On 29/10/2022 09:32, Corinna Vinschen wrote:
> On Oct 28 16:05, Jon Turney wrote:
>> This adds an extra section to the stackdump, which lists the loaded
>> modules and their base address.  This is perhaps useful as it makes it
>> immediately clear if RandomCrashInjectedDll.dll is loaded...
>>
>> XXX: It seems like the 'InMemoryOrder' part of 'InMemoryOrderModuleList' is a lie?
> 
> Probably just an alternative fact...

Yeah.  I did stared a bit at the code wondering if the structure layouts 
were incorrect so we were somehow traversing one of the other module 
lists with a different ordering, but everything looks correct.

The attached might be a good idea, then, to ensure that module+offset is 
calculated correctly.