1

Recently i installed an application that was built using Delphi , when i try to load some files in the application i get Access violation at address 00000000 . i couldn't find any info about the problem in the event viewer so i went to use process explorer to generate a dumb file for the process and then used the file in WinDbg and the output was as follow:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\xVisualizer3D.dmp] User Mini Dump File: Only registers, stack and portions of memory are available

************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 7 Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible Product: WinNt, suite: SingleUserTS Machine Name: Debug session time: Sat Nov 12 18:56:37.000 2022 (UTC + 2:00) System Uptime: not available Process Uptime: 0 days 0:00:32.000 ................................................................ .................................. For analysis of this file, run !analyze -v *** WARNING: Unable to verify checksum for Visualizer3D.exe eax=00320620 ebx=0008e301 ecx=00000000 edx=00000000 esi=00000000 edi=00000000 eip=767939c0 esp=0018fed4 ebp=0018ff04 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 user32!NtUserWaitMessage+0x15: 767939c0 83c404 add esp,4 0:000> !analyze -v


  •                                                                         *
    
  •                    Exception Analysis                                   *
    
  •                                                                         *
    




*** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. ***


*** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. ***


*** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. ***


*** Type referenced: kernel32!gpServerNlsUserInfo ***



KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 1343

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 289371

Key  : Analysis.IO.Other.Mb
Value: 6

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 7

Key  : Analysis.Init.CPU.mSec
Value: 562

Key  : Analysis.Init.Elapsed.mSec
Value: 407939

Key  : Analysis.Memory.CommitPeak.Mb
Value: 69

Key  : Timeline.Process.Start.DeltaSec
Value: 32

Key  : WER.Process.Version
Value: 3.0.0.30


FILE_IN_CAB: xVisualizer3D.dmp

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00000000 ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0

FAULTING_THREAD: 00000e60

PROCESS_NAME: Visualizer3D.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.

EXCEPTION_CODE_STR: 80000003

STACK_TEXT:
0018fed4 006b0756 0018ff30 006b0773 0018ff04 user32!NtUserWaitMessage+0x15 WARNING: Stack unwind information not available. Following frames may be wrong. 0018ff04 006af968 001a036e 00000113 00000001 Visualizer3D!TMethodImplementationIntercept+0x1c3ece 0018ff58 00bbca0a 00bbcab9 0018ff78 00bbcad1 Visualizer3D!TMethodImplementationIntercept+0x1c30e0 0018ff88 7628343d 7efde000 0018ffd4 771f9832 Visualizer3D!TMethodImplementationIntercept+0x6d0182 0018ff94 771f9832 7efde000 77ecc335 00000000 kernel32!BaseThreadInitThunk+0xe 0018ffd4 771f9805 00bbc8a8 7efde000 00000000 ntdll!__RtlUserThreadStart+0x70 0018ffec 00000000 00bbc8a8 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND: ~0s; .ecxr ; kb

SYMBOL_NAME: visualizer3d+1c3ece

MODULE_NAME: Visualizer3D

IMAGE_NAME: Visualizer3D.exe

FAILURE_BUCKET_ID: BREAKPOINT_80000003_Visualizer3D.exe!Unknown

OSPLATFORM_TYPE: x86

OSNAME: Windows 7

IMAGE_VERSION: 3.0.0.30

FAILURE_ID_HASH: {860298c4-6043-6454-52eb-067e0c079603}

Followup: MachineOwner

I don't know what to do after this point , and looked through the info above and couldn't find any useful information about the cause of the problem and not sure ,but i think i'm having problem with symbols also in the debugger .

So what can i do now to find the cause of the exception ?

Note: I don't have the source code for this program , also i tried to install the application on another pc (with win 10 installed) and worked without any problem .

Regards

  • How have you generated the dmp file? It doesn't show an Access violation error. – harrymc Nov 12 '22 at 18:53
  • @harrymc using Process Explorer , created a dmp file while the process is running and throwing the exception , Am I doing it wrong ? – user727701 Nov 12 '22 at 19:39
  • The dump shows what the process was doing when dumped, which is just running. See Creating an Application Crash Dump. You could upload the crash file if you wish us to have a look at it. – harrymc Nov 12 '22 at 20:46
  • I followed all the instructions in the site , but no crash dump was generated , is there another method ? – user727701 Nov 12 '22 at 22:05
  • What is your Windows version? – harrymc Nov 12 '22 at 22:15
  • @harrymc windows 7 – user727701 Nov 12 '22 at 22:23
  • This advice for getting dumps should have worked on Windows 7. The application might be trapping its crashes, for some reason, this way suppressing the dumps. What is this app? If this is OKM Visualizer 3D Studio, there might exist newer versions, and their Support may answer. – harrymc Nov 13 '22 at 08:59
  • yes , it is OKM Visualizer 3D Studio , there is no new version available and the support team taking forever to reply sir . If there is a way to catch this exception in any debugger please let me know . – user727701 Nov 13 '22 at 09:35

1 Answers1

1

As the Windows mechanism for Creating an Application Crash Dump by setting the registry key of HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\SomeProcess.exe, does not work for the OKM Visualizer 3D Studio application, you need to debug it yourself.

You need to run the application from the debugger. You could try Windbg or Visual Studio or Visual Studio Code.

This way, the debugger will be in control all along. You need to assure that the debugger is set to trap the error code of Access violation.

This will require some knowledge of reading the execution stack and its parameters.

However, as you do not have the source for the application, and as the Support of the app does not answer, it's unclear what you will achieve by better understanding the problem. You might be better off trying to find an alternative product.

I would also try this product on a computer running Window 10. Many products today no longer support Windows 7, and this product might be one of them.

harrymc
  • 480,290