Application fault string

WINDBG
1

Hi,

Can you please explain the following from windbg?
!analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*** WARNING: Unable to verify checksum for sqlapi.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sqlapi.dll -
*** WARNING: Unable to verify checksum for mtmanapi.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mtmanapi.dll -
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/WinService_exe/0_0_0_0/4e0a181a/msvcp100_dll/10_0_30319_1/4ba1dbdd/c0000005/0000c6d4.htm?Retriage=1

FAULTING_IP:
msvcp100!std::ctype::is+8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
6feec6d4 ff6008 jmp dword ptr [eax+8]

EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
ExceptionAddress: 6feec6d4 (msvcp100!std::ctype::is+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 3330653a
Attempt to read from address 3330653a

DEFAULT_BUCKET_ID: STRING_DEREFERENCE

PROCESS_NAME: WinService.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 3330653a

READ_ADDRESS: 3330653a

FOLLOWUP_IP:
msvcp100!std::ctype::is+8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
6feec6d4 ff6008 jmp dword ptr [eax+8]

MOD_LIST:

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

FAULTING_THREAD: 0000d720

PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE

BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER: from 0004c089 to 6feec6d4

STACK_TEXT:
0250fba0 0004c089 00000077 00000061 0250fcd0 msvcp100!std::ctype::is+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 0005017b 0005017c 00000000 WinService!std::tr1::_Regex_traits::lookup_classname+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 00000001 00000000 0004962c WinService!std::tr1::_Parser >::_CharacterClassEscape+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_AtomEscape+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_Alternative+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 0250fcd0 00000000 0004a1f4 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 0250fcd0 0250fcd0 00049729 WinService!std::tr1::_Parser >::_Do_capture_group+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 0250fce8 0250fcd0 00952d78 WinService!std::tr1::_Parser >::_Wrapped_disjunction+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 0250fce8 00000000 00952d78 WinService!std::tr1::_Parser >::_Alternative+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f 5fc2d39e 00954cb8 00000000 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 0250fcd0 5fc2d38e 00954cd1 WinService!std::tr1::_Parser >::_Compile+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe 00000000 00954cb8 00000000 WinService!MatchOrder+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 00954cb8 0250fdc4 76f116c3 WinService!ManipThread+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 00954cb8 c335b6ec 00000000 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 00041b90 00954cb8 ffffffff ntdll!_RtlUserThreadStart+0x23
0250fddc 00000000 00041b90 00954cb8 00000000 ntdll!RtlUserThreadStart+0x1b

STACK_COMMAND: ~8s; .ecxr ; kb

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: msvcp100!std::ctype::is+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msvcp100

IMAGE_NAME: msvcp100.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4ba1dbdd

FAILURE_BUCKET_ID: STRING_DEREFERENCE_c0000005_msvcp100.dll!std::ctype_unsigned_short::is

BUCKET_ID: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_msvcp100!std::ctype_unsigned_short::is+8

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WinService_exe/0_0_0_0/4e0a181a/msvcp100_dll/10_0_30319_1/4ba1dbdd/c0000005/0000c6d4.htm?Retriage=1

Followup: MachineOwner
---------

0:008> kb
ChildEBP RetAddr Args to Child
0250fba0 0004c089 00000077 00000061 0250fcd0 msvcp100!std::ctype::is+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 0005017b 0005017c 00000000 WinService!std::tr1::_Regex_traits::lookup_classname+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 00000001 00000000 0004962c WinService!std::tr1::_Parser >::_CharacterClassEscape+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_AtomEscape+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_Alternative+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 0250fcd0 00000000 0004a1f4 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 0250fcd0 0250fcd0 00049729 WinService!std::tr1::_Parser >::_Do_capture_group+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 0250fce8 0250fcd0 00952d78 WinService!std::tr1::_Parser >::_Wrapped_disjunction+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 0250fce8 00000000 00952d78 WinService!std::tr1::_Parser >::_Alternative+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f 5fc2d39e 00954cb8 00000000 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 0250fcd0 5fc2d38e 00954cd1 WinService!std::tr1::_Parser >::_Compile+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe 00000000 00954cb8 00000000 WinService!MatchOrder+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 00954cb8 0250fdc4 76f116c3 WinService!ManipThread+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 00954cb8 c335b6ec 00000000 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 00041b90 00954cb8 ffffffff ntdll!__RtlUserThreadStart+0x23
0250fddc 00000000 00041b90 00954cb8 00000000 ntdll!_RtlUserThreadStart+0x1b
0:008> kP
ChildEBP RetAddr
0250fba0 0004c089 msvcp100!std::ctype::is(
short _Maskval = 0n119,
unsigned short _Ch = 0x61)+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 WinService!std::tr1::_Regex_traits::lookup_classname(
char * _First = 0x0005017b “w+|\d+)|(SUB|USB)|S|order-(\d+)-(\d+)-(\w+)$”,
char * _Last = 0x0005017c “+|\d+)|(SUB|USB)|S|order-(\d+)-(\d+)-(\w+)$”,
bool _Icase = false)+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 WinService!std::tr1::_Parser >::_CharacterClassEscape(
bool _Addit = true)+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c WinService!std::tr1::_Parser >::_AtomEscape(void)+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 WinService!std::tr1::_Parser >::_Alternative(void)+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 WinService!std::tr1::_Parser >::_Disjunction(void)+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 WinService!std::tr1::_Parser >::_Do_capture_group(void)+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 WinService!std::tr1::_Parser >::_Wrapped_disjunction(void)+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 WinService!std::tr1::_Parser >::_Alternative(void)+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f WinService!std::tr1::_Parser >::_Disjunction(void)+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 WinService!std::tr1::_Parser >::_Compile(void)+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe WinService!MatchOrder(
char * str = 0x00954cb8 “3e00000130d775b3d8|USB|S|order-1961932-50-EURUSD”)+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 WinService!ManipThread(
void * lpvParam = 0x00954cb8)+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 ntdll!__RtlUserThreadStart+0x23
0250fddc 00000000 ntdll!_RtlUserThreadStart+0x1b
0:008> r
eax=33306532 ebx=0250fbbc ecx=00934440 edx=00000077 esi=0005017b edi=0250fcc4
eip=6feec6d4 esp=0250fb78 ebp=0250fba0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
msvcp100!std::ctype::is+0x8:
6feec6d4 ff6008 jmp dword ptr [eax+8] ds:0023:3330653a=???

