Fatal exception 0xc0000005 from USER32.DLL

Question

Environment: C++ using VS 2010 running on Win10.

I have an application that crashes with error log entry:

--
Log Name: Application
Source: Application Error
Date: 2021-11-05 9:33:39 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: COMPUTER-RM
Description:
Faulting application name: envservices.exe, version: 4.0.5.0, time stamp: 0x60119cd5
Faulting module name: USER32.dll, version: 10.0.19041.1288, time stamp: 0x28f79a20
Exception code: 0xc0000005
Fault offset: 0x0005199f
Faulting process id: 0x20b4
Faulting application start time: 0x01d7d24a35f27cd1
Faulting application path: c:\Envision\apps\envservices.exe
Faulting module path: C:\Windows\System32\USER32.dll
Report Id: dad4e331-e7b4-43d9-8a56-8bd016cfdf09
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-11-06T01:33:39.0769078Z" />
<EventRecordID>4629</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>COMPUTER-RM</Computer>
<Security />
</System>
<EventData>
<Data>envservices.exe</Data>
<Data>4.0.5.0</Data>
<Data>60119cd5</Data>
<Data>USER32.dll</Data>
<Data>10.0.19041.1288</Data>
<Data>28f79a20</Data>
<Data>c0000005</Data>
<Data>0005199f</Data>
<Data>20b4</Data>
<Data>01d7d24a35f27cd1</Data>
<Data>c:\Envision\apps\envservices.exe</Data>
<Data>C:\Windows\System32\USER32.dll</Data>
<Data>dad4e331-e7b4-43d9-8a56-8bd016cfdf09</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>

--
Only partly useful.
It would be very helpful to be able to determine which module in USER32.DLL caused this fault.

Of course it never fails in the lab environment or I could run it under a debugger and capture the point of failure.
It fails at a customer site and the machine is rebooted to start it up again. Rate of failure could be days or weeks.

Is there any way of getting more useful information?

Thanks.

Answer 1

if you have access to the machine where it crashes, you could use ADPlus to generate a dump file upon crash.

See excerpt from https://www.ibm.com/support/pages/using-microsoft-adplus-capture-windows-process-dump-troubleshoot-filenet-p8-and-image-services-issues

---

To capture a dump on a crash condition: If a specific process is crashing, the following commands can be used to force a dump at the time of failure. The adplus command must be executed prior to the failure, so that the crash will automatically trigger the dump. For example:

cscript adplus -quiet -crash -pn <process_name>.exe -nodumponfirst -ctcf -o <output_directory> -y c:\winnt\symbols

The above command allows First Chance Exceptions to be logged without forcing a dump.

However, the following command will force a dump on any exception:

cscript adplus -crash -pn <process_name>.exe -ctcf -o <output_directory> -y c:\winnt\symbols

---

-SM

Answer 2

Hello,
you should add minidump handling into your programme.
Post-Mortem-Debugging-Your-Application-with-Minidu
It will show you in your source where the app is "crashing". Since the error is not reproducable in debug mode, it sounds like a memory or variable initialization error.
Regards, Guido