A way to "reverse" dw20.exe hashes?

Our application throws unhandled exceptions. DW20.exe writes them like this test case:

EventType clr20r3, P1 clr20r3.exe, P2 1.0.0.0, P3 4af175d6, P4 clr20r3, P5 1.0.0.0, P6 4af175d6, P7 1, P8 a, P9 system.applicationexception, P10 NIL. 

P9 is the name of the exception. If the exception name exceeds 32 characters, DW20.exe hashes the name (and supposedly encodes the hash). For example, the exception "LongExceptionWithNameThatIsOver32" is logged as:

 EventType clr20r3, P1 aspnet_wp.exe, P2 2.0.50727.3082, P3 492b8702, P4 app_web_bmcy0pha, P5 0.0.0.0, P6 4af86274, P7 59, P8 5, P9 3e3rjg2ow1fkknn0eqptakfytpvxew1k, P10 NIL. 

As you can see, P9 is no longer an exception name, but a hash of the name.

I can exclude exceptions from our application one at a time, but I would rather instead generate an exception name in the utility to get a hash. I'm sure DW20.exe is a hash program (not a .NET Runtime). I would like to know that uses the hash / encoding algorithm dw20.exe, so I can create a utility that takes advantage of all my exceptions and creates the corresponding hash / code.

I tried connecting windbg to a test program, but then dw20.exe is not being called. I tried connecting windbg to dw20.exe when it places the transfer dialog on microsoft, but it already registered an exception by then. I cannot get dw20.exe to run under the control of windbg.exe, which would be one way to find out what is being used.

Jr

+4
source share

All Articles