu.obj) +003396C3 Far.exe!UserMenu::ProcessUserMenu(bool,class std::basic_string_view >) __ptr64+0xDB3 (usermenu.obj) +0033D69B Far.exe!user_menu(bool)+0x5B (usermenu.obj) +00019F91 Far.exe!CommandLine::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x721 (cmdline.obj) +0019528A Far.exe!FilePanels::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x161A (filepanels.obj) +00237F60 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x700 (manager.obj) +00237313 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0xB3 (manager.obj) +00237231 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +0022E6B1 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +00232E9C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +00233A22 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232966 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233389 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233AA2 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002332BA Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233B2C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00233508 Far.exe!main+0xC8 (main.obj) +00365C00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00007FFBBF53AE20 RBX = 00007FF66FBCE370 RCX = 000001C658520340 RDX = 000001C658520BC0 RSI = 00000015A318D440 RDI = 0000000019930520 R8 = 0000000000000040 R9 = 0000000000000000 R10 = 0000001500000000 R11 = 0000000000000000 R12 = 000001C65B29B580 R13 = FFFFFFFFFFFFFFFC R14 = 00000015A318D5E0 R15 = 0000000000000008 RIP = 00007FFBBCC65369 RSP = 00000015A318D2E0 RBP = FFFFFFFFFFFFFFFC EFL = 00000202 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00025369 KERNELBASE.dll!RaiseException+0x69: 00007ffb`bcc6533b b80f000000 mov eax,0Fh 00007ffb`bcc65340 488d4c2440 lea rcx,[rsp+40h] 00007ffb`bcc65345 443bc0 cmp r8d,eax 00007ffb`bcc65348 498bd1 mov rdx,r9 00007ffb`bcc6534b 440f47c0 cmova r8d,eax 00007ffb`bcc6534f 4489442438 mov dword ptr [rsp+38h],r8d 00007ffb`bcc65354 49c1e003 shl r8,3 00007ffb`bcc65358 e8ba190900 call KERNELBASE!SetHandleCount+0x247 (00007ffb`bccf6d17) 00007ffb`bcc6535d 488d4c2420 lea rcx,[rsp+20h] 00007ffb`bcc65362 48ff156fdf1b00 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb6fb8 (00007ffb`bce232d8)] 00007ffb`bcc65369 0f1f440000 nop dword ptr [rax+rax] +003677EF Far.exe!_CxxThrowException+0x97 (libvcruntime:throw.obj): 00007ff6`6fa977bd bf00409901 mov edi,1994000h 00007ff6`6fa977c2 ba01000000 mov edx,1 00007ff6`6fa977c7 48897c2428 mov qword ptr [rsp+28h],rdi 00007ff6`6fa977cc 4c8d4c2428 lea r9,[rsp+28h] 00007ff6`6fa977d1 4889742430 mov qword ptr [rsp+30h],rsi 00007ff6`6fa977d6 b963736de0 mov ecx,0E06D7363h 00007ff6`6fa977db 48895c2438 mov qword ptr [rsp+38h],rbx 00007ff6`6fa977e0 4889442440 mov qword ptr [rsp+40h],rax 00007ff6`6fa977e5 448d4203 lea r8d,[rdx+3] 00007ff6`6fa977e9 ff15c96a0600 call qword ptr [Far+0x3ce2b8 (00007ff6`6fafe2b8)] 00007ff6`6fa977ef 488b5c2470 mov rbx,qword ptr [rsp+70h] +00360AB2 Far.exe!std::_Xlength_error(char const * __ptr64)+0x22 (libcpmt:xthrow.obj): 00007ff6`6fa90a89 e8ca6c0000 call Far+0x367758 (00007ff6`6fa97758) 00007ff6`6fa90a8e cc int 3 00007ff6`6fa90a8f cc int 3 00007ff6`6fa90a90 4883ec48 sub rsp,48h 00007ff6`6fa90a94 488bd1 mov rdx,rcx 00007ff6`6fa90a97 488d4c2420 lea rcx,[rsp+20h] 00007ff6`6fa90a9c e8c3fcffff call Far+0x360764 (00007ff6`6fa90764) 00007ff6`6fa90aa1 488d15c8d81300 lea rdx,[Far+0x49e370 (00007ff6`6fbce370)] 00007ff6`6fa90aa8 488d4c2420 lea rcx,[rsp+20h] 00007ff6`6fa90aad e8a66c0000 call Far+0x367758 (00007ff6`6fa97758) 00007ff6`6fa90ab2 cc int 3 +00015AA0 Far.exe!std::_Xlen_string(void)+0x10 (cddrv.obj): 00007ff6`6f745a89 cc int 3 00007ff6`6f745a8a cc int 3 00007ff6`6f745a8b cc int 3 00007ff6`6f745a8c cc int 3 00007ff6`6f745a8d cc int 3 00007ff6`6f745a8e cc int 3 00007ff6`6f745a8f cc int 3 00007ff6`6f745a90 4883ec28 sub rsp,28h 00007ff6`6f745a94 488d0dcd673c00 lea rcx,[Far+0x3dc268 (00007ff6`6fb0c268)] 00007ff6`6f745a9b e8f0af3400 call Far+0x360a90 (00007ff6`6fa90a90) 00007ff6`6f745aa0 cc int 3 +00021A0E Far.exe!std::basic_string,class std::allocator >::_Reallocate_grow_by,class std::allocator >::append(unsigned __int64,wchar_t) __ptr64'::`2'::,unsigned __int64,wchar_t>(unsigned __int64,class `std::basic_string,class std::allocator >::append(unsigned __int64,wchar_t) __ptr64'::`2'::,unsigned __int64,wchar_t) __ptr64+0x16E (cmdline.obj): 00007ff6`6f7519f3 4883c420 add rsp,20h 00007ff6`6f7519f7 415f pop r15 00007ff6`6f7519f9 415e pop r14 00007ff6`6f7519fb 5f pop rdi 00007ff6`6f7519fc c3 ret 00007ff6`6f7519fd e8721a3500 call Far+0x373474 (00007ff6`6faa3474) 00007ff6`6f751a02 cc int 3 00007ff6`6f751a03 e82830feff call Far+0x4a30 (00007ff6`6f734a30) 00007ff6`6f751a08 cc int 3 00007ff6`6f751a09 e88240ffff call Far+0x15a90 (00007ff6`6f745a90) 00007ff6`6f751a0e cc int 3 +0033A55D Far.exe!FillUserMenu(class VMenu2 & __ptr64,class std::list > & __ptr64,int,class std::array & __ptr64,class subst_context const & __ptr64)+0x81D (usermenu.obj): 00007ff6`6fa6a537 4b8d0428 lea rax,[r8+r13] 00007ff6`6fa6a53b 33ff xor edi,edi 00007ff6`6fa6a53d 66893c42 mov word ptr [rdx+rax*2],di 00007ff6`6fa6a541 eb1c jmp Far+0x33a55f (00007ff6`6fa6a55f) 00007ff6`6fa6a543 66c74424202000 mov word ptr [rsp+20h],20h 00007ff6`6fa6a54a 4d8bcd mov r9,r13 00007ff6`6fa6a54d 450fb6c7 movzx r8d,r15b 00007ff6`6fa6a551 498bd5 mov rdx,r13 00007ff6`6fa6a554 488d4d00 lea rcx,[rbp] 00007ff6`6fa6a558 e84373ceff call Far+0x218a0 (00007ff6`6f7518a0) 00007ff6`6fa6a55d 33ff xor edi,edi +0033AD2C Far.exe!UserMenu::ProcessSingleMenu(class std::list > & __ptr64,int,class std::list > & __ptr64,class std::basic_string_view >,class std::basic_string,class std::allocator > const & __ptr64) __ptr64+0x40C (usermenu.obj): 00007ff6`6fa6acf4 c740680e000000 mov dword ptr [rax+68h],0Eh 00007ff6`6fa6acfb c744247001000000 mov dword ptr [rsp+70h],1 00007ff6`6fa6ad03 488d8580000000 lea rax,[rbp+80h] 00007ff6`6fa6ad0a 4889442420 mov qword ptr [rsp+20h],rax 00007ff6`6fa6ad0f 4c8d8da0020000 lea r9,[rbp+2A0h] 00007ff6`6fa6ad16 448b442440 mov r8d,dword ptr [rsp+40h] 00007ff6`6fa6ad1b 4c8b7540 mov r14,qword ptr [rbp+40h] 00007ff6`6fa6ad1f 498bd6 mov rdx,r14 00007ff6`6fa6ad22 488b4c2460 mov rcx,qword ptr [rsp+60h] 00007ff6`6fa6ad27 e814f0ffff call Far+0x339d40 (00007ff6`6fa69d40) 00007ff6`6fa6ad2c 488b7c2460 mov rdi,qword ptr [rsp+60h] +003396C3 Far.exe!UserMenu::ProcessUserMenu(bool,class std::basic_string_view >) __ptr64+0xDB3 (usermenu.obj): 00007ff6`6fa696a1 2420 and al,20h 00007ff6`6fa696a3 0200 add al,byte ptr [rax] 00007ff6`6fa696a5 004889 add byte ptr [rax-77h],cl 00007ff6`6fa696a8 442428 and al,28h 00007ff6`6fa696ab 