need help resolving kernel32.dll first chance exception

NTDEV
1

hi

Although I normally post only device driver questions, I was hoping that one of the gurus on this site who have video driver and DirectShow experience might be able to give me suggestions. I hope this isn’t too far off a question for ntdev - if so, I apologize in advance.

I’m having trouble with a DirectShow app (console app) I wrote ( XP SP2 - filter graph containing video capture device (webcam) + DMO (Direct media object) ) - it inconsistently hangs unrecoverably (sometimes it takes 1/2 a day - sometimes only 10 minutes). When I run it in the Visual Studio debugger, I get the message “First chance exceptionat 0x7c812a5b ox00ff00ff:0xff0ff”. I looked up the address of 0x7c812a5b in the Modules listing, and it is within kernel32.dll.

When it hangs, the video freezes in the (DirectShow ) video preview window (that pops up when I run the graph) and I no longer see output in DbgView that I output during processing in the DMO for each frame.

Thinking I’d be able to get more info with windbg, I fired up a local connection. I finally got the problem to repro, but I don’t know where to proceed from here.
Could you offer suggestions? Note that I have very little DirectShow and/or COM experience.

I did remove the code that actually was messing with the frame video data - but it still excepts. I haven’t been able to use the process of elimination to isolate what I’m doing wrong.

Here’s the output:

(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.b0c): Break instruction exception - code 80000003 (first chance)
eax=7ffd9000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c901230 esp=03ecffcc ebp=03ecfff4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc int 3

When I look at the Processes and Threads debug window in windbg, it lists 005:1d0 as one of the threads.

Not sure what the 0x00ff00ff is or the 1a8.

thanks in advance

2

S. Drasnin wrote:

Although I normally post only device driver questions, I was hoping
that one of the gurus on this site who have video driver and
DirectShow experience might be able to give me suggestions. I hope
this isn’t too far off a question for ntdev - if so, I apologize in
advance.

I’m having trouble with a DirectShow app (console app) I wrote ( XP
SP2 - filter graph containing video capture device (webcam) + DMO
(Direct media object) ) - it inconsistently hangs unrecoverably
(sometimes it takes 1/2 a day - sometimes only 10 minutes). When I
run it in the Visual Studio debugger, I get the message “First chance
exceptionat 0x7c812a5b ox00ff00ff:0xff0ff”. I looked up the address of
0x7c812a5b in the Modules listing, and it is within kernel32.dll.

When it hangs, the video freezes in the (DirectShow ) video preview
window (that pops up when I run the graph) and I no longer see output
in DbgView that I output during processing in the DMO for each frame.

Thinking I’d be able to get more info with windbg, I fired up a local
connection. I finally got the problem to repro, but I don’t know where
to proceed from here.
Could you offer suggestions? Note that I have very little DirectShow
and/or COM experience.

I did remove the code that actually was messing with the frame video
data - but it still excepts. I haven’t been able to use the process of
elimination to isolate what I’m doing wrong.

Here’s the output:

(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.1d0): Unknown exception - code 00ff00ff (first chance)
(1a8.b0c): Break instruction exception - code 80000003 (first chance)
eax=7ffd9000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004
edi=00000005
eip=7c901230 esp=03ecffcc ebp=03ecfff4 iopl=0 nv up ei pl zr
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc int 3

When I look at the Processes and Threads debug window in windbg, it
lists 005:1d0 as one of the threads.

Not sure what the 0x00ff00ff is or the 1a8.

1a8 is the process ID, 1d0 is the thread id. 00ff00ff is the exception
code that it detected, which is not a valid exception code. Sounds like
memory got overwritten. Notice the suspicious values in ebx, ecx, edx,
esi, edi.

There’s not nearly enough information here to analyze this. In the
Visual Studio debugger, what did the call stack look like? That should
at least pinpoint what part of your code is causing the problem.

Are you saying your DMO is now passing the data unchanged, and it still
crashes? Have you checked for a memory leak? Are you checking memory
allocations to make sure they succeed? Have you double-checked all of
your buffer sizes?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Hi, I’m having a similar problem. My web camera application works fine for a inconsistant amount of time before it encounters an unknown exception repeatedly until it finally crashes with an access violation from the wmvencod.dll file.