This a crash dump for a windows service I wrote, I wasn’t able to catch the crash until I attached Adplus to the service on a testing server.
What I understand is that its refrencing an invalid memory at 3330653a, but the stack trace shows nothing remarkable on this.

Thanks in advance,

2

My first suggestion would be to set the symbol server to the Microsoft symbols with your own local store and then do the analyze again.

Gary G. Little

----- Original Message -----
From: “forget about aj”
To: “Kernel Debugging Interest List”
Sent: Wednesday, June 29, 2011 1:30:05 PM
Subject: [windbg] Application fault string

Hi,

Can you please explain the following from windbg?
!analyze -v

*
Exception Analysis *
*
***

WARNING: Unable to verify checksum for sqlapi.dll
ERROR: Symbol file could not be found. Defaulted to export symbols for sqlapi.dll -
WARNING: Unable to verify checksum for mtmanapi.dll
ERROR: Symbol file could not be found. Defaulted to export symbols for mtmanapi.dll -
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/WinService_exe/0_0_0_0/4e0a181a/msvcp100_dll/10_0_30319_1/4ba1dbdd/c0000005/0000c6d4.htm?Retriage=1

FAULTING_IP:
msvcp100!std::ctype::is+8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
6feec6d4 ff6008 jmp dword ptr [eax+8]

EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
ExceptionAddress: 6feec6d4 (msvcp100!std::ctype::is+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 3330653a
Attempt to read from address 3330653a

DEFAULT_BUCKET_ID: STRING_DEREFERENCE

PROCESS_NAME: WinService.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 3330653a

READ_ADDRESS: 3330653a

FOLLOWUP_IP:
msvcp100!std::ctype::is+8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
6feec6d4 ff6008 jmp dword ptr [eax+8]

MOD_LIST:

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

FAULTING_THREAD: 0000d720

PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE

BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER: from 0004c089 to 6feec6d4

STACK_TEXT:
0250fba0 0004c089 00000077 00000061 0250fcd0 msvcp100!std::ctype::is+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 0005017b 0005017c 00000000 WinService!std::tr1::_Regex_traits::lookup_classname+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 00000001 00000000 0004962c WinService!std::tr1::_Parser >::_CharacterClassEscape+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_AtomEscape+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_Alternative+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 0250fcd0 00000000 0004a1f4 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 0250fcd0 0250fcd0 00049729 WinService!std::tr1::_Parser >::_Do_capture_group+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 0250fce8 0250fcd0 00952d78 WinService!std::tr1::_Parser >::_Wrapped_disjunction+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 0250fce8 00000000 00952d78 WinService!std::tr1::_Parser >::_Alternative+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f 5fc2d39e 00954cb8 00000000 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 0250fcd0 5fc2d38e 00954cd1 WinService!std::tr1::_Parser >::_Compile+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe 00000000 00954cb8 00000000 WinService!MatchOrder+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 00954cb8 0250fdc4 76f116c3 WinService!ManipThread+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 00954cb8 c335b6ec 00000000 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 00041b90 00954cb8 ffffffff ntdll!_RtlUserThreadStart+0x23
0250fddc 00000000 00041b90 00954cb8 00000000 ntdll!RtlUserThreadStart+0x1b

