Dump analysis

Hi All,

Can anyone please help me analyse the follwing dump.

This heap stop was caused by Application Verfier.

(eec.c0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=042f0b05 ebx=033d8b88 ecx=00007ec1 edx=00000001 esi=042d1000
edi=043864f8
eip=77c472e3 esp=033d8ac4 ebp=033d8acc iopl=0 nv up ei pl nz ac pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010212
msvcrt!memmove+0x33:
77c472e3 f3a5 rep movsd ds:042d1000=???
es:043864f8=c0c0c0c0
0:001> g

=======================================
VERIFIER STOP 00000013 : pid 0xEEC: First chance access violation for
current stack trace.

042D1000 : Invalid address causing the exception.
77C472E3 : Code address executing the invalid access.
033D87DC : Exception record.
033D87F8 : Context record.

0:001> !ext heap -p -a 042D1000
No export ext found
0:001> !ext.heap -p -a 042D1000
address 042d1000 found in
_DPH_HEAP_ROOT @ 81000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize

  • VirtAddr VirtSize)
    3039e40: 42c1000 10000
  • 42c0000 12000
    7c91b298 ntdll!RtlAllocateHeap+0x00000e64
    003ab4ed vfbasics!AVrfpRtlAllocateHeap+0x000000cd
    7c8099df kernel32!LocalAlloc+0x00000058
    003abd0d vfbasics!AVrfpLocalAlloc+0x0000009d
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for
    D:\Program Files\MyProj\nlhtml.dll -
    041f7249 nlhtml!DllRegisterServer+0x00005568
    041f2c3e nlhtml!DllRegisterServer+0x00000f5d
    041f2898 nlhtml!DllRegisterServer+0x00000bb7
    041efe9b nlhtml!DllGetClassObject+0x0000193d
    041f433d nlhtml!DllRegisterServer+0x0000265c
    041ed47b nlhtml+0x0000d47b
    041ee1d3 nlhtml+0x0000e1d3
    03b846d5 MyFilt!CMyAttachStorage::HrBuildIFilter+0x00000585
    03b840c0 MyFilt!CMyAttachStorage::HrHandleStream+0x00000050
    03b83f1e MyFilt!CMyAttachStorage::HrGetNextChunk+0x0000009e
    03b853bb MyFilt!CMyFiltBaseStorage::HrGetChunk+0x0000007b
    03b87925 MyFilt!CMyFiltPrimaryStorage::HrGetChunk+0x00000065