Here’s the winDbg output just before the application crashes…
(ae0.734): Unknown exception - code 00ff00ff (first chance)
(ae0.f48): Unknown exception - code 00ff00ff (first chance)
(ae0.734): Unknown exception - code 00ff00ff (first chance)
(ae0.f48): Unknown exception - code 00ff00ff (first chance)
(ae0.734): Unknown exception - code 00ff00ff (first chance)
(ae0.f48): Unknown exception - code 00ff00ff (first chance)
(ae0.734): Unknown exception - code 00ff00ff (first chance)
(ae0.f48): Unknown exception - code 00ff00ff (first chance)
(ae0.474): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=000000bf edi=00000000
eip=1573ba90 esp=0c8ffba0 ebp=0c8ffc7c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\WMVENCOD.dll -
WMVENCOD!DllGetClassObject+0x410d:
1573ba90 39bbc8010000 cmp dword ptr [ebx+1C8h],edi ds:0023:000001c8=???

and here’s the stack trace:

WMVENCOD.dll!1573ba90()
[Frames below may be incorrect and/or missing, no symbols loaded for WMVENCOD.dll]
ntdll.dll!7c926abe()
ntdll.dll!7c926abe()
ntdll.dll!7c96cde9()
ntdll.dll!7c926abe()
WMVENCOD.dll!1572de11()
WMVENCOD.dll!1572e4f1()
WMVENCOD.dll!15733559()
WMVENCOD.dll!15733424()
WMVENCOD.dll!15733cee()
WMVENCOD.dll!15733d24()
WMVENCOD.dll!15736d4f()
wmvcore.dll!151c2691()
wmvcore.dll!151c9073()
wmvcore.dll!151c95ed()
wmvcore.dll!152b3c1e()
wmvcore.dll!152b5c35()
wmvcore.dll!151a2a81()
wmvcore.dll!152b2eb7()
kernel32.dll!7c8025f0()
wmvcore.dll!151f49af()
wmvcore.dll!151f4d11()
wmvcore.dll!151f42e6()
kernel32.dll!7c80b683()

4

You need to fix your symbols first:

.sympath srv**http://msdl.microsoft.com/download/symbols
.reload -f
lml

Good luck,

mm

xxxxx@gmail.com wrote:
> Hi, I’m having a similar problem. My web camera application works fine for a inconsistant amount of time before it encounters an unknown exception repeatedly until it finally crashes with an access violation from the wmvencod.dll file.
>
> Here’s the winDbg output just before the application crashes…
> (ae0.734): Unknown exception - code 00ff00ff (first chance)
> (ae0.f48): Unknown exception - code 00ff00ff (first chance)
> (ae0.734): Unknown exception - code 00ff00ff (first chance)
> (ae0.f48): Unknown exception - code 00ff00ff (first chance)
> (ae0.734): Unknown exception - code 00ff00ff (first chance)
> (ae0.f48): Unknown exception - code 00ff00ff (first chance)
> (ae0.734): Unknown exception - code 00ff00ff (first chance)
> (ae0.f48): Unknown exception - code 00ff00ff (first chance)
> (ae0.474): Access violation - code c0000005 (first chance)
> First chance exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=000000bf edi=00000000
> eip=1573ba90 esp=0c8ffba0 ebp=0c8ffc7c iopl=0 nv up ei pl zr na pe nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\WMVENCOD.dll -
> WMVENCOD!DllGetClassObject+0x410d:
> 1573ba90 39bbc8010000 cmp dword ptr [ebx+1C8h],edi ds:0023:000001c8=???
>
> and here’s the stack trace:
>
> WMVENCOD.dll!1573ba90()
> [Frames below may be incorrect and/or missing, no symbols loaded for WMVENCOD.dll]
> ntdll.dll!7c926abe()
> ntdll.dll!7c926abe()
> ntdll.dll!7c96cde9()
> ntdll.dll!7c926abe()
> WMVENCOD.dll!1572de11()
> WMVENCOD.dll!1572e4f1()
> WMVENCOD.dll!15733559()
> WMVENCOD.dll!15733424()
> WMVENCOD.dll!15733cee()
> WMVENCOD.dll!15733d24()
> WMVENCOD.dll!15736d4f()
> wmvcore.dll!151c2691()
> wmvcore.dll!151c9073()
> wmvcore.dll!151c95ed()
> wmvcore.dll!152b3c1e()
> wmvcore.dll!152b5c35()
> wmvcore.dll!151a2a81()
> wmvcore.dll!152b2eb7()
> kernel32.dll!7c8025f0()
> wmvcore.dll!151f49af()
> wmvcore.dll!151f4d11()
> wmvcore.dll!151f42e6()
> kernel32.dll!7c80b683()
>
>

