I'm not sure if you are on the right track, diagnosing this as a stack overflow.
But in any case, the fact that you get poof !, plus what you see in WinDbg
The crash dump will contain only one thread, which is "Sleep ()". All other threads are out.
suggests me that someone called the C function of RTL exit () or perhaps directly called the Windows API TerminateProcess (). This may have something to do with your interrupt handlers or not. Perhaps something in the exception handling logic has a re-entry check and arbitrarily decides to exit () if it reappears.
My suggestion is to fix your executables so that you can possibly debug INT 3 at the exit entry point (), if it is statically linked or dynamically linked, fixes the import, and also fixes any import files kernel32 :: TerminateProcess instead throws DebugBreak () .
Of course, exit () and / or TerminateProcess () can also be called during a normal shutdown, so you have to filter out false alarms, but if you can get a call stack for the case when it is just about to go for proof, you should have that you need.
EDIT ADD: just writing your own version of exit () and linking it instead of the CRTL version can do the trick.
Die in sente
source share