Никаких других программ не произошло, только onedrive.exe (указать c часть машины, а не все). Из дампа кажется, что он вылетал при вызове
IFileOperation::Unadvise.
CONTEXT: (.ecxr)
eax=75d0476c ebx=75d9630e ecx=75d0a5e2 edx=00001b10 esi=086feeb0 edi=75cf8f6c
eip=764e4563 esp=086fec6c ebp=086fec94 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
rpcrt4!NdrpClientInit+0x1d3:
764e4563 c70300000000 mov dword ptr [ebx],0 ds:002b:75d9630e=8b0c4d8b
Resetting default scope
FAULTING_IP:
rpcrt4!NdrpClientInit+1d3
764e4563 c70300000000 mov dword ptr [ebx],0
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 764e4563 (rpcrt4!NdrpClientInit+0x000001d3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 75d9630e
Attempt to write to address 75d9630e
PROCESS_NAME: OneDrive.exe
FOLLOWUP_IP:
xxx!CHookIFileOperation::Unadvise+f [hookifileoperation.cpp @ 61]
747fcb35 ff742408 push dword ptr [esp+8]
00 086fec94 764c5978 a0b2bfee 00000000 086ff1b8 rpcrt4!NdrpClientInit+0x1d3
01 086ff180 75e1cf40 75cd2e50 75cf8f44 086ff1b8 rpcrt4!NdrClientCall2+0x158
02 086ff1a0 75e14edf 086ff1b8 00000004 086ff230 combase!ObjectStublessClient+0x70 [onecore\com\combase\ndr\ndrole\i386\stblsclt.cxx @ 227]
03 086ff1b0 747fcb35 058a2b7c 00000000 75ce0adc combase!ObjectStubless+0xf [onecore\com\combase\ndr\ndrole\i386\stubless.asm @ 171]
04 086ff1c0 75d9630e 058a2b7c 00000000 086ff4c4 xxx!CHookIFileOperation::Unadvise+0xf [hookifileoperation.cpp @ 61]
05 086ff230 75da0a16 086ff4c4 086ff2a0 00000000 combase!CRpcResolver::CreateInstance+0x2ad [onecore\com\combase\dcomrem\resolver.cxx @ 2673]
06 086ff268 75df9e02 75f062bc 00000000 086ff4c4 combase!CClientContextActivator::CreateInstance+0x156 [onecore\com\combase\objact\actvator.cxx @ 589]
07 086ffad8 75dd06a0 00000000 00000001 00000000 combase!WinRTCreateInstanceOfOutofprocClass+0x139 [onecore\com\combase\objact\objact.cxx @ 2286]
08 086ffbb4 75dcf96d 07d048d8 00000000 00000000 combase!WinRTActivateInstanceInternal+0x360 [onecore\com\combase\winrtbase\winrtbase.cpp @ 607]
09 (Inline) -------- -------- -------- -------- combase!_RoActivateInstance+0x80 [onecore\com\combase\winrtbase\winrtbase.cpp @ 735]
0a 086ffc04 5d351dfc 08b47a90 086ffc54 5d351dd0 combase!RoActivateInstance+0x8d [onecore\com\combase\winrtbase\winrtbase.cpp @ 763]
xxx!CHookIFileOperation::Unadvise:
747fcb26 56 push esi
747fcb27 ff74240c push dword ptr [esp+0Ch]
747fcb2b ff74240c push dword ptr [esp+0Ch]
747fcb2f ff1528158374 call dword ptr [xxx!CHookIFileOperation::m_pRawUnadvise (74831528)]
747fcb35 ff742408 push dword ptr [esp+8]
0:037> dd 74831528
74831528 6ec90480 6ec904c8 6ec90510 6ec90558
6ec90480 b904000000 mov ecx,4
6ec90485 e97b4a1807 jmp combase!ObjectStublessClient4+0x5 (75e14f05)
В обычном сценарии ios здесь должно быть "CFileOperation :: Unadvise + 0x5" not "combase! ObjectStublessClient4 + 0x5".
почему? потому что заглушка / прокси? и как мне избежать таких проблем?