5

I’ve downloaded the Windows Symbols, but they don’t seem to include the ones for Kernel32.dll, WMVENCOD.dll, or wmvcore.dll

Here’s the updated call stack:

WMVENCOD.dll!1573ba90()
[Frames below may be incorrect and/or missing, no symbols loaded for WMVENCOD.dll]
ntdll.dll!_NtFreeVirtualMemory@16() + 0xc bytes
ntdll.dll!_RtlpSecMemFreeVirtualMemory@16() + 0x1b bytes
ntdll.dll!_NtFreeVirtualMemory@16() + 0xc bytes
WMVENCOD.dll!1572de11()
WMVENCOD.dll!1572e4f1()
WMVENCOD.dll!15733559()
WMVENCOD.dll!15733424()
WMVENCOD.dll!15733cee()
WMVENCOD.dll!15733d24()
WMVENCOD.dll!15736d4f()
wmvcore.dll!151c2691()
wmvcore.dll!151c9073()
wmvcore.dll!151c95ed()
wmvcore.dll!152b3c1e()
wmvcore.dll!152b5c35()
wmvcore.dll!151a2a81()
wmvcore.dll!152b2eb7()
kernel32.dll!7c8025f0()
wmvcore.dll!151f49af()
wmvcore.dll!151f4d11()
wmvcore.dll!151f42e6()
kernel32.dll!7c80b683()

6

Is there some reason that you can’t use the MS symbol server (what I included in my last post)? Either way, it sounds like you have
the wrong symbols, so you might try this:

.symopt+ 0x80000000
.reload -f

This will dump a bunch of information about the symbol loading process, and hopefully it will say more about why kernel32.dll has no
symbols, which is weird.

Good luck,

mm

xxxxx@gmail.com wrote:

I’ve downloaded the Windows Symbols, but they don’t seem to include the ones for Kernel32.dll, WMVENCOD.dll, or wmvcore.dll

Here’s the updated call stack:
> WMVENCOD.dll!1573ba90()
[Frames below may be incorrect and/or missing, no symbols loaded for WMVENCOD.dll]
ntdll.dll!_NtFreeVirtualMemory@16() + 0xc bytes
ntdll.dll!_RtlpSecMemFreeVirtualMemory@16() + 0x1b bytes
ntdll.dll!_NtFreeVirtualMemory@16() + 0xc bytes
WMVENCOD.dll!1572de11()
WMVENCOD.dll!1572e4f1()
WMVENCOD.dll!15733559()
WMVENCOD.dll!15733424()
WMVENCOD.dll!15733cee()
WMVENCOD.dll!15733d24()
WMVENCOD.dll!15736d4f()
wmvcore.dll!151c2691()
wmvcore.dll!151c9073()
wmvcore.dll!151c95ed()
wmvcore.dll!152b3c1e()
wmvcore.dll!152b5c35()
wmvcore.dll!151a2a81()
wmvcore.dll!152b2eb7()
kernel32.dll!7c8025f0()
wmvcore.dll!151f49af()
wmvcore.dll!151f4d11()
wmvcore.dll!151f42e6()
kernel32.dll!7c80b683()

7

Hi MM, I got the symbol server connection to work this morning. Here’s what the stack trace looks like for both crashing threads when viewed in winDbg.

ntdll!KiFastSystemCallRet (FPO: [0,0,0])
ntdll!ZwWaitForSingleObject+0xc (FPO: [3,0,0])
kernel32!WaitForSingleObjectEx+0xa8 (FPO: [Non-Fpo])
kernel32!WaitForSingleObject+0x12 (FPO: [Non-Fpo])
qcap!COutputQueue::ThreadProc+0xd5 (FPO: [Non-Fpo])
qcap!COutputQueue::InitialThreadProc+0x16 (FPO: [Non-Fpo])
kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])