3

First I will describe the crash types I know about. Scroll down for the actual question. Note that I am only interested in crashes that are handled by Windows. Specific applications and frameworks sometimes have their own crash handlers (eg. Cygwin, the VCL, Java or .NET), which I will not discuss.

Dr Watson

On Windows XP, most unhandled "Structured Exceptions" such as access violations produce a Microsoft Application Error Reporting dialog (it was later renamed "Windows Error Reporting" but the executable is dwwin.exe and I will call it Dr Watson):

Dr Watson dialog

It is easily reproduced with *(char*)0=0;

FatalAppExit

Calling FatalAppExit() produces a MessageBox and Event Log entry, but no Dr Watson:

Fatal Application Exit

Stack overflow

On Windows XP a stack overflow causes the process to unceremoniously exit with no notification at all. (I think this was fixed starting with Vista)

It can be reproduced with main(){main();}

My question is, what causes one of these:

AcroRd32.exe - Application Error

This dialog is owned by csrss.exe, and by the time I see it, the AcroRd32.exe process has exited.

It also writes an entry in the System Event Log (which a Dr Watson crash doesn't do):

Application popup: AcroRd32.exe - Application Error : The exception unknown software exception (0xc0000409) occurred in the application at location 0x00404def.

I can reproduce the dialog and Event Log entry (but obviously not an actual crash), with this call to MessageBox:

MessageBox(
    0,
    "The exception unknown software exception (0xc0000409) occurred in the application at location 0x00404def.",
    "AcroRd32.exe - Application Error",
    MB_ICONSTOP | MB_SERVICE_NOTIFICATION);

I've ruled out Adobe Reader running as a service. It is version 11.0.08. The crash seems to happen sporadically when a Windows Explorer window with a PDF file selected becomes the active window.

Of course I'm not asking you to troubleshoot Adobe Reader for me, just how to produce an "Application Error" / "Application Popup" type of crash, preferably programmatically so I can understand what's going on.

Hugh Allen
  • 6,509
  • 1
  • 34
  • 44
  • FYI: `0xC0000409` is `STATUS_STACK_BUFFER_OVERRUN`. You could try passing it to `NtRaiseHardError`, but on Windows 7 that displays a very different message. (I don't have Windows XP to test at the moment) – Cauterite Mar 04 '17 at 14:03

2 Answers2

0

This looks like the work of kernel32.UnhandledExceptionFilter. You might be able to trigger this error message with:

EXCEPTION_RECORD Rec = {
    ExceptionCode : 0xc0000409, /* STATUS_STACK_BUFFER_OVERRUN */
    ExceptionAddress : cast(void*) 0x404def,
};

CONTEXT Ctx;
RtlCaptureContext(&Ctx);

EXCEPTION_POINTERS Xcep = {
    ExceptionRecord : &Rec,
    ContextRecord : &Ctx,
};
UnhandledExceptionFilter(&Xcep);

However on Windows 7 that didn't do it for me, it just went straight to Dr Watson.

What does seem to work on W7 is this:

size_t[2] Params = [
    0xc0000409, /* STATUS_STACK_BUFFER_OVERRUN */
    0x404def, /* exception address */
];

int Response;
NtRaiseHardError(
    0xc0000144 /* STATUS_UNHANDLED_EXCEPTION */ |
        0x10000000 /* HARDERROR_OVERRIDE_ERRORMODE */,
    Params.length,
    0, /* UnicodeStringParameterMask */
    Params.ptr,
    2 /* OptionOkCancel */,
    &Response
);

I know UnhandledExceptionFilter has this code somewhere, I just don't know what conditions it needs to take that code path. But you can just call NtRaiseHardError like this yourself.

Here's the result:

enter image description here

I don't use XP any more so you'll have to experiment yourself to see how these methods behave on XP, but hopefully this will give you a starting point.

Cauterite
  • 1,637
  • 17
  • 24
  • Thanks for the answer, but when I said "produce programmatically", I meant like an accidental crash, not calling a crash-handling function directly. In terms of my above examples, `*(char*)0=0;` rather than `MessageBox(...`. I want to understand what causes such error dialogs "in the natural course of events". – Hugh Allen Mar 08 '17 at 03:22
  • @HughAllen Hmm, yeah I wouldn't know how the system could even detect a `STACK_BUFFER_OVERRUN` itself, so it's possible Adobe rigged up their own exception handler or it's a feature of some particular C runtime library. Or maybe a compiler feature — some kind of exploit-mitigation mode. – Cauterite Mar 08 '17 at 08:50
0

The error dialog owned by CSRSS (which can also be programmatically triggered by a manual call to NtRaiseHardError, see this answer), is displayed on Windows when you have an unhandled exception. For all Win32 applications, a default exception handler for unhandled exceptions is set up by kernel32.dll, and this is this handler that does the job of either showing the Windows Error Reporting dialog, or showing the error dialog.

For the details, the open-source ReactOS project (which aim is to "re-create" Windows in an open-source way using clean-room RE) has similar code, that should help you knowing precisely in which conditions the error dialog appears: see the UnhandledExceptionFilter() function in dll/win32/kernel32/client/except.c.

ROS
  • 1