Trapping an exception in the kernel

  • Thread starter Thread starter Andrew Chalk
  • Start date Start date
A

Andrew Chalk

My app. sees an exception from the kernel at an obscure address, 0x7c59ba9d.
When running under the VC++ 6.0 debugger, I can trap this each time it
occurs. If I want to trap it in my program and just tell the program to just
continue (i.e. not pass the exception up the chain) how do I do this?

Any idea how I can find out what the cause of the exception is? In the call
stack my program doesn't appear. MSCORWKS (which I think is .NET, the
framework used by the app. that calls my DLL) and KERNEL32 do.

Many thanks for any help that you can give.
 
The address 0x7c59ba9d does not appear to be a kernel address.
It's a user mode address.

You have not told us which kind of exception this is:
one ACCESS_VIOLATION ?
a CLR Exception ?

on average, the way to "continue" the exceptio is something along these
lines.
The ExceptionFilter may be incorrect for your case,
since you have not provided enough information,
and we even don't knonw if the exception is continuable.

DWORD ExceptionFilter(LPEXCEPTION_POINTERS ExceptionPointers){
CONTEXT * pContext = ExceptionPointers->ContextRecord;
if (0x7c59ba9d == (ULONG_PTR)Context->eip){
return EXCEPTION_CONTINUE_EXECUTION;
} else {
return EXCEPTION_CONTINUE_SEARCH.
}
}

Function(){
__try {
// your code here
} __except (ExceptionFilter(GetExceptionInformation())) {
// nothing
}
}
 
Sorry. My sloppy terminology -- In a call to KERNEL32. Here is the call
stack:

KERNEL32! 7c59ba9d()
MSCORWKS! 792206a8()
MSCORWKS! 7922063e()
MSCORWKS! 792205f1()
MSCORWKS! 792205d1()
MSCORWKS! 792a85fc()
MSCORWKS! 792a8ef9()
MSCORWKS! 79248678()
03f21d1e()
056ad957()
055d8422()
0474a865()
0474a5a7()
MSCORWKS! 791ece8a()
MSCORWKS! 791eb8a0()
MSCORWKS! 791f3941()
MSCORWKS! 791f38ff()
MSCORWKS! 792cc5f8()
MSCORWKS! 792cc6be()
KERNEL32! 7c57b382()

From this, it appears to be a CLR exception. Correct?

Thanks for the rest of your answer. What should I bracket with the __try()
block? My code is inside an ActiveX control that is loaded by a VB.NET
application.

Regards,

Andrew
 
If you could use a system debugger like cdb/ntsd/windbg from
http://www.microsoft.com/whdc/ddk/debugging/default.mspx?gssnb=1
and report the output of the '~*kb' command, that would help to see more
things.

The stack below is equvalent (as an educate guess) to a call to
kernel32!RaiseException.
The CLR raises C++ exception, CLR exceptin and some native exception as
well,
plus some intentional Access Violation in order to implement the
System.NullReferenceException.

As a general suggestion, you should add this constructs in your VB.NET code,
since the approach suggested below does not look feasible in you case.

Try
' your code here
Catch E as Exception
' your cleanup code here
End Catch


--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
 
Thanks. What additional information would windbg give me. I already get an
assembler listing and a call stack in VC++?

Regards
 
something like the param passed to the RaiseException function,
so that I can see which exception it is and from which callstack with GOOD
SYMBOLS ?
The stack below is only good for a guess.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
 
So windbg shows symbols?
Ivan Brugiolo said:
something like the param passed to the RaiseException function,
so that I can see which exception it is and from which callstack with GOOD
SYMBOLS ?
The stack below is only good for a guess.
Click to expand...
 
If you point it to the public symbol server, it will give a pretty decent
stack trace.
Follow the instruction on the page I pointed you out, and report the output
of `~*kb'.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
 
I ran my executable from the WinDbg File->Open Executable menu and when the
first chance exception that I am looking for occurred, execution did not
halt. Any idea what I am doing wrong?

Regards,

Andrew
 
Andrew Chalk said:
I ran my executable from the WinDbg File->Open Executable menu and when the
first chance exception that I am looking for occurred, execution did not
halt. Any idea what I am doing wrong?
Click to expand...

To enable 1st chance break on specific exceptions, do 'sxe <exception
code>'.

If you are interested in .NET exceptions, you can also do 'sxe clr'.
 
Thanks. I'll try this.

Pavel Lebedinsky said:
To enable 1st chance break on specific exceptions, do 'sxe <exception
code>'.

If you are interested in .NET exceptions, you can also do 'sxe clr'.
Click to expand...
 
Back
Top