anyconnect version:
4.8.01090
I try to open windows mini dump in windbg, and got some clue:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2748.3ac4): Access violation - code c0000005 (first/second chance not available)
....
....
Attempt to read from address 00000000
windbg !analyze -v output:
Loading unloaded module list
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2748.3ac4): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
eax=00000000 ebx=00000000 ecx=0230fc10 edx=00000000 esi=00000003 edi=00000003
eip=77b0148c esp=0230f250 ebp=0230f3e0 iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216
ntdll!NtWaitForMultipleObjects+0xc:
77b0148c c21400 ret 14h
0:005> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify timestamp for vpnagent.exe
*** WARNING: Unable to verify timestamp for vpncommon.dll
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Read
Key : Timeline.Process.Start.DeltaSec
Value: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
Timeline: !analyze.Start
Name: <blank>
Time: 2020-01-31T03:12:54.612Z
Diff: 376612 mSec
Timeline: Dump.Current
Name: <blank>
Time: 2020-01-31T03:06:38.0Z
Diff: 0 mSec
Timeline: Process.Start
Name: <blank>
Time: 2020-01-31T03:06:37.0Z
Diff: 1000 mSec
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
eax=00000000 ebx=00000000 ecx=0230fc10 edx=00000000 esi=0230fc10 edi=00000000
eip=73ba190a esp=0230fb8c ebp=0230fb94 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
vpnagentutilities+0x190a:
73ba190a 3807 cmp byte ptr [edi],al ds:002b:00000000=??
Resetting default scope
FAULTING_IP:
vpnagentutilities+190a
73ba190a 3807 cmp byte ptr [edi],al
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 73ba190a (vpnagentutilities+0x0000190a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_POINTER_READ
PROCESS_NAME: vpnagent.exe
FOLLOWUP_IP:
vpnagentutilities+190a
73ba190a 3807 cmp byte ptr [edi],al
READ_ADDRESS: 00000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000000
WATSON_BKT_PROCSTAMP: 5b903646
WATSON_BKT_PROCVER: 4.6.3049.0
WATSON_BKT_MODULE: vpnagentutilities.dll
WATSON_BKT_MODSTAMP: 5b903500
WATSON_BKT_MODOFFSET: 190a
WATSON_BKT_MODVER: 4.6.3049.0
BUILD_VERSION_STRING: 19041.1.x86fre.vb_release.191206-1406
MODLIST_WITH_TSCHKSUM_HASH: 7c6794ea2b1120d1dc90c8ad33b25a3a0d199cda
MODLIST_SHA1_HASH: 754f9af5b00540c39f40d81e7cdce633643c7cb5
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
DUMP_FLAGS: 8000294
DUMP_TYPE: 1
ANALYSIS_SESSION_HOST: HOUCHEN-PC
ANALYSIS_SESSION_TIME: 01-31-2020 11:12:54.0612
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
THREAD_ATTRIBUTES:
OS_LOCALE: CHS
BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_READ_INVALID_POINTER_READ
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
PROBLEM_CLASSES:
ID: [0n313]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x3ac4]
Frame: [0] : vpnagentutilities
ID: [0n285]
Type: [INVALID_POINTER_READ]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x3ac4]
Frame: [0] : vpnagentutilities
ID: [0n300]
Type: [NULL_POINTER_READ]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x2748]
TID: [0x3ac4]
Frame: [0] : vpnagentutilities
LAST_CONTROL_TRANSFER: from 73bd9774 to 73ba190a
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
0230fb94 73bd9774 00000000 e5a5bbe4 0000aaa4 vpnagentutilities+0x190a
0230fbc4 73bd9874 0230fc10 0102f4c8 5b73a7e3 vpnagentutilities+0x39774
0230fc38 008a2d3d 00000000 760c01c0 0101cd00 vpnagentutilities+0x39874
0230fc50 6f63d541 0101cd00 6f63d594 0230fc6c vpnagent+0x32d3d
0230fc60 6f63d59f 00fdded8 0230fca4 7653505f vpncommon+0x6d541
0230fc6c 7653505f 00fdded8 b0a3613d 76535020 vpncommon+0x6d59f
0230fca4 776df989 0101cd00 776df970 0230fd10 ucrtbase!thread_start<unsigned int (__stdcall*)(void *),1>+0x3f
0230fcb4 77af5de4 0101cd00 45ee99e2 00000000 kernel32!BaseThreadInitThunk+0x19
0230fd10 77af5db4 ffffffff 77b16093 00000000 ntdll!__RtlUserThreadStart+0x2f
0230fd20 00000000 76535020 0101cd00 00000000 ntdll!_RtlUserThreadStart+0x1b
THREAD_SHA1_HASH_MOD_FUNC: 9e5fb5b3f80ab1a0dfcc02a9b4395289dac5f722
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 170bbc193631b30c0585e6a9de902e74cd19ea04
THREAD_SHA1_HASH_MOD: 156ac8e451ac8f7911816026d9d463e7a00bdd58
FAULT_INSTR_CODE: 8740738
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: vpnagentutilities+190a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: vpnagentutilities
IMAGE_NAME: vpnagentutilities.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5b903500
STACK_COMMAND: ~5s ; .ecxr ; kb
FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_vpnagentutilities.dll!Unknown
BUCKET_ID: APPLICATION_FAULT_NULL_POINTER_READ_INVALID_POINTER_READ_vpnagentutilities+190a
FAILURE_EXCEPTION_CODE: c0000005
FAILURE_IMAGE_NAME: vpnagentutilities.dll
BUCKET_ID_IMAGE_STR: vpnagentutilities.dll
FAILURE_MODULE_NAME: vpnagentutilities
BUCKET_ID_MODULE_STR: vpnagentutilities
FAILURE_FUNCTION_NAME: Unknown
BUCKET_ID_FUNCTION_STR: Unknown
BUCKET_ID_OFFSET: 190a
BUCKET_ID_MODTIMEDATESTAMP: 5b903500
BUCKET_ID_MODCHECKSUM: c2ffa
BUCKET_ID_MODVER_STR: 4.6.3049.0
BUCKET_ID_PREFIX_STR: APPLICATION_FAULT_NULL_POINTER_READ_INVALID_POINTER_READ_
FAILURE_PROBLEM_CLASS: APPLICATION_FAULT
FAILURE_SYMBOL_NAME: vpnagentutilities.dll!Unknown
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/vpnagent.exe/4.6.3049.0/5b903646/vpnagentutilities.dll/4.6.3049.0/5b903500/c0000005/0000190a.htm?Retriage=1
TARGET_TIME: 2020-01-31T03:06:38.000Z
OSBUILD: 19041
OSSERVICEPACK: 1
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 256
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x86
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt SingleUserTS
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 191206-1406
BUILDLAB_STR: vb_release
BUILDOSVER_STR: 10.0.19041.1.x86fre.vb_release.191206-1406
ANALYSIS_SESSION_ELAPSED_TIME: 309cf
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:null_pointer_read_c0000005_vpnagentutilities.dll!unknown
FAILURE_ID_HASH: {e3c336f6-08bb-df75-8430-259b20e951da}
Followup: MachineOwner