0:001> kp
ChildEBP RetAddr
033d8464 0040383d ntdll!DbgBreakPoint
033d8664 004072c9 vrfcore!VerifierStopMessageEx(struct
_AVRF_LAYER_DESCRIPTOR * LayerDescriptor = 0x0040b5d8, unsigned long
StopCode = 0x13, unsigned long Param1 = 0x42d1000, unsigned long Param2 =
0x77c472e3, unsigned long Param3 = 0x33d87dc, unsigned long Param4 =
0x33d87f8, struct _AVRF_STOP_EXTRA * StopExtra = 0x00000000, unsigned long
StopIsDisabled = 0)+0x518 [e:\avrf\source\base\avrf\avrf30\vrfcore\sdk.cpp @
523]
033d8688 003b2dd9 vrfcore!VfCoreRedirectedStopMessage(unsigned long Code =
0x13, char * Message = 0x003a31e8 “first chance access violation for current
stack trace”, unsigned long Param1 = 0x42d1000, char * Description1 =
0x003a3220 “Invalid address being accessed”, unsigned long Param2 =
0x77c472e3, char * Description2 = 0x003a21f8 “Code performing invalid
access”, unsigned long Param3 = 0x33d87dc, char * Description3 = 0x003a2218
“Exception record. Use .exr to display it.”, unsigned long Param4 =
0x33d87f8, char * Description4 = 0x003a2244 “Context record. Use .cxr to
display it.”)+0x81 [e:\avrf\source\base\avrf\avrf30\vrfcore\stopredirect.cpp
@ 103]
033d86b8 003a9429 vfbasics!VfBasicsStopMessage(unsigned long Code = 0x13,
char * Message = 0x003a31e8 “first chance access violation for current stack
trace”, unsigned long Param1 = 0x42d1000, char * Description1 = 0x003a3220
“Invalid address being accessed”, unsigned long Param2 = 0x77c472e3, char *
Description2 = 0x003a21f8 “Code performing invalid access”, unsigned long
Param3 = 0x33d87dc, char * Description3 = 0x003a2218 “Exception record. Use
.exr to display it.”, unsigned long Param4 = 0x33d87f8, char * Description4
= 0x003a2244 “Context record. Use .cxr to display it.”)+0x1c9
[e:\avrf\source\base\avrf\avrf30\providers\basics\basics.c @ 1091]
033d871c 003a8b68 vfbasics!AVrfpCheckFirstChanceException(struct
_EXCEPTION_POINTERS * ExceptionPointers = 0x033d8744)+0x139
[e:\avrf\source\base\avrf\avrf30\providers\basics\support.c @ 870]
033d872c 7c942dcf vfbasics!AVrfpVectoredExceptionHandler(struct
_EXCEPTION_POINTERS * ExceptionPointers = 0x033d8744)+0x18
[e:\avrf\source\base\avrf\avrf30\providers\basics\support.c @ 200]
033d874c 7c9377da ntdll!RtlCallVectoredExceptionHandlers+0x48
033d87c4 7c90eafa ntdll!RtlDispatchException+0x19
033d87c4 77c472e3 ntdll!KiUserExceptionDispatcher+0xe
033d8acc 7750682d msvcrt!memmove+0x33
033d8af0 75d0f589 ole32!CMemStm::Write+0xa1
033d8b78 75cff9df mlang!_DetectInputCodepage+0x1e4
033d8b98 041ed4d8 mlang!CMultiLanguage2::DetectInputCodepage+0x1c
WARNING: Stack unwind information not available. Following frames may be
wrong.
033d8c00 041ee1d3 nlhtml+0xd4d8
033d8c34 03b846d5 nlhtml+0xe1d3
033d90e4 03b840c0 MyFilt!CMyAttachStorage::HrBuildIFilter(wchar_t * wzName =
0x039c0fd0 “__substg1.0_37010102”)+0x585
[d:\myfolder\enlistment\private\filters\myfolder\myattachstorage.cpp @ 635]
033d910c 03b83f1e MyFilt!CMyAttachStorage::HrHandleStream(struct tagSTATSTG
* pstatstg = 0x033d9120)+0x50
[d:\myfolder\enlistment\private\filters\myfolder\myattachstorage.cpp @ 443]
033d9170 03b853bb MyFilt!CMyAttachStorage::HrGetNextChunk(struct
tagSTAT_CHUNK * pStat = 0x033db2ec, AttachmentIFilterStatus *
peAttachmentIFilterStatus = 0x033d9360)+0x9e
[d:\myfolder\latest\private\filters\myfolder\myattachstorage.cpp @ 319]
033d9194 03b87925 MyFilt!CMyBaseStorage::HrGetChunk(struct tagSTAT_CHUNK *
pStat = 0x033db2ec, AttachmentIFilterStatus * peAttachmentIFilterStatus =
0x033d9360)+0x7b
[d:\myfolder\latest\private\filters\myfolder\mybasestorage.cpp @ 418]
033d91bc 03b83e23 MyFilt!CMyPrimaryStorage::HrGetChunk(struct tagSTAT_CHUNK
* pStat = 0x033db2ec, AttachmentIFilterStatus * peAttachmentIFilterStatus =
0x033d9360)+0x65
[d:\myfolder\latest\private\filters\myfolder\myprimarystorage.cpp @ 265]

Thanks alot.

Regards,
Shreshth

it is access violation mate!

