I have a Windows Service written in C#. It is crashing when it calls into a 3rd party COM component. The problem only appears on Windows 7 (x86 and x64). When I run the same service code as a console application on Windows 7 (x86 and x64), it works fine.
When I run the same service on Windows 2003, it also works properly. I think it could be related to UAC. I am looking for suggestions/direction on debugging this service to identify what is causing the problem. Use debug symbols for ntdll.dll? Below the info from the event log.
Event ID: 1000, Level: Error
Faulting application name: ServiceHost.exe, version: 1.0.0.0, time stamp: 0x4f87bc9a
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec49b60
Exception code: 0xc0000005
Fault offset: 0x0002bcbb
Faulting process id: 0x151c
Faulting application start time: 0x01cd1939c9017b2d
Faulting application path: E:\ServiceHost\bin\Debug\ServiceHost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 08da6aa3-852d-11e1-a889-00155d016f32
As a wild guess, you might be falling foul of Session 0 Isolation:
In Windows XP®, Windows Server® 2003, and earlier versions of the Windows® operating system, all services run in the same session as the first user who logs on to the console. This session is called Session 0. Running services and user applications together in Session 0 poses a security risk because services run at elevated privilege and therefore are targets for malicious agents that are looking for a means to elevate their own privilege levels.
Where this usually causes issues for services is if, for instance, something tries to create UI.
The easiest approach to dealing with this issue would be to talk to the vendor of the 3rd party component and ensure it's supported for use with services. However, if the vendor no longer exists, that may not be possible.
If the issue arises whilst the service is running, it may be possible to attach a debugger to it and capture a dump at the point at which the error happens (e.g. using something like adplus from the debugging tools for windows). If the issue is happening during service startup, it may be trickier to diagnose.
You really need to isolate the last function call in your code that brings on the error, and then try to diagnose from there.
Try changing the account of service to any other. Like Local System.
The 3rd party COM component is using some hacks (some unleashed APIs) to boost its performance and the OS interface has been changed without notice in the next versions on Windows.
This was an old policy from early days of windows (Norton, Office...) to make some direct calls to Kernel and ...
Related
I received an error report regarding a WPF app that wouldn't start up in a Windows Server 2008 Service pack 2 server (the application is an administration tool we're distributing to our customers). Since this application has a lot of external references, I tried to simplify the problem by creating a simple WPF application using Visual Studio 2013: a plain white window with "hello world" showing and nothing more. I tried to make it run in the production server, with no luck: it always crashes immediately.
Here's what I have:
the application was created with the standard VS 2013 template for WPF, so it had 3.5 as the target framework; i changed it to 4.6
the server has the 3.5 SP1 and 4.6 versions of the .net framework installed
the app.config is well-formed, with the configSections section on top, no additional references besides log4net, supportedRuntime tag set according to the target framework version
I already checked that there are no project references from version 3.5 left in the project
I already tried logging in the DispatcherUnhandledException and in the AppDomain.UnhandledException handlers
the application runs in my development environment
the application runs in production environment only if I change the target framework to 3.5. In this case, the WPF windows shows up and the log file is correctly produced
I already tried producing a dump and trying to debug it in Visual Studio: I just get a "Source not available" message and a stack trace ending with ntdll.dll!NtWaitForSingleObject()
Here are the error details:
Description:
Stopped working
Problem signature:
Problem Event Name: APPCRASH
Application Name: MyApp.exe
Application Version: 1.0.0.0
Application Timestamp: 5bfc07f1
Fault Module Name: KERNEL32.dll
Fault Module Version: 6.0.6002.24367
Fault Module Timestamp: 5ae3dcd9
Exception Code: e0434352
Exception Offset: 000000000001667d
OS Version: 6.0.6002.2.2.0.272.7
Locale ID: 1033
The Windows event log shows little information:
Faulting application MyApp.exe, version 1.0.0.0, time stamp 0x5bfc07f1, faulting module KERNEL32.dll, version 6.0.6002.24367, time stamp 0x5ae3dcd9, exception code 0xe0434352, fault offset 0x000000000001667d, process id 0x%9, application start time 0x%10.
Application: MyApp.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code e0434352, exception address 0000000077A6667D
Stack: [this is empty]
Any suggestions?
Just in case someone else stumbles on the same problem, looks like the KB4457921 update from Microsoft somehow solves the issue. If an update is not possible, consider porting the code back to .net framework v. 3.5.
We implemented a build pipeline for our UWP app on VSTS. We can build the application on any of our developer workstations in release mode with .NET native enabled and the app works as expected.
When we build the same application on a Hosted VS2017 Agent in VSTS, the application also builds successful and the resulting appxbundle file can be installed on a device. However, the application crashes right after showing the splash screen.
I can't see any difference in the way we build the application in VS2017 compared to the way it is build on the Hosted VS2017 Agent in VSTS.
The event log shows the following right after the crash:
Faulting application name: Foo.exe, version: 0.19.1.0, time stamp: 0x5a1d8e4a
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.16299.15, time stamp: 0xf6706fe0
Exception code: 0xc000027b
Fault offset: 0x00000000006e7269
Faulting process ID: 0x3044
Faulting application start time: 0x01d368691c216952
Faulting application path: C:\Program Files\WindowsApps\Foo_0.19.1.0_x64__fdr8vq4bd9b2a\Foo.exe
Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
Report ID: 2655f631-947c-42e5-b3d4-2d2679a93332
Faulting package full name: Foo_0.19.1.0_x64__fdr8vq4bd9b2a
Faulting package-relative application ID: App
The build step in VSTS is configured as following:
/p:AppxBundlePlatforms="$(BuildPlatform)" /p:AppxPackageDir="$(Build.ArtifactStagingDirectory)\AppxPackages\\" /p:AppxBundle=Always /p:UapAppxPackageBuildMode=StoreUpload
If I use the same command line and run it on any developer workstation it works and the resulting appxbundle can be installed and started without any crash.
Any idea what the difference could be or how I can debug the app best?
The issue is caused by a upload task to App Center (aka Mobile Center) within the build pipeline of VSTS. This tasks seems to "corrupt" the file in a really strange way.
I replaced the task with one using the App Center CLI and the upload works and the app no longer crashes.
I posted another question for the root cause here: Distribute UWP App to App Center (aka Mobile Center) using VSTS Task
I have an asp.net application written using a combination of technologies such as Asp.net MVC,WebAPI,SignalR etc and it is crashing almost everyday randmoly. I get this message logged by IIS in the event logs
Faulting application w3wp.exe, version 6.0.3790.3959, stamp 45d691cc,
faulting module kernel32.dll, version 5.2.3790.4062
There are no erros in my application log(log4net)
There are no other logs in the application and system logs
I cannot install any tools or profiler in the production server as it requires many levels of approvals and privileges.
I understand that we can use some kind of CLR profiler to get the crash analyzed but even that requires approval and we had a situation where the profiler was causing real slowness to our application as the application is very chatty(Hence signalR) .So I am looking for a solution with minimal impact on runtime but would like to figure out the root cause of the crash.
WER helped me troubleshoot this issue.Enabled crash dump using WER
Windows Registry Editor Version 5.00
�
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe]
"DumpFolder"=hex(2):63,00,3a,00,5c,00,64,00,75,00,6d,00,70,00,73,00,00,00
"DumpCount"=dword:00000002
"DumpType"=dword:00000002
And this created an hdmp file and I was to get this analyzed using debugdiag and windbg to find out the issue. There was a stackoverflow exception happening and caused the application to crash.
Are you using dedicated application pool for your app ?
if not, you can try to add new application pool and configure it for your application.
I have developed a windows application in visual studio 2012 and deployed the application using Installshield. When I install the application in 32-bit system it works fine, but while I install in 64-bit system, it installs fine but after installing the application is not opening throwing and error that,
Problem Signature:
Problem Event Name: APPCRASH
Application Name: sappln.exe
Fault Module Name: KERNALBASE.DLL
and more it goes on..
In configuration Manager, I have specified Release -> Any CPU
Can anyone give some solutions to avoid this error?
Thanks in advance!!
Seems like you are using libaries that can't run on x64 platforms. What libaries are you using?
Also check if your program does anything "special" upon startup.
This should keep you out.
Good luck!
I have one windows application built using C# and .net framework 2.0 and its installed on Windows Server 2003.
I have tested application on my machine and it works perfectly on my machine. Only difference between two machines is that, my machine has Windows Vista OS and machine on which error occured has Windows Server 2003 OS.
When I start application, it works correctly for some time but then gives one error as
Faulting application ,
version ,faulting
module kernel32.dll,version 5.2.3790.4480, stamp , debug? 0. fault address 0x000bef7.
Source : .NET Runtime 2.0 Error
Category : None
Event ID : 1000
Does anyone knows why this error is coming? I googled for this error but most of the solutions were for either explorer.exe or internet explorer.
Use windbg or adplus to attach to the process and get the process crash dump. This would help you to identify the offending part of the code with symbols loaded. In most cases, it shows the last exception and hence gives a very good view of what could have gone wrong.