Debug BEX (0xc0000417) Exception using windbg on Windows 7

2

I'm debugging an application crash on 32Bit windows 7. (I don't have access to source code).

The application crashing with BEX exception.

Problem signature:
  Problem Event Name:   BEX
  Application Name: xxxxx.EXE
  Application Version:  xx.xx.xxx.xxx
  Application Timestamp:    xxxxx
  Fault Module Name:    xxxxx.dll
  Fault Module Version: x.x.xx.xx
  Fault Module Timestamp:   xxxxx
  Exception Offset: xxxxxxxx
  Exception Code:   c0000417
  Exception Data:   00000000
  OS Version:   x.x.xx.x.x.x.xxx.xx
  Locale ID:    xxxx

Additional information about the problem:
  LCID: xxxx
  skulcid:  xxxx

https://technet.microsoft.com/en-us/library/cc738483(v=ws.10).aspx

Above link says, BEX (c0000417 ==> STATUS_INVALID_CRUNTIME_PARAMETER)exception occurs due to buffer overflow / DEP violation(when its trying to execute page which is not executable ). Which I think is a security issue in the app.

Reference:

https://social.msdn.microsoft.com/Forums/vstudio/en-US/04f1c082-79db-4f41-82fc-3d41b14c8713/regarding-error-statusinvalidcruntimeparameter-c0000417?forum=vcgeneral

This looks like a continuation of the work done on the secure CRT in VS2008. The exception is thrown by _invoke_watson(), hard to track where it may be called, lots of macros. It is clearly meant to prevent a CRT function from continuing with an invalid argument, a major security loophole. Debug it by running IE in the debugger with Debug + Exceptions, Thrown checkbox turned on. You ought to get a call stack that shows the problem function call.

The problem is when I'm attaching the application with windbg, instead of stopping the debugger in faulting point , the application is getting terminated. And I get this in windbg screen

eax=000000c0 ebx=00000000 ecx=00000000 edx=2f9a1265 esi=00000198 edi=00000000
eip=778970d4 esp=01adfaa4 ebp=01adfb10 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
778970d4 c3              ret
0:001> g
       ^ No runnable debuggees error in 'g'

So my question is, if I have to break the debugger at the exact faulting point (Instead of exiting is completely) what changes I have to made in OS / Debugger Settings ?

c++
debugging
reverse-engineering
windbg
asked on Stack Overflow Feb 23, 2016 by Dev.K.

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0