Unloaded Modules List

[Larry]

Windbg is reporting an unloaded module that is suspicious:

0:069> lmv m l.dll
start end module name
....
....
Unloaded modules:
000000a1 48975e04 l.dll
Timestamp: Wed Mar 25 05:31:05 1970 (006E0069)
Checksum: 006D0078

Is it possible that this is some indication of memory corruption? The
unloaded modules don't appear to be tracked in the _LDR_DATA lists.
I was hoping I could dump the data around this area and see if
anything looked out of place. Any suggestions?

[Kjell Gunnar]

I have a Script which may be of help, here you can see the time in
hex:
copy the folowing to C:\tt\Disp_unload_mod.txt
-------
$$ run with: $$>< C:\tt\Disp_unload_mod.txt
$$ Get start of array in $t0.
r? $t0 = @@masm(ntdll!RtlpUnloadEventTrace)
.echo Addr Base Size Time Module
.for(r $t2=0; @$t2 < 0n16; r $t2 = @$t2 + 1)
{
as /x $Addr @$t0
as /x $Base poi(@$t0)
as /x $Size poi(@$t0 + 4)
as /x $time poi( @$t0 + 4 * 3 )
as /mu ${/v:$Mod} @$t0 + (5*4)
.block
{
.echo ${$Addr}: ${$Base} ${$Size} ${$time} ${$Mod}

}
ad ${/v:$Addr}
ad ${/v:$Base}
ad ${/v:$Size}
ad ${/v:$time}
ad ${/v:$Mod}

r? $t0 = @$t0+ 0x0054

}
------
Regards
Kjell Gunnar