System.AccessViolationException in .NET 2.0 application

[nagar]

A couple of customers have reported a System.AccessViolationException.
From the stack trace I received with the error I can see that the
exception is thrown from different places in the code.
This happened on Windows XP SP2.
Any idea of what the problem can be? Maybe a problem that has to do
with multithreading?
Thanks.
Andrea

Here's a paste of the two stack traces with the error

System.AccessViolationException: Attempted to read or write protected
memory. This is often an indication that other memory is corrupt.
at
System.Windows.Forms.UnsafeNativeMethods.GetOpenFileName(OPENFILENAME_I
ofn)
at System.Windows.Forms.OpenFileDialog.RunFileDialog(OPENFILENAME_I
ofn)
at System.Windows.Forms.FileDialog.RunDialog(IntPtr hWndOwner)
at System.Windows.Forms.CommonDialog.ShowDialog(IWin32Window owner)
at System.Windows.Forms.CommonDialog.ShowDialog()
at
Nagarsoft.DirectAccess.FileSystemHelper.ShowFileSelectDialog(String
curselFilename, Boolean fileMustExist, Boolean showfilename, Boolean
multiselect, String title, String filter, String[]& selectedFiles)

System.AccessViolationException: Attempted to read or write protected
memory. This is often an indication that other memory is corrupt.
at System.Windows.Forms.UnsafeNativeMethods.IntCreateWindowEx(Int32
dwExStyle, String lpszClassName, String lpszWindowName, Int32 style,
Int32 x, Int32 y, Int32 width, Int32 height, HandleRef hWndParent,
HandleRef hMenu, HandleRef hInst, Object pvParam)
at System.Windows.Forms.UnsafeNativeMethods.CreateWindowEx(Int32
dwExStyle, String lpszClassName, String lpszWindowName, Int32 style,
Int32 x, Int32 y, Int32 width, Int32 height, HandleRef hWndParent,
HandleRef hMenu, HandleRef hInst, Object pvParam)
at System.Windows.Forms.NativeWindow.CreateHandle(CreateParams cp)
at System.Windows.Forms.Timer.TimerNativeWindow.EnsureHandle()
at System.Windows.Forms.Timer.TimerNativeWindow.StartTimer(Int32
interval)
at System.Windows.Forms.Timer.set_Enabled(Boolean value)
at System.Windows.Forms.Timer.Start()

 

[Jeffrey Tan[MSFT]]

Hi,

I have searched this exception and call stack in internal database and
found 2 reported records with the same error. However, both 2 records are
closed as "can not reproduce".

Based on the call stack, there is an AV exception in the
UnsafeNativeMethods.GetOpenFileName code which wraps Win32 GetOpenFileName
API in comdlg32.dll. So the exception is generated in Win32 side while the
Net exception call stack only shows the managed call stack. It is almost
impossible to find out the root cause without using unmanaged debugging to
dig into GetOpenFileName.

Can you reproduce your customers' problem on your side? If so, please feel
free to provide the sample project. I will help to use the windbg to
perform Win32 debugging to find out which x86 instruction is accessing
invalid memory region. You may send the sample project to me at:
(e-mail address removed)(remove "online.")

Just a guess, since the calling of GetOpenFileName API comes from .Net
Framework code, I would not suspect the code of GetOpenFileName or
parameters passed from .Net. I suspect certain 3rd party software may have
corrupted your memory region or changed the CPU registers, which caused the
CPU to read/write an invalid memory region. You may ask your customer to
turn off any anti-virus softwares and screen translation softwares. These
softwares may inject code/dll into any application memory space for hooking
purpose. A more technical way is listing all the modules/dlls in your
application process in problematic machine to examine if there is any
abnormal module/dll(that is neither Microsoft dlls or your application
dlls). You may ask the customer to download Process Explorer to examine the
dll list:
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExp
lorer.mspx

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[nagar]

Hi Jeffrey,

I can't contact the customer as I got an anonymous crash notification.
From what you told me it looks like it's not a fault of my application
(I never got this kind of problems when I used .NET 1.1).
Is there anything I can do to my application to prevent this problems
to happen?
Thanks.
Andrea

 

[Jeffrey Tan[MSFT]]

Hi Andrea,

Thank you for the feedback.

