I'm debugging an application crash on 32Bit windows 7. (I don't have access to source code).
The application crashing with BEX exception.
Problem signature:
Problem Event Name: BEX
Application Name: xxxxx.EXE
Application Version: xx.xx.xxx.xxx
Application Timestamp: xxxxx
Fault Module Name: xxxxx.dll
Fault Module Version: x.x.xx.xx
Fault Module Timestamp: xxxxx
Exception Offset: xxxxxxxx
Exception Code: c0000417
Exception Data: 00000000
OS Version: x.x.xx.x.x.x.xxx.xx
Locale ID: xxxx
Additional information about the problem:
LCID: xxxx
skulcid: xxxx
https://technet.microsoft.com/en-us/library/cc738483(v=ws.10).aspx
Above link says, BEX (c0000417 ==> STATUS_INVALID_CRUNTIME_PARAMETER)exception occurs due to buffer overflow / DEP violation(when its trying to execute page which is not executable ). Which I think is a security issue in the app.
Reference:
This looks like a continuation of the work done on the secure CRT in VS2008. The exception is thrown by _invoke_watson(), hard to track where it may be called, lots of macros. It is clearly meant to prevent a CRT function from continuing with an invalid argument, a major security loophole. Debug it by running IE in the debugger with Debug + Exceptions, Thrown checkbox turned on. You ought to get a call stack that shows the problem function call.
The problem is when I'm attaching the application with windbg, instead of stopping the debugger in faulting point , the application is getting terminated. And I get this in windbg screen
eax=000000c0 ebx=00000000 ecx=00000000 edx=2f9a1265 esi=00000198 edi=00000000
eip=778970d4 esp=01adfaa4 ebp=01adfb10 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
778970d4 c3 ret
0:001> g
^ No runnable debuggees error in 'g'
So my question is, if I have to break the debugger at the exact faulting point (Instead of exiting is completely) what changes I have to made in OS / Debugger Settings ?
User contributions licensed under CC BY-SA 3.0