title: How could it happen? (in debugging minidump file)
body: <p>I'm tracing dmp file which seems like crashed calling virtual function of broken object instance.</p>
  
  <p>it seems that vft of the broken object pointer pointed wrong address(<code>0x3822a497</code>) and program crashed immediately after <code>call edx</code> to <code>0x3822a497</code> (<code>LAST_CONTROL_TRANSFER:  from 00ccde67 to 3822a497</code>), and instruction pointer (<code>EIP</code>) couldn't even go one step further. then, shouldn't it be <code>edx=0x3822a497</code>? but both Visual Studio and Windbg indicates <code>edx=0x1e4dcc0</code>.</p>
  
  <p>Can somebody explain how could it happen?</p>
  
  <h3>EDIT: I trusted LAST_CONTROL_TRANSFER too much, but still mystery exists. please first see updated suppositions 1,2,3 below and give me a possible scenario.</h3>
  
  <h3>Result of windbg !analyze -v</h3>
  
  <pre><code>Failed calling InternetOpenUrl, GLE=12029
  FAULTING_IP: 
  +8cde67
  3822a497 006e00          add     byte ptr [esi],ch
  EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
  ExceptionAddress: 3822a497
     ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
  NumberParameters: 2
     Parameter[0]: 00000001
     Parameter[1]: 0138d2cc
  Attempt to write to address 0138d2cc
  PROCESS_NAME:  DDD.exe
  ADDITIONAL_DEBUG_TEXT:  
  Use '!findthebuild' command to search for the target build information.
  If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
  FAULTING_MODULE: 76df0000 kernel32
  DEBUG_FLR_IMAGE_TIMESTAMP:  518275c9
  MODULE_NAME: DDD
  ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
  EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
  EXCEPTION_PARAMETER1:  00000001
  EXCEPTION_PARAMETER2:  0138d2cc
  WRITE_ADDRESS:  0138d2cc 
  FOLLOWUP_IP: 
  DDD+8cde67
  00ccde67 ??              ???
  FAILED_INSTRUCTION_ADDRESS: 
  +591b2faf0239d8f4
  3822a497 006e00          add     byte ptr [esi],ch
  MOD_LIST: &lt;ANALYSIS/&gt;
  FAULTING_THREAD:  00000650
  BUGCHECK_STR:  APPLICATION_FAULT_BAD_INSTRUCTION_PTR_INVALID_POINTER_WRITE_WRONG_SYMBOLS
  PRIMARY_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR
  DEFAULT_BUCKET_ID:  BAD_INSTRUCTION_PTR
  LAST_CONTROL_TRANSFER:  from 00ccde67 to 3822a497
  STACK_TEXT:  
  WARNING: Frame IP not in any known module. Following frames may be wrong.
  0018cfe0 00ccde67 1a75cb52 00000000 28e86c00 0x3822a497
  0018cfe4 1a75cb52 00000000 28e86c00 00000011 DDD+0x8cde67
  0018cfe8 00000000 28e86c00 00000011 29b52260 0x1a75cb52
  
  STACK_COMMAND:  ~0s; .ecxr ; kb
  SYMBOL_STACK_INDEX:  1
  SYMBOL_NAME:  DDD+8cde67
  FOLLOWUP_NAME:  MachineOwner
  IMAGE_NAME:  DDD.exe
  BUCKET_ID:  WRONG_SYMBOLS
  FAILURE_BUCKET_ID:  BAD_INSTRUCTION_PTR_c0000005_DDD.exe!Unknown
  WATSON_STAGEONE_URL:  http://watson.microsoft.com/...
  Followup: MachineOwner
  ---------
  0:000&gt;
  </code></pre>
  
  <h3>Result of windbg .excr</h3>
  
  <pre><code>0:000&gt; .ecxr
  eax=0018d0c8 ebx=78b3b6a8 ecx=00cddb00 edx=01e4dcc0 esi=0138d2cc edi=0018cfc8
  eip=3822a497 esp=0018cfe4 ebp=00000002 iopl=0         nv up ei ng nz na po nc
  cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210282
  3822a497 006e00          add     byte ptr [esi],ch          ds:002b:0138d2cc=??
  </code></pre>
  
  <h2>Result of windbg r</h2>
  
  <pre><code>Last set context:
  eax=0018d0c8 ebx=78b3b6a8 ecx=00cddb00 edx=01e4dcc0 esi=0138d2cc edi=0018cfc8
  eip=3822a497 esp=0018cfe4 ebp=00000002 iopl=0         nv up ei ng nz na po nc
  cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210282
  3822a497 006e00          add     byte ptr [esi],ch          ds:002b:0138d2cc=??
  </code></pre>
  
