TransWikia.com

How to debug an application (exe) freeze and crash?

Reverse Engineering Asked by Sofiane Djerbi on July 2, 2021

I have an app (and I don’t know the source code), that freeze and crash everytime it loses focus (but the music continue). I’ve tried to debug it using windbg but it doesn’t change anything, and I don’t know how to log the freeze/crash properly.

How can i know what happened ? In term of assembly instructions or memory ?

CONTEXT :

  • Graphic App (Nvidia drivers)
  • 32 BIT APP created on windows 7
  • Crash on windows 7 32 bit
  • Debugging on windows 10 64 bit
  • Not related to the hardware, crash on different computer the same way
  • Unfocus the app = Frozen, then "unresponding", nothing else. It crashes when windows send a report
  • Cannot crash when executed by a debugger, it only froze (Even the process manager cannot close the app)

UPDATE :
Procdump + Windbg analysis (The app didn’t crashed under procdump, it only crashed after stopping procdump process)

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

COMMENT:  
*** procdump.exe  -e -ma -t -w "name.exe"
*** Process termination

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00001f64

PROCESS_NAME:  name.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE_STR:  80000003

STACK_TEXT:  
1d63fdb0 77131030     000002e4 06ff3150 00000010 ntdll!NtWaitForWorkViaWorkerFactory+0xc
1d63ff70 76abfa29     00b39e00 76abfa10 1d63ffdc ntdll!TppWorkerThread+0x2a0
1d63ff80 771475f4     00b39e00 26f0b456 00000000 kernel32!BaseThreadInitThunk+0x19
1d63ffdc 771475c4     ffffffff 77167350 00000000 ntdll!__RtlUserThreadStart+0x2f
1d63ffec 00000000     77130d90 00b39e00 00000000 ntdll!_RtlUserThreadStart+0x1b


SYMBOL_NAME:  ntdll!NtWaitForWorkViaWorkerFactory+c

MODULE_NAME: ntdll

IMAGE_NAME:  ntdll.dll

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb

FAILURE_BUCKET_ID:  BREAKPOINT_80000003_ntdll.dll!NtWaitForWorkViaWorkerFactory

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 10

IMAGE_VERSION:  6.2.19041.662

FAILURE_ID_HASH:  {bb9287bd-f940-f1d0-c927-6d6da8a242a3}

Followup:     MachineOwner

Update 2 :
It seems that only the graphic content freeze. The sounds is okay

Update 3 :
Freeze when whole computer when fullscreen. Cannot access to any other window, WIN key show taskbar but nothing happen when trying to switch app even with WIN+TAB

Update 4 :
Seems to be related to Nvidia drivers

One Answer

I finally solved it but I really don't know how and why. It was nvidia drivers, changing gpu solved the error. With nvidia gpu, adding it to the program list solved it. Whatever, I wonder how we can fix that without user interaction

Answered by Sofiane Djerbi on July 2, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP