3 Replies Latest reply on Aug 5, 2010 8:34 AM by Jeffrey Hyson

    Exception in "msvcrt.dll"

      Hi,

      I’ve got an exception within msvcrt.dll and can’t resolve the function name where it happens.

       

      I provided the correct msvcrt.pdb (checked with “symchk.exe”) but nevertheless AppSight Code Console only shows the address (Exception at 0x….).

      Ok, I tried out to find the nearest function with “WinDbg” but I’m not sure I caught it.

       

      Is anybody experienced with such an issue?

        • 1. Re: Exception in "msvcrt.dll"
          Jeffrey Hyson

          The AppSight Code console uses Microsoft's DIA SDK to read the PDB file to find the function name by Relative Virtual Address (RVA).  If the console does not display the function name you really need to ask Microsoft why.the symbol is not public.

           

          You can use Microsoft's Dia2Dump utility (http://msdn.microsoft.com/en-us/library/b5ke49f5(VS.80).aspx) to dump the contents of the entire PDB file.

           

          If you want you can use Dia2Dump to manually find public symbols just before the RVA of the exception.

          1) In the recording the exception is showing the Virtual Address (VA) of the function, let's say the number is 0x7c1f4872

          2) To obtain the RVA you need the base address of the DLL

          3) Go to the Modules tab in the System Console and locate the base Address of the DLL, let's say the number is 0x7c140000

          4) Subtract the 2 addresses 0x7c1f4872 - 0x7c140000 = 0xB4872 which is the RVA

          5) Use Dia2Dump to display public symbols just before this RVA

              DiaDump -psr B4872 msvcrt.pdb

           

          With the RVA of the exception Microsoft "Technically" should be able to identify the function name using a MAP file (http://msdn.microsoft.com/en-us/library/k7xkk3e2(VS.80).aspx) built by the Linker.

          1 of 1 people found this helpful
          • 2. Re: Exception in "msvcrt.dll"

            Thanks a lot,

             

            using Dia2Dump shows that I was on the right track with WinDbg using the Virtual Address:

             

            Dia2Dump -psr 1272c msvcrt.pdb

            PublicSymbol: [000126F6][0001:000116F6] __CxxThrowException@8(__CxxThrowExceptio

            n@8)

             

            WinDbg:

            0:001> ln 0x77c2272c

            (77c226f6)   msvcrt!_CxxThrowException+0x36   |  (77c22738)   msvcrt!_EH_prolog

             

            unfortunately this won't help finding my problem. I don't know why the exception was thrown!

             

            best regards

             

            Thomas

            • 3. Re: Exception in "msvcrt.dll"
              Jeffrey Hyson

              Now I understand why you were not able to see the function name in AppSight Code.  We use shadow PDB files (C:\Program Files\BMC Software\BMC AppSight\AppSight for Windows\Data\stdpdbs) to help create code RPRs that supply function names and argument values.  The majority of the time the PDB files from Microsoft have function names but strip out function arguments, having function arguments is helpful when recording a function to see the data passed in.

               

               

              Sometimes, as in this case, having the shadow PDB file masks public symbols that could resolve the function name.  To determine if AppSight Code is using a shadow PDB file for a DLL you would need to open the code RPR and see if the text "msvcrt.dll - Built-in support" is applied.  If it is you need to right-click the entry and Locate Module/PDB...for the console to use a different PDB file.  By doing it this way the console will store a path (View --> Options --> Directories --> PDB section) to this directory, next time when any DLL is referenced it will also check any PDB file in this directory.

               

              That should help you next time see the correct function name in a stack dump.

               

              For your current stack dump in the Black Box recording there are other entries in the stack list that show the call history of how msvcrt!_CxxThrowException was invoked, you should view these entries and find a reference to one of your code module(s).  The equivalent in WinDbg is the kc command.