STACK_COMMAND: ~8s; .ecxr ; kb

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: msvcp100!std::ctype::is+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msvcp100

IMAGE_NAME: msvcp100.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4ba1dbdd

FAILURE_BUCKET_ID: STRING_DEREFERENCE_c0000005_msvcp100.dll!std::ctype_unsigned_short::is

BUCKET_ID: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_msvcp100!std::ctype_unsigned_short::is+8

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WinService_exe/0_0_0_0/4e0a181a/msvcp100_dll/10_0_30319_1/4ba1dbdd/c0000005/0000c6d4.htm?Retriage=1

Followup: MachineOwner
---------

0:008> kb
ChildEBP RetAddr Args to Child
0250fba0 0004c089 00000077 00000061 0250fcd0 msvcp100!std::ctype::is+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 0005017b 0005017c 00000000 WinService!std::tr1::_Regex_traits::lookup_classname+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 00000001 00000000 0004962c WinService!std::tr1::_Parser >::_CharacterClassEscape+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_AtomEscape+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 0250fce8 0250fcd0 00952db8 WinService!std::tr1::_Parser >::_Alternative+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 0250fcd0 00000000 0004a1f4 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 0250fcd0 0250fcd0 00049729 WinService!std::tr1::_Parser >::_Do_capture_group+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 0250fce8 0250fcd0 00952d78 WinService!std::tr1::_Parser >::_Wrapped_disjunction+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 0250fce8 00000000 00952d78 WinService!std::tr1::_Parser >::_Alternative+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f 5fc2d39e 00954cb8 00000000 WinService!std::tr1::_Parser >::_Disjunction+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 0250fcd0 5fc2d38e 00954cd1 WinService!std::tr1::_Parser >::_Compile+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe 00000000 00954cb8 00000000 WinService!MatchOrder+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 00954cb8 0250fdc4 76f116c3 WinService!ManipThread+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 00954cb8 c335b6ec 00000000 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 00041b90 00954cb8 ffffffff ntdll!__RtlUserThreadStart+0x23
0250fddc 00000000 00041b90 00954cb8 00000000 ntdll!_RtlUserThreadStart+0x1b
0:008> kP
ChildEBP RetAddr
0250fba0 0004c089 msvcp100!std::ctype::is(
short _Maskval = 0n119,
unsigned short _Ch = 0x61)+0x8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
0250fbc8 0004b066 WinService!std::tr1::_Regex_traits::lookup_classname(
char * _First = 0x0005017b “w+|\d+)|(SUB|USB)|S|order-(\d+)-(\d+)-(\w+)$”,
char * _Last = 0x0005017c “+|\d+)|(SUB|USB)|S|order-(\d+)-(\d+)-(\w+)$”,
bool _Icase = false)+0x49 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 381]
0250fbfc 0004a131 WinService!std::tr1::_Parser >::_CharacterClassEscape(
bool _Addit = true)+0x46 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4513]
0250fc08 0004962c WinService!std::tr1::_Parser >::_AtomEscape(void)+0x91 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4863]
0250fc18 00048cc0 WinService!std::tr1::_Parser >::_Alternative(void)+0x1fc [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4950]
0250fc38 0004b558 WinService!std::tr1::_Parser >::_Disjunction(void)+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fc44 0004a1f4 WinService!std::tr1::_Parser >::_Do_capture_group(void)+0x78 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4665]
0250fc50 00049729 WinService!std::tr1::_Parser >::_Wrapped_disjunction(void)+0xa4 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4724]
0250fc60 00048cc0 WinService!std::tr1::_Parser >::_Alternative(void)+0x2f9 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 4962]
0250fc80 0004899f WinService!std::tr1::_Parser >::_Disjunction(void)+0x20 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5002]
0250fca8 00047976 WinService!std::tr1::_Parser >::_Compile(void)+0x8f [c:\program files (x86)\microsoft visual studio 10.0\vc\include\regex @ 5034]
0250fd28 00041bfe WinService!MatchOrder(
char * str = 0x00954cb8 “3e00000130d775b3d8|USB|S|order-1961932-50-EURUSD”)+0x76 [d:\projects\winservice\winservice\matchregex.cpp @ 25]
0250fd78 76e3d0e9 WinService!ManipThread(
void * lpvParam = 0x00954cb8)+0x6e [d:\projects\winservice\winservice\main.cpp @ 662]
0250fd84 76f116c3 kernel32!BaseThreadInitThunk+0xe
0250fdc4 76f11696 ntdll!__RtlUserThreadStart+0x23
0250fddc 00000000 ntdll!_RtlUserThreadStart+0x1b
0:008> r
eax=33306532 ebx=0250fbbc ecx=00934440 edx=00000077 esi=0005017b edi=0250fcc4
eip=6feec6d4 esp=0250fb78 ebp=0250fba0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
msvcp100!std::ctype::is+0x8:
6feec6d4 ff6008 jmp dword ptr [eax+8] ds:0023:3330653a=???