488d442470 lea rax,[rsp+70h] 00007ff6`6fa696b0 4889442420 mov qword ptr [rsp+20h],rax 00007ff6`6fa696b5 4d8bcd mov r9,r13 00007ff6`6fa696b8 498bd5 mov rdx,r13 00007ff6`6fa696bb 498bcc mov rcx,r12 00007ff6`6fa696be e85d120000 call Far+0x33a920 (00007ff6`6fa6a920) 00007ff6`6fa696c3 8bf8 mov edi,eax +0033D69B Far.exe!user_menu(bool)+0x5B (usermenu.obj): 00007ff6`6fa6d66f e8687b0200 call Far+0x3651dc (00007ff6`6fa951dc) 00007ff6`6fa6d674 488900 mov qword ptr [rax],rax 00007ff6`6fa6d677 48894008 mov qword ptr [rax+8],rax 00007ff6`6fa6d67b 4889442440 mov qword ptr [rsp+40h],rax 00007ff6`6fa6d680 0f57c0 xorps xmm0,xmm0 00007ff6`6fa6d683 660f7f442420 movdqa xmmword ptr [rsp+20h],xmm0 00007ff6`6fa6d689 4c8d442420 lea r8,[rsp+20h] 00007ff6`6fa6d68e 0fb6d3 movzx edx,bl 00007ff6`6fa6d691 488d4c2430 lea rcx,[rsp+30h] 00007ff6`6fa6d696 e875b2ffff call Far+0x338910 (00007ff6`6fa68910) 00007ff6`6fa6d69b 90 nop +00019F91 Far.exe!CommandLine::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x721 (cmdline.obj): 00007ff6`6f749f62 e839360d00 call Far+0xed5a0 (00007ff6`6f81d5a0) 00007ff6`6f749f67 488d5758 lea rdx,[rdi+58h] 00007ff6`6f749f6b 488d8fc0010000 lea rcx,[rdi+1C0h] 00007ff6`6f749f72 e859dcffff call Far+0x17bd0 (00007ff6`6f747bd0) 00007ff6`6f749f77 8b87d0010000 mov eax,dword ptr [rdi+1D0h] 00007ff6`6f749f7d 8987e0010000 mov dword ptr [rdi+1E0h],eax 00007ff6`6f749f83 b001 mov al,1 00007ff6`6f749f85 e969120000 jmp Far+0x1b1f3 (00007ff6`6f74b1f3) 00007ff6`6f749f8a 33c9 xor ecx,ecx 00007ff6`6f749f8c e8af363200 call Far+0x33d640 (00007ff6`6fa6d640) 00007ff6`6f749f91 b001 mov al,1 ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00128428 Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x16D8 (exception_handler.obj) +0012A97B Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0xA6B (exception_handler.obj) +0012B95C Far.exe!handle_std_exception(class exception_context const & __ptr64,class std::exception const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x24C (exception_handler.obj) +0012BA8E Far.exe!handle_std_exception(class std::exception const & __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0xAE (exception_handler.obj) +0012BAEE Far.exe!handle_std_exception(class std::exception const & __ptr64,struct source_location const & __ptr64)+0xE (exception_handler.obj) +00232ECF Far.exe!`cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::::operator()(class std::exception const & __ptr64,struct source_location const & __ptr64)const __ptr64+0xF (PluginA.obj) +00232EDD Far.exe!`cpp_try,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7'::::operator()(class std::exception const & __ptr64,struct source_location const & __ptr64)const __ptr64+0xD (PluginA.obj) +00233F59 Far.exe!std::invoke,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: const & __ptr64,class std::exception const & __ptr64,struct source_location const & __ptr64>(class `cpp_try,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `oldpluginapi::AddEndSlashA(char * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginap+0x9 (PluginA.obj) +002339F7 Far.exe!`function_ref::function_ref,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: const & __ptr64>(class `cpp_try,clas+0x17 (PluginA.obj) +00233A0F Far.exe!`function_ref::function_ref,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `oldpluginapi::ExpandEnvironmentStrA(char const * __ptr64,char * __ptr64,unsigned __int64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: const & __ptr64>(class `cpp_try,clas+0xF (PluginA.obj) +003B8DC2 Far.exe!__catch$?cpp_try@detail@@YAXV?$function_ref@$$A6AXXZ@@V?$function_ref@$$A6AXAEBUsource_location@@@Z@@V?$function_ref@$$A6AXAEBVexception@std@@AEBUsource_location@@@Z@@AEBUsource_location@@@Z$0+0x15 (exception_handler.obj) +00372FE0 Far.exe!_CallSettingFrame_LookupContinuationIndex+0x20 (libvcruntime:handlers.obj) +00369E9A Far.exe!__FrameHandler4::CxxCallCatchBlock(struct _EXCEPTION_RECORD * __ptr64)+0x112 (libvcruntime:frame.obj) +000A1CD6 ntdll.dll!RtlCaptureContext2+0x4A6 +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232966 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233389 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233AA2 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002332BA Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233B2C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00233508 Far.exe!main+0xC8 (main.obj) +00365C00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ====================================================================== Thread 30320 / 0x7670 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001C6586091B0 RCX = 0000000000000088 RDX = 000001C658608E30 RSI = 000001C658605A70 RDI = 000001C6586091B0 R8 = 0000000000000008 R9 = 0000000000000006 R10 = 0000000000000000 R11 = 00000000FFFFFFFF R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A34FF4D8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 25516 / 0x63AC ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001C658609E20 RCX = 0000000000000088 RDX = 000001C658609AA0 RSI = 000001C658605A70 RDI = 000001C658609E20 R8 = 00000015A35FED20 R9 = 00000000000000FF R10 = 000000000000006C R11 = 00000015A35FEB20 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A35FF5B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 7728 / 0x1E30 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001C65860B930 RCX = 0000000000000088 RDX = 000001C65860B5B0 RSI = 000001C658605A70 RDI = 000001C65860B930 R8 = 0000000000000012 R9 = 0000000000000012 R10 = 0000000000000000 R11 = 0000000000000029 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A36FF588 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 10448 / 0x28D0 (Window messages processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000047 - Попытка освобождения семафора, при котором было бы превышено его максимальное значение счетчика. