CODEWITHSUNDEEP
c#.net-4.5ntdll
srajeshnkl
srajeshnkl

Reputation: 901

Application crash in ntdll.dll, version: 6.1.7601.23677 with .Net Framework Version: v4.0.30319

My application is crashing frequently after updating .Net frame work. Below is the application event log found in event viewer,

Faulting application name: MyApp.exe, version: Version of my App, time stamp: 0x5885f545 Faulting module name: ntdll.dll, version: 6.1.7601.23677, time stamp: 0x589c957a Exception code: 0xc015000f Fault offset: 0x00084269 Faulting process id: 0x%9 Faulting application start time: 0x%10 Faulting application path: %11 Faulting module path: %12 Report Id: %13 Faulting package full name: %14 Faulting package-relative application ID: %15

Also below error also found in event logs,

Application: MyApp.exe .Net Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception. Exception Info: exception code c015000f, exception address 77994269

For me looks like there is a compatibility issue between ntdll.dll and .Net version. Is there any KB needs to be installed along with .Net 4.0.30319?

I am analysing crash dump, It shows below call stack,

0 0042eb84 7566171a ntdll!NtWaitForMultipleObjects+0x15
01 0042ec20 75551a08 KERNELBASE!WaitForMultipleObjectsEx+0x100
02 0042ec68 75554200 kernel32!WaitForMultipleObjectsExImplementation+0xe0
03 0042ec84 755780ec kernel32!WaitForMultipleObjects+0x18
04 0042ecf0 75577fab kernel32!WerpReportFaultInternal+0x186
05 0042ed04 755778a0 kernel32!WerpReportFault+0x70
06 0042ed14 7557781f kernel32!BasepReportFault+0x20
07 0042eda0 77395b67 kernel32!UnhandledExceptionFilter+0x1af
08 0042eda8 77395a44 ntdll!__RtlUserThreadStart+0x62
09 0042edbc 773958d1 ntdll!_EH4_CallFilterFunc+0x12
0a 0042ede4 773834c9 ntdll!_except_handler4+0x8e
0b 0042ee08 7738349b ntdll!ExecuteHandler2+0x26
0c 0042ee2c 7738343c ntdll!ExecuteHandler+0x24
0d 0042eeb8 77330143 ntdll!RtlDispatchException+0x127
0e 0042eeb8 773a41c9 ntdll!KiUserExceptionDispatcher+0xf
0f 0042f3e0 7555544c ntdll!RtlDeactivateActivationContext+0x154
10 0042f3f0 055e70ce kernel32!DeactivateActCtx+0x31
11 0042f434 013e1fd1 mydll!Mydll::Function+0x8e

The issue is with Windows 2008. In one of the machine which has same .Net version and ntdll.dll version 6.1.7601.17514, the application works fine.

But only with ntdll.dll version 6.1.7601.23677 the application crashes.

Upvotes: 3

Views: 4434

Answers (1)

Fruchtzwerg
Fruchtzwerg

Reputation: 11399

I faced a similar issue loading a managed .NET dll from an unmanaged cpp application.

I found out that .NET exceptions, even if they are catched, could crash the application. It seems that building the host application with the /CETCOMPAT (CET Shadow Stack compatible) flag enabled caused the issue.

In short (more details): Catching exceptions leads to a change of the stack which is detected as a violation and causes a termination of the process.

Upvotes: 0

Related Questions