I fired up WinDbg, with the SOS extension. Then I went to File -> Open Executable, and chose the application to start. As WinDbg breaks before the program are actually run, I pressed F5, to continue the application. Then WinDbg breaks later on because of an exception, with an output something like this:
ModLoad: 77650000 77716000 C:\Windows\system32\ADVAPI32.dll ModLoad: 777a0000 77863000 C:\Windows\system32\RPCRT4.dll ModLoad: 72d70000 72dd6000 C:\Windows\Microsoft.NET\Framework\v4.0.30109\mscoreei.dll ModLoad: 765c0000 76619000 C:\Windows\system32\SHLWAPI.dll ModLoad: 77cc0000 77d0b000 C:\Windows\system32\GDI32.dll ModLoad: 76620000 766bd000 C:\Windows\system32\USER32.dll ModLoad: 77870000 7791a000 C:\Windows\system32\msvcrt.dll ModLoad: 766c0000 766de000 C:\Windows\system32\IMM32.DLL ModLoad: 76410000 764d8000 C:\Windows\system32\MSCTF.dll ModLoad: 76350000 76359000 C:\Windows\system32\LPK.DLL ModLoad: 76390000 7640d000 C:\Windows\system32\USP10.dll ModLoad: 750e0000 7527e000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll ModLoad: 72250000 727e0000 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ModLoad: 73e90000 73f2b000 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\MSVCR80.dll ModLoad: 768b0000 773c0000 C:\Windows\system32\shell32.dll ModLoad: 773c0000 77505000 C:\Windows\system32\ole32.dll ModLoad: 70c50000 71748000 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\894183c0c47bd4772fbfad4c1a7e3b71\mscorlib.ni.dll ModLoad: 60340000 60348000 C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture.dll ModLoad: 72ea0000 72eec000 image72ea0000 ModLoad: 00a70000 00abc000 image00a70000 ModLoad: 72ea0000 72eec000 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_da_b77a5c561934e089\mscorlib.resources.dll (1090.1160): C++ EH exception - code e06d7363 (first chance) (1090.1160): C++ EH exception - code e06d7363 (first chance) (1090.1160): C++ EH exception - code e06d7363 (first chance) (1090.1160): C++ EH exception - code e06d7363 (first chance) (1090.1160): C++ EH exception - code e06d7363 (first chance) (1090.1160): CLR exception - code e0434f4d (first chance) (1090.1160): CLR exception - code e0434f4d (!!! second chance !!!) eax=002cfb50 ebx=e0434f4d ecx=00000001 edx=00000000 esi=002cfbd8 edi=000f79a8 eip=7651fbae esp=002cfb50 ebp=002cfba0 iopl=0 nv up ei pl nz ac pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216 KERNEL32!RaiseException+0x58: 7651fbae c9 leaveI start by looking at the stack of the thread throwing the exception, using kb:
0:000> kb
ChildEBP RetAddr Args to Child
002cfba0 722ae774 e0434f4d 00000001 00000001 KERNEL32!RaiseException+0x58
002cfc00 7230dc9c 01f91444 00000000 00000000 mscorwks!RaiseTheExceptionInternalOnly+0x2a8
002cfc38 723e5a54 ffffffff 00126d28 cdf37c13 mscorwks!UnwindAndContinueRethrowHelperAfterCatch+0x70
002cfc84 72d76210 722c3d8f 002cfca0 72e57f16 mscorwks!_CorExeMain+0x1ac
002cfc90 72e57f16 00000000 72d70000 002cfcb4 mscoreei!_CorExeMain+0x38
002cfca0 72e54de3 00000000 7652d0e9 7ffda000 mscoree!ShellShim__CorExeMain+0x99
002cfca8 7652d0e9 7ffda000 002cfcf4 77af19bb mscoree!_CorExeMain_Exported+0x8
002cfcb4 77af19bb 7ffda000 72824509 00000000 KERNEL32!BaseThreadInitThunk+0xe
002cfcf4 77af198e 72e54ddb 7ffda000 00000000 ntdll!__RtlUserThreadStart+0x23
002cfd0c 00000000 72e54ddb 7ffda000 00000000 ntdll!_RtlUserThreadStart+0x1b
Here I can see that it is a .NET exception cause the application crash. This means that I can use the SOS command !pe, to look close at the exception. First I load SOS, using .load sos, and then the !pe command.0:000> .load sos 0:000> !pe Exception object: 01f91444 Exception type: System.IO.FileNotFoundException Message: The file or assembly 'xxx.dll', Version=1.0.3672.38321, Culture=neutral, PublicKeyToken=cfb1f46daa2d0af2' or one of its dependencies could not be found. The file could not be found. InnerException:Now the real error message appears, and the problem can be solved.StackTrace (generated): StackTraceString: HResult: 80070002
I'm pretty sure that the error message are supposed to be shown in the Windows Event Log, and that it has before, but for some reason this was not the case in the situation above.
Nice blog ,,, This blog help you to find your DLL file is corrupt or missing .please go through this link.
ReplyDeleteHow To Remove Rundll Error
Thank you
Aalia lyon