2

I'm developing and supporting Win32/.NET application. The application is a unmanaged/native executable extended by .NET modules. After last release it started to crash in random time. It crashes only in production environment and I'm unable to reproduce the bug. We usually use try/catch blocks for all threads, but nothing is getting logged. Unfortunately in production version are no AppDomain unhandled exceptions hooks.

The only information I get is following entry in system Event Log:

Error   XX.XX.XXXX XX:XX:XX
Application Error   1000    (100) "Faulting application name: XXXXX.EXE, version: X.X.0.0, time stamp: 0xXXXXXXXX
Faulting module name: KERNELBASE.dll, version: 6.3.9600.18666, time stamp: 0xXXXXXXXX
Exception code: 0xebad53fc
Fault offset: 0x00015608
Faulting process id: 0xXXX
Faulting application start time: 0xXXXXXXXXXXXXXXX
Faulting application path: C:\Program Files (x86)\XXXXX\XXXX.EXE
Faulting module path: C:\WINDOWS\SYSTEM32\KERNELBASE.dll
Faulting package full name: 
Faulting package-relative application ID: "
Error   XX.XX.XXXX XX:XX:XX .NET Runtime    1026    None    Application: XXXXX.EXE
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code ebad53fc, exception address 753B5608
Stack:

The event stored in Event Log suggests me that something went wrong in .NET code.

I have requested my customer to create crash dump after each application crash by using Windows Task Manager. After few days I've got few DMP files, but there are no interesting information there. Most of threads are in waiting or GetMessage(UI) state. There are no KERNELBASE.dll!_UnhandledExceptionFilter or similar procedures calls. Crash dumps have no information about exception and exception code. Everything looks fine.

I've made few experiments and initiated few application crashes manually from .NET code. Experimental crash dumps contain useful information. Especially stack frames passing from .NET code through KERNELBASE.dll!_UnhandledExceptionFilter.

I wonder why crash dumps from customer look fine and why the event logged in Event Log says that faulting module is KERNELBASE.DLL, but error occurred in .NET Runtime.

Rakoo
  • 546
  • 5
  • 16
  • 2
    I suggest to create [registry key](https://msdn.microsoft.com/en-us/library/windows/desktop/bb787181(v=vs.85).aspx) on user machine to generate crash dump. Should be more reliable than task manager method. – zett42 Jul 17 '17 at 14:05
  • 1
    Of course there are no exception records, when users create a dump *after* the fact. You'll need to create a dump file in your software from an unhandled exception filter, or use WER as suggested by @zett42. – IInspectable Jul 17 '17 at 14:12
  • 1
    `ebad53fc` this is very unique and rarely exception code. i be begin from search 4 raw bytes `fc 53 ad eb` in modules which used by your program. – RbMm Jul 17 '17 at 14:43
  • In crash dump I've found memory address where exception code is stored. Found memory address belongs to Stack64 section. From such information I've found the thread which could cause the exception. I've also reconstructed a full stack trace, but there are no information about unhandled exceptions. The last call in stack trace is: user32!NtUserSetFocus+0xc. – Rakoo Jul 18 '17 at 11:21
  • 1
    Possible duplicate of [How do I take a good crash dump for .NET?](https://stackoverflow.com/questions/24874027/how-do-i-take-a-good-crash-dump-for-net) – Thomas Weller Jul 19 '17 at 19:25

0 Answers0