I think these error messages highlight how weak the error reporting culture is in Microsoft.
Since WerFault.exe is an error reporting component, this message leaves you to wonder: Is WerFault.exe reporting to you an error that happened in some other application, or is this an error occurring in the execution of the program WerFault.exe?
Since the message does not indicate any other program or process, I think it logically must be the latter, that the program WerFault.exe is failing due to a memory fault. The instruction addresses and memory addresses do not usually make sense without a
particular application or program, since each program (process) has its own address space, and the instruction address 0x747193a8
(e.g.) would be something completely different if it were in, say, winword.exe. So I conclude that this message means that an instruction belonging to the WerFault.exe program triggered a memory fault. More on that below.
Still there is another possibility, that the addresses are physical addresses, not virtual addresses. But it is usually
not informative to learn that an instruction in a particular physical memory location is making an incorrect or unsuccessful memory access. It would be extremely difficult to find out what application to fix. So I assume that the instruction addresses are
virtual addresses.
But nowadays even virtual addresses are not as informative as they used to. There is a specific type of "vulnerability",
or security weakness, where attackers provide malicious data to programs that fail to validate their inputs properly and allow buffer overflows t happen. Attackers carefully craft the input to overflow the program's buffers, overwriting subroutine return addresses
with pointers to code contained in the input. This code will make calls to routines in the program. But the attacker needs to know the addresses of the routines he wants to call. Nowadays this is thwarted by "address space randomization". Each time a program
is run, the routines are loaded to different places in the virtual address space. But then the information given in this message becomes meaningless.
Not all programs use such randomization, and I have not checked if Microsoft is using this technique. Therefore, it is possible that the message is meaningful, if randomization is
not used.
Now, assuming that the instruction address is meaningful, what is this error message actually telling? That the memory location at address 0x008d23a0
could not be read. There are two main reasons for this. We do not know if the program has any memory with that address. There could be a programming error, leading the program to want to access memory locations that were never allocated to the program. Or
there could be a hardware fault, where a memory module failed to return the contents of that memory location.
In the first case, the program WerFault.exe needs to be fixed. The address of the non-readable memory location may be
completely random, depending on the nature of the programming fault. Or it could be revealing for a programmer that wants to fix the error, and knows or has access to a memory map for the program.
In the second case, the address location is usually meaningless if it is a virtual address. Next time the program is
run, it would be loaded to a different part of the physical memory, and it may not use the faulty memory location at all. Instead a different program may have the faulty memory allocated to it, and fail mysteriously, or with similar messages. To find out what
memory location to fix, on would (in theory) have to determine in each case, what physical memory was used to carry the specified virtual memory location. But nobody does that. Memory modules are cheap, you do not repair them, you replace them.
But then there is a third possibility: It could be a physical memory fault, but a transient one. Cosmic radiation, radon
gas, and other sources of background radioactivity will randomly hit your memory and change it in unpredictable ways. If you have error correcting memory (more expensive), the memory module will notice and report the random change. Sometimes it will
even know how to fix it, but then it does not report it. But error correcting circuitry is itself prone to failures. I don't know what is the current state of the art in this regard. So I don't know if it is likely that the errors reported above are purely
transient.
To sum up, some guys inside Microsoft may know more about this, but the general "computer expert" has no way of reaching
a useful conclusion based on these error messages. The messages simply do not contain the needed information. All you can do, is to replace your computer if you get many such messages. Otherwise ignore them.
But take home the lesson that computers are not completely reliable. If you build something that can threaten your life
if it fails, you must use thorough methods of redundant computing to minimize the risk.
WerFault.exe
