What is 0x%08lx?

Question

I've been getting a lot of blue screens on my XP box at work recently. So many in fact that I downloaded debugging tools for windows(x86) and have been analyzing the crash dumps. So many in fact that I've changed the dumps to mini only or else I would probably end up tanking half a work day each week just waiting for the blue screen to finish recording the detailed crash log.

Almost without exception every dump tells me that the cause of the blue screen is some kind of memory misallocation or misreference and the memory at 0x%08lx referenced 0x%08lx and could not be %s.

Out of idle curiosity I put "0x%08lx" into Google and found that quite a few crash dumps include this bizarre message. Am I to take it that 0x%08lx is a place holder for something that should be meaningful? "%s" which is part of the concluding sentence "The memory could not be %s" definitely looks like it's missing a variable or something.

Does anyone know the provenance of this message? Is it actually supposed to be useful and what is it supposed to look like?

It's not a major thing I have always worked around it. It's just strange that so many people should see this in so many crash dumps and nobody ever says: "Oh the crash dump didn't complete that message properly it's supposed to read..."

I'm just curious as to whether anyone knows the purpose of this strange error message artefact.

Cress

Answer 1

I believe it is just the placeholder for the memory address. 0x is a string prefix that would notify the user that it is an hexadecimal, while %08lx is the actual placeholder for a long int (l) converted to hexadecimal (x) with a padding of 8 zeroes (08).

Cache

It all becomes "somewhat" more clear. Thanks for breaking down the weird placeholder code for me. – Cress

Answer 2

0x%08lx and %s are almost certainly format specifiers for the C function sprintf. But looks like the driver developers did as good a job in their error handling code as they did in the critical code, as you should never see these specifiers in the GUI -- they should be replaced with meaningful values.

0x%08lx should turn into something like "0xE001D4AB", a hexadecimal 32-bit pointer value.

%s should be replaced by another string, in this case a description. Something like

the memory at 0xE001D4AB referenced 0xE005123F and could not be read.

Note that I made up the values. Basically, a kernel mode access violation occurred. Hopefully in the mini dumps you can see which module caused it and uninstall / update / whatever it.

Xanthic

An embarrassment of riches here everyone's been somewhat helpful your +1 is for the render of how it should read. I am going with Andrea's answer as accepted because he breaks down why the format string is 0x%08lx. This is still really helpful. Thanks! – Cress

Answer 3

I am not a programmer, but I have tried to read many dumps and temp. files over the years. It seems that I have been having problems after upgrading from Win8.1, to Win10 over the last 2 days. From the ctfmon dump that I just got through looking at, it looked like it was referring to a combination of Win8.1 + Win10. ("Win X"?) As; "081x". Said that it should be "081x", and 'not', "'0x081x'"! Also, it looks like malware on my PC (From an unsolicited atieexx? driver.) causing the violation, by ctfmon, which "suddenly appeared", and both the driver and CTF loader were both running as programs. Mentioned "remote text input",(All remote svcs, server, etc. are disabled!) about 20 times, followed by many ?s, and buffer overflows, exceptions, you name it! Seemed the problem was "0", x 081x (Win:08.1/10.) %ws, (web socket.) as if the remote computer was '0'system? I just reprogrammed because of a nasty, undetectible, remote control hacker that I found by accident, when trying to run virtual box. (Blue screen.) "Tigger", I believe, (Dr Web). Left a file in program data named "krosqm"! ( My guess is "Kollide-remote-operating-system-quiet-management?) Looks like it is still hiding somewhere! Had to throw away 2 routers! Couldn't factory reset, and wireless quit working with flashing yellow light! Evil and Nasty. GMER is the only thing that saw it. Thought GRUB was the reason MBR was unknown, but supposedly "o.k.". ASWER MBR wouldn't repair. Breaking out BOOTICE now! But what do I know? I cant believe that no one really knows what this means! Everyone is guessing! I just thought I'd throw in a guess.

Visitation

As it's currently written, your answer is unclear. Please edit your post to improve readability or add additional details to clarify how it answers the question being asked. – Empennage