ok, here the hard way to find this crash :
1) Install Microsoft Debugging Tools for Windows
2) Once installed, run 'WinDbg' (available from the start menu)
3) Start Multwinia ( windowed )
4) From 'WinDbg' main window -> 'File' menu -> 'Attach to a process...' -> In the 'Attach to process' dialog select 'Multiwinia.exe'
5) If you are asked to save the workspace just say no
6) Now Multiwinia execution is stopped, relaunch it by going in 'Debug' menu -> 'Go'
7) Go back to Multiwinia and make it crash
8) Once Multiwinia crash, it should output debugging information in 'WinDbg', post them here!
Crashes and ncftpput?
Moderators: jelco, bert_the_turtle
-
frenchfrog
- level5
- Posts: 2572
- Joined: Sun Sep 22, 2002 7:11 pm
- Location: Quebec
alright here it is:
Code: Select all
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
ModLoad: 00400000 00739000 C:\Program Files\Multiwinia\Multiwinia.exe
ModLoad: 777e0000 77907000 C:\Windows\system32\ntdll.dll
ModLoad: 77910000 779eb000 C:\Windows\system32\kernel32.dll
ModLoad: 6a8f0000 6a9bb000 C:\Windows\system32\OPENGL32.dll
ModLoad: 76f70000 7701a000 C:\Windows\system32\msvcrt.dll
ModLoad: 77320000 773e6000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 76ca0000 76d62000 C:\Windows\system32\RPCRT4.dll
ModLoad: 77090000 770db000 C:\Windows\system32\GDI32.dll
ModLoad: 76ea0000 76f3d000 C:\Windows\system32\USER32.dll
ModLoad: 6ba20000 6ba43000 C:\Windows\system32\GLU32.dll
ModLoad: 6b230000 6b315000 C:\Windows\system32\DDRAW.dll
ModLoad: 6e4c0000 6e4c6000 C:\Windows\system32\DCIMAN32.dll
ModLoad: 77540000 776ca000 C:\Windows\system32\SETUPAPI.dll
ModLoad: 77230000 772bd000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 770e0000 77224000 C:\Windows\system32\ole32.dll
ModLoad: 71b50000 71b5c000 C:\Windows\system32\dwmapi.dll
ModLoad: 74380000 743b2000 C:\Windows\system32\WINMM.dll
ModLoad: 74340000 74379000 C:\Windows\system32\OLEACC.dll
ModLoad: 6a5f0000 6a660000 C:\Windows\system32\DSOUND.dll
ModLoad: 75490000 754aa000 C:\Windows\system32\POWRPROF.dll
ModLoad: 73050000 73057000 C:\Windows\system32\WSOCK32.dll
ModLoad: 76f40000 76f6d000 C:\Windows\system32\WS2_32.dll
ModLoad: 77080000 77086000 C:\Windows\system32\NSI.dll
ModLoad: 69390000 694a5000 C:\Program Files\Multiwinia\dbghelp.dll
ModLoad: 76140000 76c4f000 C:\Windows\system32\SHELL32.dll
ModLoad: 772c0000 77318000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 757a0000 757a8000 C:\Windows\system32\VERSION.dll
ModLoad: 76c80000 76c9e000 C:\Windows\system32\IMM32.DLL
ModLoad: 76060000 76128000 C:\Windows\system32\MSCTF.dll
ModLoad: 76130000 76139000 C:\Windows\system32\LPK.DLL
ModLoad: 776d0000 7774d000 C:\Windows\system32\USP10.dll
ModLoad: 74e00000 74f9e000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
ModLoad: 74290000 742bf000 C:\Windows\system32\wdmaud.drv
ModLoad: 743c0000 743c4000 C:\Windows\system32\ksuser.dll
ModLoad: 75110000 75137000 C:\Windows\system32\MMDevAPI.DLL
ModLoad: 75280000 75287000 C:\Windows\system32\AVRT.dll
ModLoad: 75340000 7536d000 C:\Windows\system32\WINTRUST.dll
ModLoad: 759a0000 75a91000 C:\Windows\system32\CRYPT32.dll
ModLoad: 75b00000 75b12000 C:\Windows\system32\MSASN1.dll
ModLoad: 75f10000 75f2e000 C:\Windows\system32\USERENV.dll
ModLoad: 75ef0000 75f04000 C:\Windows\system32\Secur32.dll
ModLoad: 76c50000 76c79000 C:\Windows\system32\imagehlp.dll
ModLoad: 741d0000 741f1000 C:\Windows\system32\AUDIOSES.DLL
ModLoad: 74160000 741c6000 C:\Windows\system32\audioeng.dll
ModLoad: 75fc0000 75fc7000 C:\Windows\system32\PSAPI.DLL
ModLoad: 74310000 74319000 C:\Windows\system32\msacm32.drv
ModLoad: 74080000 74094000 C:\Windows\system32\MSACM32.dll
ModLoad: 74300000 74307000 C:\Windows\system32\midimap.dll
ModLoad: 003e0000 003f6000 C:\Windows\system32\XINPUT1_3.dll
ModLoad: 74fe0000 7501f000 C:\Windows\system32\uxtheme.dll
ModLoad: 048f0000 0532c000 C:\Windows\system32\atioglxx.dll
ModLoad: 77750000 777d4000 C:\Windows\system32\CLBCatQ.DLL
ModLoad: 75690000 756cb000 C:\Windows\system32\mswsock.dll
ModLoad: 75370000 75375000 C:\Windows\System32\wshtcpip.dll
ModLoad: 74fa0000 74faf000 C:\Windows\system32\NLAapi.dll
ModLoad: 75940000 75959000 C:\Windows\system32\IPHLPAPI.DLL
ModLoad: 758b0000 758e5000 C:\Windows\system32\dhcpcsvc.DLL
ModLoad: 75b40000 75b6c000 C:\Windows\system32\DNSAPI.dll
ModLoad: 758a0000 758a7000 C:\Windows\system32\WINNSI.DLL
ModLoad: 75870000 75891000 C:\Windows\system32\dhcpcsvc6.DLL
