What do these APPCRASH messages mean?

Question

I am testing APPCRASH from my C # application. The error message "This application asked Runtime to terminate it in an unusual way" appears in Runtime. Then, when I click “OK”, I get the message “MyApplication has stopped working” with the usual options “check online for solution”, “close the program” and “debugging program”. When I click "extra data", I get an APPCRASH signature with a lot of extra information. Some of them are human readable, some of them are only hexadecimal numbers. The exception code is 40000015. There is also the line “Additional Information”. My question is: does anyone in the universe know what the information in the APPCRASH message means?

It seems that the message was intended to be read by someone who can explain the reason. When searching for answers, I found that many people post messages formatted in exactly the same way. Unfortunately, I did not find an explanation of what this information means.

In addition, I tried the option "Debugging the program", but it is useless. It just puts me in the system dlls, with none of my codes anywhere in the call stack. I researched and the error does not occur in this system code.

The APPCRASH message called the other dll “error module” (this code uses a large number of external DLLs), and there is probably a fatal error. But this information is not very useful, because I need to find a place in my code, which makes a bad call to an external dll (or puts it in a bad state). Unfortunately, when I say "my code", I mean the code I'm working with. This is a huge codebase written by several dozens of people over the course of a couple of years, so I cannot just guess about the places that can cause a fatal call. This is why I was hoping to get more information from the APPCRASH message. That is why I am very mean with details. All this is very proprietary with a lot of red tape. This is why I did not post the contents of the APPCRASH message.

To be clear, I am not asking you to debug my problem for me. I cannot give you a reproducible case of error, and I do not ask anyone to tell me the cause of the error in my particular case. I just want to know how to interpret these hexadecimal numbers, and I could not find the documentation.

Answer 1

Here is an example application alarm message:

Problem signature: Problem Event Name: APPCRASH Application Name: WINWORD.EXE Application Version: 12.0.4518.1014 Application Timestamp: 45428028 Fault Module Name: StackHash_7ae5 Fault Module Version: 6.0.6000.16386 Fault Module Timestamp: 4549bdc9 Exception Code: c0000374 Exception Offset: 000af1c9 OS Version: 6.0.6000.2.0.0.256.4 Locale ID: 1033 Additional Information 1: 7ae5 Additional Information 2: 4cf2e59e469447e0692da79a5a9446de Additional Information 3: 333f Additional Information 4: 583336399425ab3efc33bdfbb60895ee 

The application name and version of the application are simple, as is the timestamp (this is a modified date in File Explorer encoded as a 32-bit Unix timestamp). The Fault module is usually the dll name, and the exception offset is the offset address of the hardware instruction in the DLL that caused the error. In this case, it was an internal runtime error in which it was not possible to find a valid module, so we got a StackHash instead of a real value. Versions are regular version strings for Windows executables. The locale identifier is the one used by the globalization settings bank: 1033 - en-US.

The exception code can be interpreted here . In this example, the error was STATUS_HEAP_CORRUPTION.

Additional information fields are opaque data and are based on what was an exception code. I don’t know any useful information about these fields, probably not, and probably these fields are purposefully undocumented so that Microsoft can change them as necessary. These fields are usually md5 hashes of a large amount of information ... basically there, so you can compare the amount of information that can be the same / different quickly through the hash code so that you know if the message is associated with the same execution state as another.

Answer 2

This means that you have an inexperienced exception, and it crashes your application.

If it works in debug mode, you need to see how the release version differs. Are all libraries present? Do you have an app.config setting?

Check the event view under Windows Logs → Application for more information.

If you set up an exception handler, you will get much better information, such as a stack trace.

Answer 3

You need to create an alarm that can be analyzed after this fact. You will need to make some changes to the registry, and then you can parse the dump file using Visual Studio. Hope this gives you more clues like a specific function that fails.

See this website for more details: http://blog.functionalfun.net/2013/05/how-to-debug-silent-crashes-in-net.html

You will create DebugDiag, a tool from Microsoft.

Let me know how things are going, or if you find some of the best tools.

Hi,

Dave

Answer 4

In .net, Managed Debugger Assistants has a nice feature for troubleshooting interoperability with internal and managed codes . MSDN article on usage here

Exceptions thrown by MDA can be configured in the Visual Studio Exception Viewer.