Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Help debugging dump file from application crash

26 Jun 2011   #1
Avital Chissick

Windows 7 Professional 32 Bit
 
 
Help debugging dump file from application crash

Hi all,



I'm developing a large application using Visual Studio 2008 using VB.NET,

with .NET Frameworks 2.0 .

The application also make extensive usage of the DevExpress controls suit.



Every now and then we get an application crash. Always with the same details



Windows reports Cabinet.Dll as the source of the crash.

This happens on Windows 7 only (in windows XP the application runs OK).

The crash occurs at different locations in the applications and we can't reproduce it.
At times it will repeat itself very often at a short period of time, and after that it won't happen for a while.



I used the adplus debugger to monitor a crash and get a dump by using the following command:


adplus -crash -pn app.exe -o c:\temp


I opened the dump file using WinDbg and used the following commands:
.loadby sos.dll mscorwks
!analyze -v



the results are pasted below.


I would appreciate any help with finding the source of the problem.


Thank you !



Code:
 
*****************************
******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for System.Windows.Forms.ni.dll *** ERROR: Module load completed but symbols could not be loaded for XXXwizard.exe *** WARNING: Unable to verify checksum for mscorlib.ni.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for nvoglv32.dll - GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.microsoft.com/StageOne...htm?Retriage=1 FAULTING_IP: cabinet!SetDecompressionType+e 6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 6d3615a4 (cabinet!SetDecompressionType+0x0000000e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 000000b1 Attempt to read from address 000000b1 PROCESS_NAME: XXXwizard.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 000000b1 READ_ADDRESS: 000000b1 FOLLOWUP_IP: cabinet!SetDecompressionType+e 6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h] MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 MANAGED_STACK: !dumpstack -EE OS Thread Id: 0x1790 (10) Current frame: ChildEBP RetAddr Caller,Callee FAULTING_THREAD: 00001790 BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff LAST_CONTROL_TRANSFER: from 6d3615d8 to 6d3615a4 STACK_TEXT: 0d53fdf4 6d3615d8 0000000f ffffffff 0551b848 cabinet!SetDecompressionType+0xe 0d53fe08 7506bfa7 ffffffff 750f0334 00020000 cabinet!FDIDestroy+0x19 0d53fe1c 7506bf59 00000000 0551b840 0a4e6f10 setupapi!DiamondTerminate+0x4e 0d53fe30 75087222 00000000 00000001 0d53fe54 setupapi!DiamondTlsInit+0x48 0d53fe40 750419a9 00000000 00000000 00000000 setupapi!ThreadTlsInitialize+0x39 0d53fe54 75041875 75040000 00000003 00000000 setupapi!DllMain+0x28 0d53feb4 7740af58 75040000 00000003 00000000 setupapi!_CRT_INIT+0x26d 0d53fed4 773e0677 750417e7 75040000 00000003 ntdll!LdrpCallInitRoutine+0x14 0d53ff78 773e06b3 00000000 00000000 0d53ff94 ntdll!LdrShutdownThread+0xe6 0d53ff88 7548119b 00000000 0d53ffd4 7740b429 ntdll!RtlExitUserThread+0x2a 0d53ff94 7740b429 073dd980 7c54ad49 00000000 kernel32!BaseThreadInitThunk+0x15 0d53ffd4 7740b3fc 6f691d43 073dd980 00000000 ntdll!__RtlUserThreadStart+0x70 0d53ffec 00000000 6f691d43 073dd980 00000000 ntdll!_RtlUserThreadStart+0x1b SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: cabinet!SetDecompressionType+e FOLLOWUP_NAME: MachineOwner MODULE_NAME: cabinet IMAGE_NAME: cabinet.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bd987 STACK_COMMAND: ~10s; .ecxr ; kb FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff_c0000005_cabinet.dll!SetDecompressionType BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff_cabinet!SetDecompressionType+e WATSON_STAGEONE_URL: **LINK REMOVED** Followup: MachineOwner ---------



My System SpecsSystem Spec
.
26 Jun 2011   #2
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by Avital Chissick View Post
Hi all,



I'm developing a large application using Visual Studio 2008 using VB.NET,

with .NET Frameworks 2.0 .

The application also make extensive usage of the DevExpress controls suit.



Every now and then we get an application crash. Always with the same details



Windows reports Cabinet.Dll as the source of the crash.

This happens on Windows 7 only (in windows XP the application runs OK).

The crash occurs at different locations in the applications and we can't reproduce it.
At times it will repeat itself very often at a short period of time, and after that it won't happen for a while.



I used the adplus debugger to monitor a crash and get a dump by using the following command:


adplus -crash -pn app.exe -o c:\temp


I opened the dump file using WinDbg and used the following commands:
.loadby sos.dll mscorwks
!analyze -v



the results are pasted below.


I would appreciate any help with finding the source of the problem.


Thank you !