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002212E USER32.dll!GetMessageW+0x2E +0035EDA2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj) +0035F70B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 00000015A37FE710 RCX = 00000015A37FE710 RDX = 0000000000000000 RSI = 000001C65867D410 RDI = 00007FF66FB6A580 R8 = 00000015A37FE088 R9 = 00000015A37FE1A0 R10 = 0000000000000000 R11 = 00000015A37FE550 R12 = 00007FF66F73A770 R13 = 0000000000000000 R14 = 00000015A318E930 R15 = 00007FF66FB6A7F0 RIP = 00007FFBBCC11104 RSP = 00000015A37FE5A8 RBP = 00000015A37FE710 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffb`bcc110e4 c3 ret 00007ffb`bcc110e5 cd2e int 2Eh 00007ffb`bcc110e7 c3 ret 00007ffb`bcc110e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffb`bcc110f0 4c8bd1 mov r10,rcx 00007ffb`bcc110f3 b806100000 mov eax,1006h 00007ffb`bcc110f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bcc11100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffb`bcc11105) 00007ffb`bcc11102 0f05 syscall 00007ffb`bcc11104 c3 ret +0002212E USER32.dll!GetMessageW+0x2E: 00007ffb`bef72102 4883ec50 sub rsp,50h 00007ffb`bef72106 418bc1 mov eax,r9d 00007ffb`bef72109 488bd9 mov rbx,rcx 00007ffb`bef7210c 458bc8 mov r9d,r8d 00007ffb`bef7210f 440bc8 or r9d,eax 00007ffb`bef72112 41f7c10000feff test r9d,0FFFE0000h 00007ffb`bef72119 0f8591320200 jne USER32!SetWindowsHookExAW+0xee50 (00007ffb`bef953b0) 00007ffb`bef7211f 448bc8 mov r9d,eax 00007ffb`bef72122 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffb`bef72127 48ff156a1a0700 call qword ptr [USER32!gapfnScSendMessage+0x1208 (00007ffb`befe3b98)] 00007ffb`bef7212e 0f1f440000 nop dword ptr [rax+rax] +0035EDA2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj): 00007ff6`6fa8ed7c 8bce mov ecx,esi 00007ff6`6fa8ed7e e88dd6daff call Far+0x10c410 (00007ff6`6f83c410) 00007ff6`6fa8ed83 84c0 test al,al 00007ff6`6fa8ed85 0f85fb010000 jne Far+0x35ef86 (00007ff6`6fa8ef86) 00007ff6`6fa8ed8b 0f1f440000 nop dword ptr [rax+rax] 00007ff6`6fa8ed90 4533c9 xor r9d,r9d 00007ff6`6fa8ed93 4533c0 xor r8d,r8d 00007ff6`6fa8ed96 33d2 xor edx,edx 00007ff6`6fa8ed98 488d4d00 lea rcx,[rbp] 00007ff6`6fa8ed9c ff150efd0600 call qword ptr [Far+0x3ceab0 (00007ff6`6fafeab0)] 00007ff6`6fa8eda2 85c0 test eax,eax +0035F70B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj): 00007ff6`6fa8f6ee 5e pop rsi 00007ff6`6fa8f6ef c3 ret 00007ff6`6fa8f6f0 4053 push rbx 00007ff6`6fa8f6f2 4883ec20 sub rsp,20h 00007ff6`6fa8f6f6 488bd9 mov rbx,rcx 00007ff6`6fa8f6f9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`6fa8f6fe 488b01 mov rax,qword ptr [rcx] 00007ff6`6fa8f701 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`6fa8f705 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`6fa8f709 ffd0 call rax 00007ff6`6fa8f70b 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`6fab0831 7510 jne Far+0x380843 (00007ff6`6fab0843) 00007ff6`6fab0833 8d48ff lea ecx,[rax-1] 00007ff6`6fab0836 e8ed230100 call Far+0x392c28 (00007ff6`6fac2c28) 00007ff6`6fab083b 85c0 test eax,eax 00007ff6`6fab083d 0f94c0 sete al 00007ff6`6fab0840 884320 mov byte ptr [rbx+20h],al 00007ff6`6fab0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`6fab084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`6fab0851 488b03 mov rax,qword ptr [rbx] 00007ff6`6fab0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`6fafee78)] 00007ff6`6fab085a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 30232 / 0x7618 (FS watcher) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0019B901 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj) +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000001C65A3A1120 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 000001C65A3A1120 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5AE0F4 RSP = 00000015A3AFF528 RBP = 00000015A3AFFA70 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`bf5ae0d1 ab stos dword ptr [rdi] 00007ffb`bf5ae0d2 8efd mov st(-1),bp 00007ffb`bf5ae0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffb`bf5ae0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`bf5ae0e0 4c8bd1 mov r10,rcx 00007ffb`bf5ae0e3 b85b000000 mov eax,5Bh 00007ffb`bf5ae0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5ae0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`bf5ae0f5) 00007ffb`bf5ae0f2 0f05 syscall 00007ffb`bf5ae0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`bcc90cd7 4c8d742450 lea r14,[rsp+50h] 00007ffb`bcc90cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`bcc90ce1 4533c0 xor r8d,r8d 00007ffb`bcc90ce4 4585ff test r15d,r15d 00007ffb`bcc90ce7 410f94c0 sete r8b 00007ffb`bcc90ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`bcc90cf0 440fb6ce movzx r9d,sil 00007ffb`bcc90cf4 498bd5 mov rdx,r13 00007ffb`bcc90cf7 8bcb mov ecx,ebx 00007ffb`bcc90cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffb`bce23560)] 00007ffb`bcc90d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`bcc90bea cc int 3 00007ffb`bcc90beb cc int 3 00007ffb`bcc90bec cc int 3 00007ffb`bcc90bed cc int 3 00007ffb`bcc90bee cc int 3 00007ffb`bcc90bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`bcc90bf0 4883ec38 sub rsp,38h 00007ffb`bcc90bf4 8364242000 and dword ptr [rsp+20h],0 00007ffb`bcc90bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`bcc90c10) 00007ffb`bcc90bfe 4883c438 add rsp,38h +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`6f98f1f2 4881ec00010000 sub rsp,100h 00007ff6`6f98f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`6fbd3240)] 00007ff6`6f98f200 4833c4 xor rax,rsp 00007ff6`6f98f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`6f98f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`6f98f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`6f98f215 4533c0 xor r8d,r8d 00007ff6`6f98f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`6f98f21b 8bcb mov ecx,ebx 00007ff6`6f98f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`6fafe338)] 00007ff6`6f98f223 8bc8 mov ecx,eax +0019B901 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj): 00007ff6`6f8cb8d6 488b4c2438 mov rcx,qword ptr [rsp+38h] 00007ff6`6f8cb8db 488b442430 mov rax,qword ptr [rsp+30h] 00007ff6`6f8cb8e0 482bc8 sub rcx,rax 00007ff6`6f8cb8e3 48c1f903 sar rcx,3 00007ff6`6f8cb8e7 488945c0 mov qword ptr [rbp-40h],rax 00007ff6`6f8cb8eb 48894dc8 mov qword ptr [rbp-38h],rcx 00007ff6`6f8cb8ef 0f2845c0 movaps xmm0,xmmword ptr [rbp-40h] 00007ff6`6f8cb8f3 660f7f4580 movdqa xmmword ptr [rbp-80h],xmm0 00007ff6`6f8cb8f8 488d4d80 lea rcx,[rbp-80h] 00007ff6`6f8cb8fc e8ef380c00 call Far+0x25f1f0 (00007ff6`6f98f1f0) 00007ff6`6f8cb901 4c8be0 mov r12,rax +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`6f8cd40c cc int 3 00007ff6`6f8cd40d cc int 3 00007ff6`6f8cd40e cc int 3 00007ff6`6f8cd40f cc int 3 00007ff6`6f8cd410 4053 push rbx 00007ff6`6f8cd412 4883ec20 sub rsp,20h 00007ff6`6f8cd416 488bd9 mov rbx,rcx 00007ff6`6f8cd419 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`6f8cd41e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`6f8cd422 ff13 call qword ptr [rbx] 00007ff6`6f8cd424 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`6fab0831 7510 jne Far+0x380843 (00007ff6`6fab0843) 00007ff6`6fab0833 8d48ff lea ecx,[rax-1] 00007ff6`6fab0836 e8ed230100 call Far+0x392c28 (00007ff6`6fac2c28) 00007ff6`6fab083b 85c0 test eax,eax 00007ff6`6fab083d 0f94c0 sete al 00007ff6`6fab0840 884320 mov byte ptr [rbx+20h],al 00007ff6`6fab0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`6fab084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`6fab0851 488b03 mov rax,qword ptr [rbx] 00007ff6`6fab0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`6fafee78)] 00007ff6`6fab085a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 40200 / 0x9D08 (Taskbar processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0031E836 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj) +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 00000015A38FF868 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 00007FFBBDB10000 R9 = 00007FFBBDB215C0 R10 = 00007FFBBDB219D0 R11 = 00007FFBBDB6FE50 R12 = 00000000FFFFFFFF R13 = 00000015A38FF868 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5AE0F4 RSP = 00000015A38FF3C8 RBP = 00000015A38FF899 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`bf5ae0d1 ab stos dword ptr [rdi] 00007ffb`bf5ae0d2 8efd mov st(-1),bp 00007ffb`bf5ae0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffb`bf5ae0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`bf5ae0e0 4c8bd1 mov r10,rcx 00007ffb`bf5ae0e3 b85b000000 mov eax,5Bh 00007ffb`bf5ae0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5ae0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`bf5ae0f5) 00007ffb`bf5ae0f2 0f05 syscall 00007ffb`bf5ae0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`bcc90cd7 4c8d742450 lea r14,[rsp+50h] 00007ffb`bcc90cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`bcc90ce1 4533c0 xor r8d,r8d 00007ffb`bcc90ce4 4585ff test r15d,r15d 00007ffb`bcc90ce7 410f94c0 sete r8b 00007ffb`bcc90ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`bcc90cf0 440fb6ce movzx r9d,sil 00007ffb`bcc90cf4 498bd5 mov rdx,r13 00007ffb`bcc90cf7 8bcb mov ecx,ebx 00007ffb`bcc90cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffb`bce23560)] 00007ffb`bcc90d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`bcc90bea cc int 3 00007ffb`bcc90beb cc int 3 00007ffb`bcc90bec cc int 3 00007ffb`bcc90bed cc int 3 00007ffb`bcc90bee cc int 3 00007ffb`bcc90bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`bcc90bf0 4883ec38 sub rsp,38h 00007ffb`bcc90bf4 8364242000 and dword ptr [rsp+20h],0 00007ffb`bcc90bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`bcc90c10) 00007ffb`bcc90bfe 4883c438 add rsp,38h +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`6f98f1f2 4881ec00010000 sub rsp,100h 00007ff6`6f98f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`6fbd3240)] 00007ff6`6f98f200 4833c4 xor rax,rsp 00007ff6`6f98f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`6f98f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`6f98f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`6f98f215 4533c0 xor r8d,r8d 00007ff6`6f98f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`6f98f21b 8bcb mov ecx,ebx 00007ff6`6f98f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`6fafe338)] 00007ff6`6f98f223 8bc8 mov ecx,eax +0031E836 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj): 00007ff6`6fa4e807 660f1f840000000000 nop word ptr [rax+rax] 00007ff6`6fa4e810 498b4718 mov rax,qword ptr [r15+18h] 00007ff6`6fa4e814 488945cf mov qword ptr [rbp-31h],rax 00007ff6`6fa4e818 498b4720 mov rax,qword ptr [r15+20h] 00007ff6`6fa4e81c 488945d7 mov qword ptr [rbp-29h],rax 00007ff6`6fa4e820 498b4728 mov rax,qword ptr [r15+28h] 00007ff6`6fa4e824 488945df mov qword ptr [rbp-21h],rax 00007ff6`6fa4e828 660f7f75b7 movdqa xmmword ptr [rbp-49h],xmm6 00007ff6`6fa4e82d 488d4db7 lea rcx,[rbp-49h] 00007ff6`6fa4e831 e8ba09f4ff call Far+0x25f1f0 (00007ff6`6f98f1f0) 00007ff6`6fa4e836 4885c0 test rax,rax +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`6f8cd40c cc int 3 00007ff6`6f8cd40d cc int 3 00007ff6`6f8cd40e cc int 3 00007ff6`6f8cd40f cc int 3 00007ff6`6f8cd410 4053 push rbx 00007ff6`6f8cd412 4883ec20 sub rsp,20h 00007ff6`6f8cd416 488bd9 mov rbx,rcx 00007ff6`6f8cd419 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`6f8cd41e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`6f8cd422 ff13 call qword ptr [rbx] 00007ff6`6f8cd424 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`6fab0831 7510 jne Far+0x380843 (00007ff6`6fab0843) 00007ff6`6fab0833 8d48ff lea ecx,[rax-1] 00007ff6`6fab0836 e8ed230100 call Far+0x392c28 (00007ff6`6fac2c28) 00007ff6`6fab083b 85c0 test eax,eax 00007ff6`6fab083d 0f94c0 sete al 00007ff6`6fab0840 884320 mov byte ptr [rbx+20h],al 00007ff6`6fab0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`6fab084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`6fab0851 488b03 mov rax,qword ptr [rbx] 00007ff6`6fab0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`6fafee78)] 00007ff6`6fab085a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 36076 / 0x8CEC ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +000CF876 combase.dll!CoRevokeInitializeSpy+0xE16 +000CF6F0 combase.dll!CoRevokeInitializeSpy+0xC90 +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0 +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 00000015A39FF440 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 000001C6586FC210 R9 = 00007FFBBD5CF460 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 00000015A39FF440 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5AE0F4 RSP = 00000015A39FF0F8 RBP = 00000000000003AC EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`bf5ae0d1 ab stos dword ptr [rdi] 00007ffb`bf5ae0d2 8efd mov st(-1),bp 00007ffb`bf5ae0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffb`bf5ae0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`bf5ae0e0 4c8bd1 mov r10,rcx 00007ffb`bf5ae0e3 b85b000000 mov eax,5Bh 00007ffb`bf5ae0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5ae0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`bf5ae0f5) 00007ffb`bf5ae0f2 0f05 syscall 00007ffb`bf5ae0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`bcc90cd7 4c8d742450 lea r14,[rsp+50h] 00007ffb`bcc90cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`bcc90ce1 4533c0 xor r8d,r8d 00007ffb`bcc90ce4 4585ff test r15d,r15d 00007ffb`bcc90ce7 410f94c0 sete r8b 00007ffb`bcc90ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`bcc90cf0 440fb6ce movzx r9d,sil 00007ffb`bcc90cf4 498bd5 mov rdx,r13 00007ffb`bcc90cf7 8bcb mov ecx,ebx 00007ffb`bcc90cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffb`bce23560)] 00007ffb`bcc90d00 0f1f440000 nop dword ptr [rax+rax] +000CF876 combase.dll!CoRevokeInitializeSpy+0xE16: 00007ffb`bd5cf84c 85ff test edi,edi 00007ffb`bd5cf84e 7559 jne combase!CoRevokeInitializeSpy+0xe49 (00007ffb`bd5cf8a9) 00007ffb`bd5cf850 8b9424b8020000 mov edx,dword ptr [rsp+2B8h] 