On 12/7/06, Shreshth Luthra wrote:
>
> Hi All,
>
> Can anyone please help me analyse the follwing dump.
>
> This heap stop was caused by Application Verfier.
>
>
>
>
>
> (eec.c0): Access violation - code c0000005 (first chance)
> First chance exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=042f0b05 ebx=033d8b88 ecx=00007ec1 edx=00000001 esi=042d1000
> edi=043864f8
> eip=77c472e3 esp=033d8ac4 ebp=033d8acc iopl=0 nv up ei pl nz ac pe
> nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00010212
> msvcrt!memmove+0x33:
> 77c472e3 f3a5 rep movsd ds:042d1000=???
> es:043864f8=c0c0c0c0
> 0:001> g
>
>
> =======================================
> VERIFIER STOP 00000013 : pid 0xEEC: First chance access violation for
> current stack trace.
>
> 042D1000 : Invalid address causing the exception.
> 77C472E3 : Code address executing the invalid access.
> 033D87DC : Exception record.
> 033D87F8 : Context record.
>
>
>
>
>
>
> 0:001> !ext heap -p -a 042D1000
> No export ext found
> 0:001> !ext.heap -p -a 042D1000
> address 042d1000 found in
> _DPH_HEAP_ROOT @ 81000
> in busy allocation ( DPH_HEAP_BLOCK: UserAddr
> UserSize - VirtAddr VirtSize)
> 3039e40: 42c1000
> 10000 - 42c0000 12000
> 7c91b298 ntdll!RtlAllocateHeap+0x00000e64
> 003ab4ed vfbasics!AVrfpRtlAllocateHeap+0x000000cd
> 7c8099df kernel32!LocalAlloc+0x00000058
> 003abd0d vfbasics!AVrfpLocalAlloc+0x0000009d
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for D:\Program Files\MyProj\nlhtml.dll -
> 041f7249 nlhtml!DllRegisterServer+0x00005568
> 041f2c3e nlhtml!DllRegisterServer+0x00000f5d
> 041f2898 nlhtml!DllRegisterServer+0x00000bb7
> 041efe9b nlhtml!DllGetClassObject+0x0000193d
> 041f433d nlhtml!DllRegisterServer+0x0000265c
> 041ed47b nlhtml+0x0000d47b
> 041ee1d3 nlhtml+0x0000e1d3
> 03b846d5 MyFilt!CMyAttachStorage::HrBuildIFilter+0x00000585
> 03b840c0 MyFilt!CMyAttachStorage::HrHandleStream+0x00000050
> 03b83f1e MyFilt!CMyAttachStorage::HrGetNextChunk+0x0000009e
> 03b853bb MyFilt!CMyFiltBaseStorage::HrGetChunk+0x0000007b
> 03b87925 MyFilt!CMyFiltPrimaryStorage::HrGetChunk+0x00000065
>
>
>
>
> 0:001> kp
> ChildEBP RetAddr
> 033d8464 0040383d ntdll!DbgBreakPoint
> 033d8664 004072c9 vrfcore!VerifierStopMessageEx(struct
> _AVRF_LAYER_DESCRIPTOR * LayerDescriptor = 0x0040b5d8, unsigned long
> StopCode = 0x13, unsigned long Param1 = 0x42d1000, unsigned long Param2 =
> 0x77c472e3, unsigned long Param3 = 0x33d87dc, unsigned long Param4 =
> 0x33d87f8, struct _AVRF_STOP_EXTRA * StopExtra = 0x00000000, unsigned long
> StopIsDisabled = 0)+0x518 [e:\avrf\source\base\avrf\avrf30\vrfcore\sdk.cpp @
> 523]
> 033d8688 003b2dd9 vrfcore!VfCoreRedirectedStopMessage(unsigned long Code =
> 0x13, char * Message = 0x003a31e8 “first chance access violation for current
> stack trace”, unsigned long Param1 = 0x42d1000, char * Description1 =
> 0x003a3220 “Invalid address being accessed”, unsigned long Param2 =
> 0x77c472e3, char * Description2 = 0x003a21f8 “Code performing invalid
> access”, unsigned long Param3 = 0x33d87dc, char * Description3 = 0x003a2218