ModLoad: 732f0000 732ff000 C:\Windows\system32\napinsp.dll
ModLoad: 73260000 73272000 C:\Windows\system32\pnrpnsp.dll
ModLoad: 73290000 73298000 C:\Windows\System32\winrnr.dll
ModLoad: 77020000 7706a000 C:\Windows\system32\WLDAP32.dll
ModLoad: 73f60000 73f66000 C:\Windows\system32\rasadhlp.dll
ModLoad: 757b0000 757b5000 C:\Windows\System32\wship6.dll
(854.b7c): Break instruction exception - code 80000003 (first chance)
eax=7ffd4000 ebx=00000000 ecx=00000000 edx=7786d094 esi=00000000 edi=00000000
eip=77827dfe esp=0af2ff5c ebp=0af2ff88 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\ntdll.dll -
ntdll!DbgBreakPoint:
77827dfe cc int 3
0:010> g
(854.3e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000001 ecx=09cc6eb0 edx=03160fc8 esi=000000a4 edi=00000000
eip=00470bbb esp=039ffd64 ebp=0000000e iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Multiwinia\Multiwinia.exe
Multiwinia+0x70bbb:
00470bbb 8b4808 mov ecx,dword ptr [eax+8] ds:0023:00000008=????????
-
frenchfrog
- level5
- Posts: 2572
- Joined: Sun Sep 22, 2002 7:11 pm
- Location: Quebec
Thanks for the quick reply.
A Null dereference, since 'dword ptr [eax+8]' and 'eax=00000000'.
From the command console it is possible to run a command like 'analyze -v'?
allen wrote:Code: Select all
(854.3e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000001 ecx=09cc6eb0 edx=03160fc8 esi=000000a4 edi=00000000
eip=00470bbb esp=039ffd64 ebp=0000000e iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Multiwinia\Multiwinia.exe
Multiwinia+0x70bbb:
00470bbb 8b4808 mov ecx,dword ptr [eax+8] ds:0023:00000008=????????
A Null dereference, since 'dword ptr [eax+8]' and 'eax=00000000'.
From the command console it is possible to run a command like 'analyze -v'?
Code: Select all
0:001> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
***** OS symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\mswsock.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\WS2_32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\WSOCK32.dll -
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** WARNING: Unable to verify checksum for C:\Windows\system32\atioglxx.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\atioglxx.dll -
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\wdmaud.drv -
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\DSOUND.dll -
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
FAULTING_IP:
Multiwinia+70bbb
00470bbb 8b4808 mov ecx,dword ptr [eax+8]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00470bbb (Multiwinia+0x00070bbb)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008
FAULTING_THREAD: 00000f50
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: Multiwinia.exe
FAULTING_MODULE: 777e0000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
READ_ADDRESS: 00000008
ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer
PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION
BUGCHECK_STR: APPLICATION_FAULT_HEAP_CORRUPTION_WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 0056d47c to 00470bbb
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
0257fd70 0056d47c 0000000e 031d5703 ffffffff Multiwinia+0x70bbb
0257fdf0 77845b87 00000000 c0590000 00000000 Multiwinia+0x16d47c
0257fe60 005fc134 02be0000 00000000 00000120 ntdll!RtlAllocateHeap+0x2e1
0257fe74 0063bdac ffffffff 0257fe98 005f45f6 Multiwinia+0x1fc134
0257fec8 0063bf7b ffffffff 00570163 031d545f Multiwinia+0x23bdac
0257ff1c 00573712 ff32ffff 10d5bd98 031d55b3 Multiwinia+0x23bf7b
0257ff6c 0063c1d6 ffffffff 0042e449 00000000 Multiwinia+0x173712
0257ffd4 7781e489 0042e490 03650d68 00000000 Multiwinia+0x23c1d6
0257ffd8 0042e490 03650d68 00000000 00000000 ntdll!RtlInitializeExceptionChain+0x36
0257ffdc 03650d68 00000000 00000000 00000000 Multiwinia+0x2e490
0257ffe0 00000000 00000000 00000000 00000000 0x3650d68
SYMBOL_NAME: heap_corruption!heap_corruption
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
STACK_COMMAND: ~1s ; kb
FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000005_heap_corruption!base_address
BUCKET_ID: APPLICATION_FAULT_HEAP_CORRUPTION_WRONG_SYMBOLS_heap_corruption!heap_corruption
Followup: MachineOwner
---------
Typing "analyze -v" gave me this:
Code: Select all
0:001> analyze -v
Couldn't resolve error at 'nalyze -v'so I typed "!analyze -v" and I got the above
-
frenchfrog
- level5
- Posts: 2572
- Joined: Sun Sep 22, 2002 7:11 pm
- Location: Quebec
Who is online
Users browsing this forum: No registered users and 5 guests