00007ffb`bd5cf857 8d4f01 lea ecx,[rdi+1] 00007ffb`bd5cf85a 89542420 mov dword ptr [rsp+20h],edx 00007ffb`bd5cf85e 4183c9ff or r9d,0FFFFFFFFh 00007ffb`bd5cf862 488d542450 lea rdx,[rsp+50h] 00007ffb`bd5cf867 48896cfc50 mov qword ptr [rsp+rdi*8+50h],rbp 00007ffb`bd5cf86c 4533c0 xor r8d,r8d 00007ffb`bd5cf86f 48ff15fae41a00 call qword ptr [combase!Ordinal79+0x61710 (00007ffb`bd77dd70)] 00007ffb`bd5cf876 0f1f440000 nop dword ptr [rax+rax] +000CF6F0 combase.dll!CoRevokeInitializeSpy+0xC90: 00007ffb`bd5cf6c0 448b0d29452300 mov r9d,dword ptr [combase!Ordinal183+0x524e8 (00007ffb`bd803bf0)] 00007ffb`bd5cf6c7 488d442450 lea rax,[rsp+50h] 00007ffb`bd5cf6cc 8364245000 and dword ptr [rsp+50h],0 00007ffb`bd5cf6d1 4533c0 xor r8d,r8d 00007ffb`bd5cf6d4 4889442430 mov qword ptr [rsp+30h],rax 00007ffb`bd5cf6d9 33d2 xor edx,edx 00007ffb`bd5cf6db 8364242800 and dword ptr [rsp+28h],0 00007ffb`bd5cf6e0 488bcb mov rcx,rbx 00007ffb`bd5cf6e3 c7442420a00f0000 mov dword ptr [rsp+20h],0FA0h 00007ffb`bd5cf6eb e8e0000000 call combase!CoRevokeInitializeSpy+0xd70 (00007ffb`bd5cf7d0) 00007ffb`bd5cf6f0 85c0 test eax,eax +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffb`bd5cf4cc 44397108 cmp dword ptr [rcx+8],r14d 00007ffb`bd5cf4d0 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffb`bd5cf60e) 00007ffb`bd5cf4d6 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffb`bd5cf4df 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffb`bd5cf4e6 4885c0 test rax,rax 00007ffb`bd5cf4e9 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffb`bd5cf4f2) 00007ffb`bd5cf4eb 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffb`bd5cf4f2 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffb`bd5cf4f6 488b4310 mov rax,qword ptr [rbx+10h] 00007ffb`bd5cf4fa ff1598f01a00 call qword ptr [combase!Ordinal79+0x61f38 (00007ffb`bd77e598)] 00007ffb`bd5cf500 48ff15d9e51a00 call qword ptr [combase!Ordinal79+0x61480 (00007ffb`bd77dae0)] +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffb`bd5cf460 48895c2408 mov qword ptr [rsp+8],rbx 00007ffb`bd5cf465 57 push rdi 00007ffb`bd5cf466 4883ec20 sub rsp,20h 00007ffb`bd5cf46a 488bf9 mov rdi,rcx 00007ffb`bd5cf46d 48ff155ce61a00 call qword ptr [combase!Ordinal79+0x61470 (00007ffb`bd77dad0)] 00007ffb`bd5cf474 0f1f440000 nop dword ptr [rax+rax] 00007ffb`bd5cf479 894728 mov dword ptr [rdi+28h],eax 00007ffb`bd5cf47c e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffb`bd5cf8c8) 00007ffb`bd5cf481 488bcf mov rcx,rdi 00007ffb`bd5cf484 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffb`bd5cf4b4) 00007ffb`bd5cf489 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 15956 / 0x3E54 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001C65A3932B0 RCX = 0000000000000014 RDX = 000001C65A392F30 RSI = 000001C658602340 RDI = 000001C65A3932B0 R8 = 0000000000000000 R9 = 4000000054000541 R10 = 3FFFFFFF03FFF03C R11 = 5555555555555555 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A3BFF878 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 30588 / 0x777C ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001C65A3B4870 RCX = 0000000000000014 RDX = 000001C65A3B44F0 RSI = 000001C658602340 RDI = 000001C65A3B4870 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A3CFFAC8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 29824 / 0x7480 ====================================================================== LastError: 0x000003F0 - Попытка ссылки на несуществующий токен. NTSTATUS: 0xC000007C - Попытка ссылки на несуществующий токен. Как правило, это происходит при ссылке на токен, связанный с потоком команд, не олицетворяющим клиента. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002212E USER32.dll!GetMessageW+0x2E +000AEC08 combase.dll!Ordinal69+0xC28 +000AEB40 combase.dll!Ordinal69+0xB60 +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0 +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 00000015A3DFF6D0 RCX = 00000015A3DFF6D0 RDX = 0000000000000000 RSI = 0000000000191610 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 00007FFBBDB879B6 R10 = 00007FFB8793D0F0 R11 = 00000015A3DFE0B0 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000001000 R15 = 0000000000000000 RIP = 00007FFBBCC11104 RSP = 00000015A3DFF628 RBP = 00000000000003B8 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffb`bcc110e4 c3 ret 00007ffb`bcc110e5 cd2e int 2Eh 00007ffb`bcc110e7 c3 ret 00007ffb`bcc110e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffb`bcc110f0 4c8bd1 mov r10,rcx 00007ffb`bcc110f3 b806100000 mov eax,1006h 00007ffb`bcc110f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bcc11100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffb`bcc11105) 00007ffb`bcc11102 0f05 syscall 00007ffb`bcc11104 c3 ret +0002212E USER32.dll!GetMessageW+0x2E: 00007ffb`bef72102 4883ec50 sub rsp,50h 00007ffb`bef72106 418bc1 mov eax,r9d 00007ffb`bef72109 488bd9 mov rbx,rcx 00007ffb`bef7210c 458bc8 mov r9d,r8d 00007ffb`bef7210f 440bc8 or r9d,eax 00007ffb`bef72112 41f7c10000feff test r9d,0FFFE0000h 00007ffb`bef72119 0f8591320200 jne USER32!SetWindowsHookExAW+0xee50 (00007ffb`bef953b0) 00007ffb`bef7211f 448bc8 mov r9d,eax 00007ffb`bef72122 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffb`bef72127 48ff156a1a0700 call qword ptr [USER32!gapfnScSendMessage+0x1208 (00007ffb`befe3b98)] 00007ffb`bef7212e 0f1f440000 nop dword ptr [rax+rax] +000AEC08 combase.dll!Ordinal69+0xC28: 00007ffb`bd5aebd7 488bb1c0000000 mov rsi,qword ptr [rcx+0C0h] 00007ffb`bd5aebde 488bce mov rcx,rsi 00007ffb`bd5aebe1 48ff15b8292800 call qword ptr [combase!Ordinal183+0x7fe98 (00007ffb`bd8315a0)] 00007ffb`bd5aebe8 0f1f440000 nop dword ptr [rax+rax] 00007ffb`bd5aebed 488905c4512500 mov qword ptr [combase!Ordinal183+0x526b0 (00007ffb`bd803db8)],rax 00007ffb`bd5aebf4 4533c9 xor r9d,r9d 00007ffb`bd5aebf7 488d4c2440 lea rcx,[rsp+40h] 00007ffb`bd5aebfc 4533c0 xor r8d,r8d 00007ffb`bd5aebff 33d2 xor edx,edx 00007ffb`bd5aec01 48ff1580292800 call qword ptr [combase!Ordinal183+0x7fe80 (00007ffb`bd831588)] 00007ffb`bd5aec08 0f1f440000 nop dword ptr [rax+rax] +000AEB40 combase.dll!Ordinal69+0xB60: 00007ffb`bd5aeb1c 488bcd mov rcx,rbp 00007ffb`bd5aeb1f 894658 mov dword ptr [rsi+58h],eax 00007ffb`bd5aeb22 48ff155ff21c00 call qword ptr [combase!Ordinal79+0x61728 (00007ffb`bd77dd88)] 00007ffb`bd5aeb29 0f1f440000 nop dword ptr [rax+rax] 00007ffb`bd5aeb2e 8b4630 mov eax,dword ptr [rsi+30h] 00007ffb`bd5aeb31 83e01f and eax,1Fh 00007ffb`bd5aeb34 ffc8 dec eax 00007ffb`bd5aeb36 83f801 cmp eax,1 00007ffb`bd5aeb39 7705 ja combase!Ordinal69+0xb60 (00007ffb`bd5aeb40) 00007ffb`bd5aeb3b e864000000 call combase!Ordinal69+0xbc4 (00007ffb`bd5aeba4) 00007ffb`bd5aeb40 