> “Exception record. Use .exr to display it.”, unsigned long Param4 =
> 0x33d87f8, char * Description4 = 0x003a2244 “Context record. Use .cxr to
> display it.”)+0x81 [e:\avrf\source\base\avrf\avrf30\vrfcore\stopredirect.cpp
> @ 103]
> 033d86b8 003a9429 vfbasics!VfBasicsStopMessage(unsigned long Code = 0x13,
> char * Message = 0x003a31e8 “first chance access violation for current stack
> trace”, unsigned long Param1 = 0x42d1000, char * Description1 = 0x003a3220
> “Invalid address being accessed”, unsigned long Param2 = 0x77c472e3, char *
> Description2 = 0x003a21f8 “Code performing invalid access”, unsigned long
> Param3 = 0x33d87dc, char * Description3 = 0x003a2218 “Exception record. Use
> .exr to display it.”, unsigned long Param4 = 0x33d87f8, char * Description4
> = 0x003a2244 “Context record. Use .cxr to display it.”)+0x1c9
> [e:\avrf\source\base\avrf\avrf30\providers\basics\basics.c @ 1091]
> 033d871c 003a8b68 vfbasics!AVrfpCheckFirstChanceException(struct
> _EXCEPTION_POINTERS * ExceptionPointers = 0x033d8744)+0x139
> [e:\avrf\source\base\avrf\avrf30\providers\basics\support.c @ 870]
> 033d872c 7c942dcf vfbasics!AVrfpVectoredExceptionHandler(struct
> _EXCEPTION_POINTERS * ExceptionPointers = 0x033d8744)+0x18
> [e:\avrf\source\base\avrf\avrf30\providers\basics\support.c @ 200]
> 033d874c 7c9377da ntdll!RtlCallVectoredExceptionHandlers+0x48
> 033d87c4 7c90eafa ntdll!RtlDispatchException+0x19
> 033d87c4 77c472e3 ntdll!KiUserExceptionDispatcher+0xe
> 033d8acc 7750682d msvcrt!memmove+0x33
> 033d8af0 75d0f589 ole32!CMemStm::Write+0xa1
> 033d8b78 75cff9df mlang!_DetectInputCodepage+0x1e4
> 033d8b98 041ed4d8 mlang!CMultiLanguage2::DetectInputCodepage+0x1c
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 033d8c00 041ee1d3 nlhtml+0xd4d8
> 033d8c34 03b846d5 nlhtml+0xe1d3
> 033d90e4 03b840c0 MyFilt!CMyAttachStorage::HrBuildIFilter(wchar_t * wzName
> = 0x039c0fd0 “__substg1.0_37010102”)+0x585
> [d:\myfolder\enlistment\private\filters\myfolder\myattachstorage.cpp @ 635]
> 033d910c 03b83f1e MyFilt!CMyAttachStorage::HrHandleStream(struct
> tagSTATSTG * pstatstg = 0x033d9120)+0x50
> [d:\myfolder\enlistment\private\filters\myfolder\myattachstorage.cpp @ 443]
> 033d9170 03b853bb MyFilt!CMyAttachStorage::HrGetNextChunk(struct
> tagSTAT_CHUNK * pStat = 0x033db2ec, AttachmentIFilterStatus *
> peAttachmentIFilterStatus = 0x033d9360)+0x9e
> [d:\myfolder\latest\private\filters\myfolder\myattachstorage.cpp @ 319]
> 033d9194 03b87925 MyFilt!CMyBaseStorage::HrGetChunk(struct tagSTAT_CHUNK *
> pStat = 0x033db2ec, AttachmentIFilterStatus * peAttachmentIFilterStatus =
> 0x033d9360)+0x7b
> [d:\myfolder\latest\private\filters\myfolder\mybasestorage.cpp @ 418]
> 033d91bc 03b83e23 MyFilt!CMyPrimaryStorage::HrGetChunk(struct
> tagSTAT_CHUNK * pStat = 0x033db2ec, AttachmentIFilterStatus *
> peAttachmentIFilterStatus = 0x033d9360)+0x65
> [d:\myfolder\latest\private\filters\myfolder\myprimarystorage.cpp @ 265]
>
>
>
>
> Thanks alot.
>
>
> Regards,
> Shreshth
> — You are currently subscribed to windbg as: xxxxx@gmail.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com



- amitr0