  <h3>Disassembly before LAST_CONTROL_TRANSFER: from 00ccde67 to 3822a497</h3>
  
  <pre><code>current_time = timeGetTime();
  00CCDE34  call        dword ptr [__imp__timeGetTime@0 (17EE5FCh)]  
  (*it)-&gt;proc();
  00CCDE3A  mov         eax,dword ptr [ebx]  
  00CCDE3C  test        eax,eax  
  00CCDE3E  je          00CCDFFE  
  00CCDE44  test        edi,edi  
  00CCDE46  je          00CCDFFE  
  00CCDE4C  cmp         dword ptr [eax+4],edi  
  00CCDE4F  ja          00CCDFFE  
  00CCDE55  cmp         edi,dword ptr [eax+8]  
  00CCDE58  jae         00CCDFFE  
  00CCDE5E  mov         ecx,dword ptr [edi]  
  00CCDE60  mov         eax,dword ptr [ecx]  
  00CCDE62  mov         edx,dword ptr [eax+0Ch]  
  00CCDE65  call        edx
  00CCDE67  push        0
  </code></pre>
  
  <h1>EDIT</h1>
  
  <p>Oh I forgot to put stack state.</p>
  
  <h3>stack (esp=0x18cfe4)</h3>
  
  <pre><code>0x0018CFA4  00000000 00000000 00000000 00000000  ................
  0x0018CFB4  00000000 00000000 00000000 00000000  ................
  0x0018CFC4  00000000 fffffd34 000002e4 fffffd34  ....4?..?...4?..
  0x0018CFD4  000002cc 00000019 00000000 0018d0c8  ?...........??..
  0x0018CFE4 &gt;00ccde67 1a75cb52 00000000 28e86c00  g??.R?u......l?(
  0x0018CFF4  00000011 29b52260 00000000 78b3c718  ....`"?).....??x
  0x0018D004  29b522a0 00000000 78b3b6ac 29b522a0  ?"?)....???x?"?)
  0x0018D014  00000000 78b3b6a8 1a75cb52 00000140  ....???xR?u.@...
  0x0018D024  01e4f688 1a75cb52 0018d050 0170d884  ???.R?u.P?..??p.
  0x0018D034  ffffffff 0018d05c 0098ec41 1a75cb36  ....\?..A??.6?u.
  </code></pre>
  
  <h3>Disassembly around eip (0x3822A497)</h3>
  
  <pre><code>3822A490 54                   push        esp  
  3822A491 00                   db          00h  
  3822A492 65                   db          65h  
  3822A493 00 72 00             add         byte ptr [edx],dh  
  3822A496 61                   popad  
  3822A497 00 6E 00             add         byte ptr [esi],ch  
  3822A49A 69 00 74 00 65 00    imul        eax,dword ptr [eax],650074h
  </code></pre>
  
  <h3>Memory dump around eip (0x3822A497)</h3>
  
  <pre><code>0x3822A480  55da14f5 80000000 00001e08 00000024  ?.?U........$...
  0x3822A490  00650054 00610072 0069006e 00650074  T.e.r.a.n.i.t.e.
  0x3822A4A0  004e0020 00630065 006c006b 00630061   .N.e.c.k.l.a.c.
  0x3822A4B0  00000065 4d747cba 55da14f2 80000000  e...?|tM?.?U....
  </code></pre>
  
  <p>Obviously this is not valid instructions but wide characters text.
  I think it is very likely that callee broke <code>edx</code> information as xwlan said.
  ( And I thought <code>LAST_CONTROL_TRANSFER</code> is some kind of trustful information. It was just displaying last callstack entry to <code>eip</code> )</p>
  
  <p>But my suppositions still don't make a sense. Can somebody make a scenario that makes sense?</p>
  
  <h2>Suppose 1: instruction jumped before <code>0x3822A497</code> and executed <code>popad</code></h2>
  
  <p>I think this makes most sense. (e.g. could jumped by some indirection jump/call to pointer to text buffer <code>0x3822A490</code>)</p>
  
  <p>If so, <code>popad</code> would executed, which pops <code>EDI, ESI, EBP, EBX, EDX, ECX, and EAX</code> from stack.
  Then why can't I find these register's values from stack?
  For example, if so, shouldn't I see <code>0x00000002 (ebp)</code>, <code>0x01e4dcc0 (edx)</code> from stack near <code>0x0018CFE4 (esp)</code>?</p>
  
  <h2>Suppose 2: callee was not <code>0x3822A497</code> , instruction jumped exactly to <code>0x3822A497</code></h2>
  
  <p>I think it is very rare case.
  If jump was by indirect call/jmp, nothing would pointed to <code>0x3822A497</code> which is odd number,
  If jump was by relative call/jmp, the call instruction would be near <code>0x3822A497</code>,
  but I can't find such a relative calls when I disassembly from every point near <code>0x3822A497</code>
  and because it has ##, 00, ##, 00, ## pattern of wide character text,
  most possible jump instruction jumps to next instruction pointer, for example:</p>
  
  <pre><code>3822A494 72 00              &gt; jb          3822A496  
  3822A496 61                   popad  
  3822A497 00 6E 00             add         byte ptr [esi],ch  
  </code></pre>
  
  <h2>Suppose 3: Callee was <code>0x3822A497</code></h2>
  
  <p>then why edx is not <code>0x3822A497</code>. (First question)</p>