488b442440 mov rax,qword ptr [rsp+40h] +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffb`bd5cf4cc 44397108 cmp dword ptr [rcx+8],r14d 00007ffb`bd5cf4d0 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffb`bd5cf60e) 00007ffb`bd5cf4d6 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffb`bd5cf4df 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffb`bd5cf4e6 4885c0 test rax,rax 00007ffb`bd5cf4e9 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffb`bd5cf4f2) 00007ffb`bd5cf4eb 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffb`bd5cf4f2 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffb`bd5cf4f6 488b4310 mov rax,qword ptr [rbx+10h] 00007ffb`bd5cf4fa ff1598f01a00 call qword ptr [combase!Ordinal79+0x61f38 (00007ffb`bd77e598)] 00007ffb`bd5cf500 48ff15d9e51a00 call qword ptr [combase!Ordinal79+0x61480 (00007ffb`bd77dae0)] +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffb`bd5cf460 48895c2408 mov qword ptr [rsp+8],rbx 00007ffb`bd5cf465 57 push rdi 00007ffb`bd5cf466 4883ec20 sub rsp,20h 00007ffb`bd5cf46a 488bf9 mov rdi,rcx 00007ffb`bd5cf46d 48ff155ce61a00 call qword ptr [combase!Ordinal79+0x61470 (00007ffb`bd77dad0)] 00007ffb`bd5cf474 0f1f440000 nop dword ptr [rax+rax] 00007ffb`bd5cf479 894728 mov dword ptr [rdi+28h],eax 00007ffb`bd5cf47c e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffb`bd5cf8c8) 00007ffb`bd5cf481 488bcf mov rcx,rdi 00007ffb`bd5cf484 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffb`bd5cf4b4) 00007ffb`bd5cf489 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 40528 / 0x9E50 (Async history config) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +00078DAD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj) +00084DDE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 00000015A3EFF628 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000DB4 R9 = 000001C65B69B5B0 R10 = 000001C65B1C0000 R11 = 0000000000000246 R12 = 00000000FFFFFFFF R13 = 00000015A3EFF628 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5AE0F4 RSP = 00000015A3EFF158 RBP = 00000015A3EFF6A0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`bf5ae0d1 ab stos dword ptr [rdi] 00007ffb`bf5ae0d2 8efd mov st(-1),bp 00007ffb`bf5ae0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffb`bf5ae0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`bf5ae0e0 4c8bd1 mov r10,rcx 00007ffb`bf5ae0e3 b85b000000 mov eax,5Bh 00007ffb`bf5ae0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5ae0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`bf5ae0f5) 00007ffb`bf5ae0f2 0f05 syscall 00007ffb`bf5ae0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`bcc90cd7 4c8d742450 lea r14,[rsp+50h] 00007ffb`bcc90cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`bcc90ce1 4533c0 xor r8d,r8d 00007ffb`bcc90ce4 4585ff test r15d,r15d 00007ffb`bcc90ce7 410f94c0 sete r8b 00007ffb`bcc90ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`bcc90cf0 440fb6ce movzx r9d,sil 00007ffb`bcc90cf4 498bd5 mov rdx,r13 00007ffb`bcc90cf7 8bcb mov ecx,ebx 00007ffb`bcc90cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffb`bce23560)] 00007ffb`bcc90d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`bcc90bea cc int 3 00007ffb`bcc90beb cc int 3 00007ffb`bcc90bec cc int 3 00007ffb`bcc90bed cc int 3 00007ffb`bcc90bee cc int 3 00007ffb`bcc90bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`bcc90bf0 4883ec38 sub rsp,38h 00007ffb`bcc90bf4 8364242000 and dword ptr [rsp+20h],0 00007ffb`bcc90bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`bcc90c10) 00007ffb`bcc90bfe 4883c438 add rsp,38h +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`6f98f1f2 4881ec00010000 sub rsp,100h 00007ff6`6f98f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`6fbd3240)] 00007ff6`6f98f200 4833c4 xor rax,rsp 00007ff6`6f98f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`6f98f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`6f98f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`6f98f215 4533c0 xor r8d,r8d 00007ff6`6f98f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`6f98f21b 8bcb mov ecx,ebx 00007ff6`6f98f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`6fafe338)] 00007ff6`6f98f223 8bc8 mov ecx,eax +00078DAD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj): 00007ff6`6f7a8d7c 48894588 mov qword ptr [rbp-78h],rax 00007ff6`6f7a8d80 488b8788000000 mov rax,qword ptr [rdi+88h] 00007ff6`6f7a8d87 48894590 mov qword ptr [rbp-70h],rax 00007ff6`6f7a8d8b 488d4588 lea rax,[rbp-78h] 00007ff6`6f7a8d8f 488945a0 mov qword ptr [rbp-60h],rax 00007ff6`6f7a8d93 48c745a802000000 mov qword ptr [rbp-58h],2 00007ff6`6f7a8d9b 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`6f7a8d9f 660f7f45b0 movdqa xmmword ptr [rbp-50h],xmm0 00007ff6`6f7a8da4 488d4db0 lea rcx,[rbp-50h] 00007ff6`6f7a8da8 e843641e00 call Far+0x25f1f0 (00007ff6`6f98f1f0) 00007ff6`6f7a8dad 4883f801 cmp rax,1 +00084DDE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj): 00007ff6`6f7b4db9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`6f7b4dbe 4c8b4910 mov r9,qword ptr [rcx+10h] 00007ff6`6f7b4dc2 4863510c movsxd rdx,dword ptr [rcx+0Ch] 00007ff6`6f7b4dc6 498b4108 mov rax,qword ptr [r9+8] 00007ff6`6f7b4dca 48630c02 movsxd rcx,dword ptr [rdx+rax] 00007ff6`6f7b4dce 48635308 movsxd rdx,dword ptr [rbx+8] 00007ff6`6f7b4dd2 4903c9 add rcx,r9 00007ff6`6f7b4dd5 4883c208 add rdx,8 00007ff6`6f7b4dd9 4803ca add rcx,rdx 00007ff6`6f7b4ddc ff13 call qword ptr [rbx] 00007ff6`6f7b4dde 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`6fab0831 7510 jne Far+0x380843 (00007ff6`6fab0843) 00007ff6`6fab0833 8d48ff lea ecx,[rax-1] 00007ff6`6fab0836 e8ed230100 call Far+0x392c28 (00007ff6`6fac2c28) 00007ff6`6fab083b 85c0 test eax,eax 00007ff6`6fab083d 0f94c0 sete al 00007ff6`6fab0840 884320 mov byte ptr [rbx+20h],al 00007ff6`6fab0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`6fab084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`6fab0851 488b03 mov rax,qword ptr [rbx] 00007ff6`6fab0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`6fafee78)] 00007ff6`6fab085a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 24752 / 0x60B0 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 0000000000000508 RDX = 000001C65D8723E0 RSI = 000001C65D885C70 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFBBF5B1034 RSP = 00000015A3FFF548 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`bf5b1014 c3 ret 00007ffb`bf5b1015 cd2e int 2Eh 00007ffb`bf5b1017 c3 ret 00007ffb`bf5b1018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`bf5b1020 4c8bd1 mov r10,rcx 00007ffb`bf5b1023 b8d5010000 mov eax,1D5h 