Yes, I do not think this is a problem of your application unless you have
done some type of unmanaged code interop in your application, which may
corrupt the process memory(such as buffer overrun). If all your code are
managed, you should be okay.

In current situation, I do not think there is any way to resolve this
problem from your application code. Because it is the customer's
responsibility to prevent instable code from injecting other processes.
Once the 3rd party code subverted the process memory or code execution
path, we have no way to recover back, because we even do not know how the
malicious code subverted the process.

The recommended defensive solution is providing a detailed crash report.
For example, your crash report may obtain a minidump of your application,
also contain the module list of your process and the process list of the
system. These information will be useful to find out the criminal. This
technology is also taken by Microsoft products. For example, Windows Error
Report will send detailed crash information to the Microsoft when internet
is avaiable.

The 2 articles below use dbghelp.dll MiniDumpWriteDump API to generate dump
for an application:
"XCrashReport : Exception Handling and Crash Reporting - Part 3"
http://www.codeproject.com/debug/XCrashReportPt3.asp
http://www.debuginfo.com/tools/clrdump.html

After getting detailed reports from production machine, you may analysis
them to find out the root cause. Then, you may attach announcement with
your application to warn end users that certain 3rd party softwares may
collide/corrupt your applications.

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[nagar]

Hi Jeffrey,

I use both managed and unmaged code in my application so I'm not
absolutely certain that there isn't any fault in it.
Everything worked fine when using the .NET 1.1.
Thanks.
Andrea

 

[nagar]

I'm doing some tests on a freshly installed Windows Vista x64 on
VMWare. I've just installed my application. I use the sendInput to
send text to the target application. What happens is that I get the
AccessViolationException. Any idea of what it can be? At this point, I
think that's a problem of my application as there no other software
running.
Thanks
Andrea

PS: could obfuscation create problems?

 

[Jeffrey Tan[MSFT]]

Hi Andrea,

Thank you for the feedback.

The current information is not enough for us to analysis the root cause.

Since you can reproduce now, is it possible for you to create a little
sample project and send to me for local reproduce? Also, does this problem
only occur on Vista x64? Can you reproduce it on x86 Windows?

Since the detailed information can only be seen from unmanaged code side,
we have to use windbg to perform unmanaged debugging over it. If you want
to debug it yourself, please follow my blog entry below to setup windbg and
obtain a native call stack of this AV exception:
"How to debug application crash/hang in production environment?"
http://blogs.msdn.com/msdnts/archive/2006/11/24/how-to-debug-application-cra
sh-hang-in-production-environment.aspx

Thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[nagar]

Do you think that obfuscation could play a role in this random AV
exceptions? (I'm using Xenocode).
I saw an AV occurr consistently when opening a simple window in my
application. Then, I tried obfuscation the application again and it
worked fine.
Could this be the cause?
Thanks
Andrea

 

[Jeffrey Tan[MSFT]]

Hi Andrea,

Thank you for the feedback.

I have no idea about the Xenocode obfuscation. Basically, obfuscation will
not modify the code execution path and intervene the JITed code. Below is
the Obfuscation principle:
http://www.aspnetpro.com/newsletterarticle/2006/10/asp200610jk_l/asp200610jk
_l.asp

However, if there is any bug in their product, it may cause the problem.

If you are suspecting the obfuscation, I recommend you first do not
obfuscate it for debugging purpose. If you are still experiencing the AV,
it should not be caused by the obfuscation.

Anyway, can you provide a sample project for local reproduce?

Thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Jeffrey Tan[MSFT]]

Hi Andrea,

Have you reviewed my last reply to you? Does it make sense to you? How
about your problem now? If you need further help or concern, please feel
free to tell me, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[nagar]

Thanks Jeffrey,

the problem didn't happen again. I'll write back if I'm having more
problems. Thanks.
Andrea

 

[Jeffrey Tan[MSFT]]

Hi Andrea,

Thank you for confirming the status.

If you need any further help, please feel free to post, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.