Code:
 
*****************************
******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for System.Windows.Forms.ni.dll *** ERROR: Module load completed but symbols could not be loaded for XXXwizard.exe *** WARNING: Unable to verify checksum for mscorlib.ni.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for nvoglv32.dll - GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.microsoft.com/StageOne...htm?Retriage=1 FAULTING_IP: cabinet!SetDecompressionType+e 6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 6d3615a4 (cabinet!SetDecompressionType+0x0000000e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 000000b1 Attempt to read from address 000000b1 PROCESS_NAME: XXXwizard.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 000000b1 READ_ADDRESS: 000000b1 FOLLOWUP_IP: cabinet!SetDecompressionType+e 6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h] MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 MANAGED_STACK: !dumpstack -EE OS Thread Id: 0x1790 (10) Current frame: ChildEBP RetAddr Caller,Callee FAULTING_THREAD: 00001790 BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff LAST_CONTROL_TRANSFER: from 6d3615d8 to 6d3615a4 STACK_TEXT: 0d53fdf4 6d3615d8 0000000f ffffffff 0551b848 cabinet!SetDecompressionType+0xe 0d53fe08 7506bfa7 ffffffff 750f0334 00020000 cabinet!FDIDestroy+0x19 0d53fe1c 7506bf59 00000000 0551b840 0a4e6f10 setupapi!DiamondTerminate+0x4e 0d53fe30 75087222 00000000 00000001 0d53fe54 setupapi!DiamondTlsInit+0x48 0d53fe40 750419a9 00000000 00000000 00000000 setupapi!ThreadTlsInitialize+0x39 0d53fe54 75041875 75040000 00000003 00000000 setupapi!DllMain+0x28 0d53feb4 7740af58 75040000 00000003 00000000 setupapi!_CRT_INIT+0x26d 0d53fed4 773e0677 750417e7 75040000 00000003 ntdll!LdrpCallInitRoutine+0x14 0d53ff78 773e06b3 00000000 00000000 0d53ff94 ntdll!LdrShutdownThread+0xe6 0d53ff88 7548119b 00000000 0d53ffd4 7740b429 ntdll!RtlExitUserThread+0x2a 0d53ff94 7740b429 073dd980 7c54ad49 00000000 kernel32!BaseThreadInitThunk+0x15 0d53ffd4 7740b3fc 6f691d43 073dd980 00000000 ntdll!__RtlUserThreadStart+0x70 0d53ffec 00000000 6f691d43 073dd980 00000000 ntdll!_RtlUserThreadStart+0x1b SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: cabinet!SetDecompressionType+e FOLLOWUP_NAME: MachineOwner MODULE_NAME: cabinet IMAGE_NAME: cabinet.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bd987 STACK_COMMAND: ~10s; .ecxr ; kb FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff_c0000005_cabinet.dll!SetDecompressionType BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff_cabinet!SetDecompressionType+e WATSON_STAGEONE_URL: **LINK REMOVED** Followup: MachineOwner ---------


We need the actual dmp file to do further analysis. please upload it

\


To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.



To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.
My System SpecsSystem Spec
26 Jun 2011   #3
Avital Chissick

Windows 7 Professional 32 Bit
 
 

Ok, right now I can't reproduce the crash to recreate another dump file.
I enabled minidumps using what you said.

The folder containing the dumps created by adplus has 3 dump files:
FULLDUMP_FirstChance_epr_Process_Shut_Down - 550MB
FULLDUMP_SecondChance_av_AccessViolation - 551MB
MINIDUMP_FirstChance_av_AccessViolation - 12MB

I assume it's the last one you are refering to.
I'm attaching it as a zip.

Thank you.
My System SpecsSystem Spec
.

Reply

 Help debugging dump file from application crash




Thread Tools




Similar help and support threads
Thread Forum
Crash Dump file.
Whenever I play a game on my PC it restarts randomly, without any warning. I've attached the .dmp file from the last incident. Any help would be appreciated. Thank you.
BSOD Help and Support
Q: Delete application Crash Dump files?
I have a few application crash dump files (.dmp) in ...\AppData\Local\CrashDumps. Can I delete them safely using Windows Explorer? I have already removed the reports from the Acton Center and Disk Cleanup did not touch them.
Performance & Maintenance
Crash - Need some help with the debugging - Cannot open the .dmp file
Please help I cannot read the .dmp file and my computer has started to crash and I am trying to stop it.
BSOD Help and Support
help, NEED help analyzing crash dump file !!! PLEASE!
ok so iv been getting random bsod lately and it is becoming more frequent however i do not have knowledge on reading dump files i was wondering if someone could analyze the dump file and explain wats wrong THANK YOU !! IF YOU ARE ABLE TO DO SO PLEASE ASK TO SEND THE DMP FILE
BSOD Help and Support
Crash dump need debugging
Need som help debuging It crashs random
BSOD Help and Support
System Crash -Help with Dump file
My system keeps craching when I open the font folder and when I open an email in outlook. I have attaxhed a dump file for a crash caused by opening the font file. Anyone please help!
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 06:35.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App