00007ffb`bf5b1028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5b1030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`bf5b1035) 00007ffb`bf5b1032 0f05 syscall 00007ffb`bf5b1034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`bf55d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`bf55d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`bf55d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`bf55d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`bf55d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`bf55d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`bf55d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`bf55d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`bf55d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`bf55d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`bf5b1020) 00007ffb`bf55d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`bf3e735d cc int 3 00007ffb`bf3e735e cc int 3 00007ffb`bf3e735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`bf3e7360 4883ec28 sub rsp,28h 00007ffb`bf3e7364 85c9 test ecx,ecx 00007ffb`bf3e7366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`bf3e7383) 00007ffb`bf3e7368 498bc8 mov rcx,r8 00007ffb`bf3e736b 488bc2 mov rax,rdx 00007ffb`bf3e736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`bf456648)] 00007ffb`bf3e7374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`bf55cc72 ec in al,dx 00007ffb`bf55cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`bf55ccc1) 00007ffb`bf55cc75 8bc9 mov ecx,ecx 00007ffb`bf55cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`bf67bff0)] 00007ffb`bf55cc7e 4885c0 test rax,rax 00007ffb`bf55cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`bf55cc93) 00007ffb`bf55cc83 4c8bc2 mov r8,rdx 00007ffb`bf55cc86 488bd1 mov rdx,rcx 00007ffb`bf55cc89 33c9 xor ecx,ecx 00007ffb`bf55cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`bf695000)] 00007ffb`bf55cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`bf55ccb3) ====================================================================== Thread 42292 / 0xA534 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +0004B7B7 CRYPT32.dll! (get the pdb) ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000001C65B751850 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000003A98 R13 = 000001C65B751850 R14 = 00000015A40FFC40 R15 = 0000000000000000 RIP = 00007FFBBF5AE0F4 RSP = 00000015A40FFBE8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`bf5ae0d1 ab stos dword ptr [rdi] 00007ffb`bf5ae0d2 8efd mov st(-1),bp 00007ffb`bf5ae0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffb`bf5ae0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`bf5ae0e0 4c8bd1 mov r10,rcx 00007ffb`bf5ae0e3 b85b000000 mov eax,5Bh 00007ffb`bf5ae0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`bf5ae0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`bf5ae0f5) 00007ffb`bf5ae0f2 0f05 syscall 00007ffb`bf5ae0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`bcc90cd7 4c8d742450 lea r14,[rsp+50h] 00007ffb`bcc90cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`bcc90ce1 4533c0 xor r8d,r8d 00007ffb`bcc90ce4 4585ff test r15d,r15d 00007ffb`bcc90ce7 410f94c0 sete r8b 00007ffb`bcc90ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`bcc90cf0 440fb6ce movzx r9d,sil 00007ffb`bcc90cf4 498bd5 mov rdx,r13 00007ffb`bcc90cf7 8bcb mov ecx,ebx 00007ffb`bcc90cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffb`bce23560)] 00007ffb`bcc90d00 0f1f440000 nop dword ptr [rax+rax] +0004B7B7 CRYPT32.dll! (get the pdb): 00007ffb`bd1ab793 488bd9 mov rbx,rcx 00007ffb`bd1ab796 48f7d8 neg rax 00007ffb`bd1ab799 1bff sbb edi,edi 00007ffb`bd1ab79b f7df neg edi 00007ffb`bd1ab79d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffb`bd1ab7a1 488d5310 lea rdx,[rbx+10h] 00007ffb`bd1ab7a5 8364242000 and dword ptr [rsp+20h],0 00007ffb`bd1ab7aa 8d4f01 lea ecx,[rdi+1] 00007ffb`bd1ab7ad 4533c0 xor r8d,r8d 00007ffb`bd1ab7b0 48ff15f1ee0c00 call qword ptr [00007ffb`bd27a6a8] 00007ffb`bd1ab7b7 0f1f440000 nop dword ptr [rax+rax] ====================================================================== Modules ====================================================================== 0x00007FF66F730000 - 0x00007FF66FCC2000 | C:\Program Files\Far\Far.exe | File and archive manager | 3.0.6575.0 x64 0x00007FFBBF510000 - 0x00007FFBBF708000 | C:\WINDOWS\SYSTEM32\ntdll.dll | Системная библиотека NT | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFBBF3D0000 - 0x00007FFBBF492000 | C:\WINDOWS\System32\KERNEL32.DLL | Библиотека клиента Windows NT BASE API | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFBBCC40000 - 0x00007FFBBCF36000 | C:\WINDOWS\System32\KERNELBASE.dll | Библиотека клиента Windows NT BASE API | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFBBE800000 - 0x00007FFBBE8B1000 | C:\WINDOWS\System32\ADVAPI32.dll | Расширенная библиотека API Windows 32 | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBDA10000 - 0x00007FFBBDAAE000 | C:\WINDOWS\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBEE00000 - 0x00007FFBBEE9F000 | C:\WINDOWS\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.19041.1 (WinBuild.160101.0800) 0x00007FFBBDB10000 - 0x00007FFBBDC30000 | C:\WINDOWS\System32\RPCRT4.dll | Библиотека удаленного вызова процедур | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBD4D0000 - 0x00007FFBBD4F7000 | C:\WINDOWS\System32\bcrypt.dll | Библиотека криптографических примитивов Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBEF50000 - 0x00007FFBBF0F1000 | C:\WINDOWS\System32\USER32.dll | Многопользовательская библиотека клиента USER API Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBCC10000 - 0x00007FFBBCC32000 | C:\WINDOWS\System32\win32u.dll | Win32u | 10.0.19041.6575 (WinBuild.160101.0800) 0x00007FFBBF160000 - 0x00007FFBBF18B000 | C:\WINDOWS\System32\GDI32.dll | GDI Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFBBCF90000 - 0x00007FFBBD0A9000 | C:\WINDOWS\System32\gdi32full.dll | GDI Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFBBCB70000 - 0x00007FFBBCC0D000 | C:\WINDOWS\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBD3D0000 - 0x00007FFBBD4D0000 | C:\WINDOWS\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBE090000 - 0x00007FFBBE800000 | C:\WINDOWS\System32\SHELL32.dll | Общая библиотека оболочки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBDCF0000 - 0x00007FFBBDE1B000 | C:\WINDOWS\System32\ole32.dll | Microsoft OLE для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBD500000 - 0x00007FFBBD854000 | C:\WINDOWS\System32\combase.dll | Microsoft COM для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBA18A0000 - 0x00007FFBA18BD000 | C:\WINDOWS\SYSTEM32\MPR.dll | Библиотека маршрутизации для нескольких служб доступа | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBABA10000 - 0x00007FFBABAB4000 | C:\WINDOWS\SYSTEM32\WINSPOOL.DRV | Драйвер диспетчера очереди Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB9A0F0000 - 0x00007FFB9A109000 | C:\WINDOWS\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBDC30000 - 0x00007FFBBDCDD000 | C:\WINDOWS\System32\shcore.dll | SHCORE | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBE080000 - 0x00007FFBBE088000 | C:\WINDOWS\System32\PSAPI.DLL | Process Status Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBE8C0000 - 0x00007FFBBED30000 | C:\WINDOWS\System32\SETUPAPI.dll | Windows Setup API | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBCF40000 - 0x00007FFBBCF8E000 | C:\WINDOWS\System32\cfgmgr32.dll | Configuration Manager DLL | 10.0.19041.3996 (WinBuild.160101.0800) 0x00007FFBABD20000 - 0x00007FFBABD2C000 | C:\WINDOWS\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBF190000 - 0x00007FFBBF26A000 | C:\WINDOWS\System32\COMDLG32.dll | Библиотека общих диалоговых окон | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBDAB0000 - 0x00007FFBBDB0B000 | C:\WINDOWS\System32\SHLWAPI.dll | Библиотека небольших программ оболочки | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBB1AB0000 - 0x00007FFBB1ABA000 | C:\WINDOWS\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBCA20000 - 0x00007FFBBCA4E000 | C:\WINDOWS\SYSTEM32\USERENV.dll | Userenv | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBF390000 - 0x00007FFBBF3BF000 | C:\WINDOWS\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFBA5810000 - 0x00007FFBA5AAB000 | C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll | Библиотека элементов управления взаимодействия с пользователем | 6.10 (WinBuild.160101.0800) 0x00007FFB91BE0000 - 0x00007FFB91D06000 | C:\Program Files\Far\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.50.4 0x00007FFBBBF90000 - 0x00007FFBBBF9C000 | C:\WINDOWS\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBB5D80000 - 0x00007FFBB5D99000 | C:\WINDOWS\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBA3650000 - 0x00007FFBA3678000 | C:\WINDOWS\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBCA50000 - 0x00007FFBBCA82000 | C:\WINDOWS\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.19041.6328 (WinBuild.160101.0800) 0x00007FFBBA9C0000 - 0x00007FFBBA9D2000 | C:\WINDOWS\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.19041.3758 (WinBuild.160101.0800) 0x00007FFBBA4D0000 - 0x00007FFBBA56E000 | C:\WINDOWS\system32\uxtheme.dll | Библиотека тем UxTheme (Microsoft) | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBF270000 - 0x00007FFBBF385000 | C:\WINDOWS\System32\MSCTF.dll | Серверная библиотека MSCTF | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBED30000 - 0x00007FFBBEDFD000 | C:\WINDOWS\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBABC0000 - 0x00007FFBBB365000 | C:\WINDOWS\SYSTEM32\windows.storage.dll | API хранения Microsoft WinRT | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBC4C0000 - 0x00007FFBBC4EB000 | C:\WINDOWS\SYSTEM32\Wldp.dll | Политика блокировки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBCAA0000 - 0x00007FFBBCAC4000 | C:\WINDOWS\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.19041.6033 (WinBuild.160101.0800) 0x00007FFBBD2C0000 - 0x00007FFBBD342000 | C:\WINDOWS\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.19041.5007 (WinBuild.160101.0800) 0x00007FFBBEEA0000 - 0x00007FFBBEF49000 | C:\WINDOWS\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFB877E0000 - 0x00007FFB87A38000 | C:\WINDOWS\system32\explorerframe.dll | ExplorerFrame | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFBB75E0000 - 0x00007FFBB7BA0000 | C:\WINDOWS\system32\d2d1.dll | Библиотека Microsoft D2D | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBB1BA0000 - 0x00007FFBB2374000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.19041.5915 (WinBuild.160101.0800) 0x0000000110000000 - 0x0000000110011000 | C:\Program Files\Far\Plugins\FaST\FARasScheduledTask64.dll | Fixes for FAR as Scheduled Task FAR3 plugin | 1.1.0.37 0x000001C65A0E0000 - 0x000001C65A0F1000 | C:\Program Files\Far\Plugins\FIN\FixIncorrectNames64.dll | Fix Incorrect Names FAR3 plugin | 1.6.0.13 0x00007FFBB3A80000 - 0x00007FFBB3AA3000 | C:\Program Files\Far\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.896.0 0x00007FFB7F880000 - 0x00007FFB7F92E000 | C:\Program Files\Far\luafar3.dll | LuaFar library | 3.0.896.0 0x0000000066D80000 - 0x0000000066E00000 | C:\Program Files\Far\lua51.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFBBC430000 - 0x00007FFBBC43C000 | C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB91BA0000 - 0x00007FFB91BD9000 | C:\Program Files\Far\Plugins\TmpPanel\TmpPanel.dll | Temporary Panel for Far Manager | 3.0.121.0 0x00007FFBBBDC0000 - 0x00007FFBBBDF3000 | C:\WINDOWS\SYSTEM32\ntmarta.dll | Поставщик Windows NT MARTA | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBAFA10000 - 0x00007FFBAFC11000 | C:\WINDOWS\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.19041.5848 (WinBuild.160101.0800) 0x00007FFB940D0000 - 0x00007FFB94104000 | C:\WINDOWS\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.19041.5794 (WinBuild.160101.0800) 0x00007FFBAFDC0000 - 0x00007FFBB0447000 | C:\WINDOWS\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBB6410000 - 0x00007FFBB6446000 | C:\WINDOWS\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBAFC20000 - 0x00007FFBAFCD4000 | C:\WINDOWS\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBD350000 - 0x00007FFBBD3C3000 | C:\WINDOWS\System32\wintrust.dll | Microsoft Trust Verification APIs | 10.0.19041.6456 (WinBuild.160101.0800) 0x00007FFBBD160000 - 0x00007FFBBD2BD000 | C:\WINDOWS\System32\CRYPT32.dll | API32 криптографии | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFBBC8A0000 - 0x00007FFBBC8B2000 | C:\WINDOWS\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFBBC810000 - 0x00007FFBBC828000 | C:\WINDOWS\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.19041.5856 (WinBuild.160101.0800) 0x00007FFBBBB70000 - 0x00007FFBBBBA8000 | C:\WINDOWS\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.19041.1 (WinBuild.160101.0800) 0x00007FFBBE060000 - 0x00007FFBBE07D000 | C:\WINDOWS\System32\imagehlp.dll | Windows NT Image Helper | 10.0.19041.3636 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARHOME=C:\Program Files\Far FARLANG=Russian FARLOCALPROFILE=C:\Users\Serg\AppData\Local\Far Manager\Profile FARPROFILE=C:\Users\Serg\AppData\Roaming\Far Manager\Profile