This a crash dump for a windows service I wrote, I wasn’t able to catch the crash until I attached Adplus to the service on a testing server.
What I understand is that its refrencing an invalid memory at 3330653a, but the stack trace shows nothing remarkable on this.

Thanks in advance,

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Thank you Gary, actually you can see this in the output, its already configured, but there are just third part DLL I use and there are no public symbols for them.

4

xxxxx@hotmail.com wrote:

Can you please explain the following from windbg?
!analyze -v
…
FAULTING_IP:
msvcp100!std::ctype::is+8 [f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale @ 2711]
> 6feec6d4 ff6008 jmp dword ptr [eax+8]
>
> EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
> ExceptionAddress: 6feec6d4 (msvcp100!std::ctype::is+0x00000008)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 3330653a
> Attempt to read from address 3330653a
> …
> This a crash dump for a windows service I wrote, I wasn’t able to catch the crash until I attached Adplus to the service on a testing server.
> What I understand is that its refrencing an invalid memory at 3330653a, but the stack trace shows nothing remarkable on this.

3330653a minus 8 (because the jump is to eax+8) is an ASCII string –
the ASCII characters “2e03”. You have the source code for this CRT in
your Visual Studio setup. This is ctype::is, trying to call the do_is
function. You have probably overwritten stack or heap memory so that
you wiped out the vtable of this object.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

Thank you Tim, yes I can see this on the CRT source code, actually I have a thread “ManipThread” that calls MatchSymbol and then goes along the chain shown in the output of !analyze -v, the thread is created every time data recieved on a socket. what do you suggest Tim to solve this problem? I’m not able to generate the same crash on my development machine within visual studio.

Regards,

6

xxxxx@hotmail.com wrote:

Thank you Tim, yes I can see this on the CRT source code, actually I have a thread “ManipThread” that calls MatchSymbol and then goes along the chain shown in the output of !analyze -v, the thread is created every time data recieved on a socket. what do you suggest Tim to solve this problem? I’m not able to generate the same crash on my development machine within visual studio.

Well, in that case you’re down to deskchecking. Does your socket
handler handle partial packets? Do you combine buffers if a transfer
gets split into multiple packets? Are you handling that repacking
correctly? Is any part of your data hex or floating point stored as
strings? (“2e30” could be a hex value, or it could be a float.)

My guess is you are receiving some unexpected input that sends you into
the weeds.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

7

Tim,
Sorry I mean Matchorder not MathSymbol as shown in the output of kP,
if you look at Machorder it receives a pointer to a string which is:3e00000130d775b3d8|USB|S|order-1961932-50-EURUSD, I have no hex or floating point received on the socket and Mathorder should do some regular expression on that string.

Thanks,

8

Try “verifier” to be able to catch problem earlier.

From: xxxxx@hotmail.com
To: “Kernel Debugging Interest List”
Date: 06/29/2011 03:35 PM
Subject: RE:[windbg] Application fault string
Sent by: xxxxx@lists.osr.com

Thank you Tim, yes I can see this on the CRT source code, actually I have
a thread “ManipThread” that calls MatchSymbol and then goes along the
chain shown in the output of !analyze -v, the thread is created every time
data recieved on a socket. what do you suggest Tim to solve this problem?
I’m not able to generate the same crash on my development machine within
visual studio.

Regards,

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

xxxxx@hotmail.com wrote:

Sorry I mean Matchorder not MathSymbol as shown in the output of kP,
if you look at Machorder it receives a pointer to a string which is:3e00000130d775b3d8|USB|S|order-1961932-50-EURUSD, I have no hex or floating point received on the socket and Mathorder should do some regular expression on that string.

Well, that string clearly contains a series of hex digits. You might
find you are either storing that string into a buffer that isn’t large
enough, or are storing it at an incorrect location. Also note that, as
always with memory corruption, the corruption itself might have happened
well before the function that happened to trigger the crash.

Here’s an example of how this kind of thing can happen:

std::string abc;
abc.resize( 40 );
strcpy( &abc, “1234567890” );

“abc” contains virtual functions, so the first thing in the object is a
pointer to a virtual function table.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

10

Thanks Tim for help, yes I got you, what I meant is that the string is a mix digits and alphas.
but can please clarify what you mean by incorrect location.

Thanks,

Ahmad Hamad

11

xxxxx@hotmail.com wrote:

Thanks Tim for help, yes I got you, what I meant is that the string is a mix digits and alphas.
but can please clarify what you mean by incorrect location.

I showed you an example in my last message. Really, without seeing the
code that triggered this, there’s not much more we can do. You need to
debug this.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.