Hallo liebes Forum,
wir haben bei uns häufige Programmabstürze beim Drucken aus der Druckvorschau. Die Druckvorschau wird dabei noch korrekt erzeugt. Jedoch tritt es nicht immer auf. Weil wir dem Hersteller der Software, welche List-Label einbindet, keinen 100% Weg nennen können diesen Fehler zu reproduzieren, möchte dieser uns leider nicht helfen.
OS: Windows Server 2012 R2 (x64)
List-Label: Version 22
Die dazugehörigen Einträge im Windows Ereignisprotokoll sehen so aus:
Name der fehlerhaften Anwendung: PrefGest.exe, Version: 14.1.0.2793, Zeitstempel: 0x5a216bdb
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.18895, Zeitstempel: 0x5a4b127e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000e6214
ID des fehlerhaften Prozesses: 0x53ac
Startzeit der fehlerhaften Anwendung: 0x01d3e69470747c15
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Preference\PrefSuite\PrefGest.exe
Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll
Berichtskennung: b8469878-5295-11e8-80d6-005056a04470
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Ausnahmecode und Fehleroffset sind immer gleich.
Das Problem tritt auf 3 unterschiedlichen Systemen auf. Mit “sfc /scannow” werden keine Fehler in der ntdll.dll angezeigt. Deswegen habe ich es mit den Debugging Tools versucht. Dabei ist der Callstack zu dem Fehler immer gleich.
Dazu möchte ich sagen, dass ich kein professioneller Debugger bin und derzeit nur versuche Muster zu finden.
Microsoft (R) Windows Debugger Version 10.0.15063.400 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\fileprint1\prefblue\WER-Logs\PrefGest\PrefGest.exe.21420.dmp]
User Mini Dump File with Full Memory: Only application data is available
Symbol search path is: srv*
Executable search path is:
Windows 8.1 Version 9600 MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer
6.3.9600.18217 (winblue_ltsb.160124-0053)
Machine Name:
Debug session time: Tue May 8 09:59:38.000 2018 (UTC + 2:00)
System Uptime: 26 days 6:10:04.946
Process Uptime: 0 days 1:40:44.000
................................................................
................................................................
................................................................
................................................................
...........................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(53ac.5178): Unknown exception - code c0000374 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=00000001 edx=77832378 esi=00000000 edi=51a10000
eip=7776c8ac esp=00186c10 ebp=00187070 iopl=0 nv up ei pl nz ac po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000212
ntdll!NtWaitForMultipleObjects+0xc:
7776c8ac c21400 ret 14h
0:000> !analyze -v crash
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for cmls22.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for cmll22.dll -
*** WARNING: Unable to verify checksum for PrefGest.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for PrefGest.exe -
*** WARNING: Unable to verify checksum for ToolkitPro1610vc110U.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ToolkitPro1610vc110U.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for cmct22.dll -
*** WARNING: Unable to verify checksum for Preference.PrefItems.Factory.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for Preference.PrefItems.Factory.dll -
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*** WARNING: Unable to verify checksum for System.Management.ni.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for cmut22.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for Cmll22ht.llx -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for cmdw22.dll -
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
eax=0018771c ebx=00000000 ecx=00000001 edx=77832378 esi=00000002 edi=8184d640
eip=77816214 esp=001876f8 ebp=00187788 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!RtlReportCriticalFailure+0x83:
77816214 eb33 jmp ntdll!RtlReportCriticalFailure+0xb8 (77816249)
Resetting default scope
FAULTING_IP:
ntdll!RtlReportCriticalFailure+83
77816214 eb33 jmp ntdll!RtlReportCriticalFailure+0xb8 (77816249)
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 77816214 (ntdll!RtlReportCriticalFailure+0x00000083)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 77832378
PROCESS_NAME: PrefGest.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE_STR: c0000374
EXCEPTION_PARAMETER1: 77832378
WATSON_BKT_PROCSTAMP: 5a216bdb
WATSON_BKT_PROCVER: 14.1.0.2793
PROCESS_VER_PRODUCT: PrefGest
WATSON_BKT_MODULE: ntdll.dll
WATSON_BKT_MODSTAMP: 5a4b127e
WATSON_BKT_MODOFFSET: e6214
WATSON_BKT_MODVER: 6.3.9600.18895
MODULE_VER_PRODUCT: Microsoft® Windows® Operating System
BUILD_VERSION_STRING: 6.3.9600.17415 (winblue_r4.141028-1500)
MODLIST_WITH_TSCHKSUM_HASH: 32a4f162b0f981448739fc3bad6d8c9d7303a95e
MODLIST_SHA1_HASH: 82c7368fb21b444bdcf8bbd99b65ca518c776b40
NTGLOBALFLAG: 0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
MISSING_CLR_SYMBOL: 0
PRODUCT_TYPE: 3
SUITE_MASK: 16
DUMP_FLAGS: 8000c07
DUMP_TYPE: 3
ANALYSIS_SESSION_HOST: BA-17002
ANALYSIS_SESSION_TIME: 05-08-2018 11:08:29.0139
ANALYSIS_VERSION: 10.0.15063.400 x86fre
MANAGED_CODE: 1
MANAGED_ENGINE_MODULE: clr
MANAGED_ANALYSIS_PROVIDER: SOS
MANAGED_THREAD_ID: 5178
THREAD_ATTRIBUTES:
ADDITIONAL_DEBUG_TEXT: SOS.DLL is not loaded for managed code. Analysis might be incomplete
LAST_CONTROL_TRANSFER: from 77818d78 to 77816214
FAULTING_THREAD: ffffffff
THREAD_SHA1_HASH_MOD_FUNC: 5b9cbe6a8e1f8b67ea048b9ac843445fbc28a70a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 1e2c6c4b3f00f688490e2e07efebb606a33466fb
OS_LOCALE: DEU
PROBLEM_CLASSES:
ID: [0n244]
Type: [ACTIONABLE]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Add
String: [BlockNotBusy]
PID: [0x53ac]
TID: [0x5178]
Frame: [2] : ntdll!RtlpLogHeapFailure
ID: [0n245]
Type: [HEAP_CORRUPTION]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x5178]
Frame: [0] : ntdll!RtlReportCriticalFailure
ID: [0n243]
Type: [DOUBLE_FREE]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x53ac]
TID: [0x5178]
Frame: [2] : ntdll!RtlpLogHeapFailure
ID: [0n115]
Type: [CLRSETUP_MSCORLIBMISMATCH]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x53ac]
TID: [0x5178]
Frame: [Unspecified]
ID: [0n234]
Type: [NOSOS]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [Unspecified]
Frame: [0]
BUGCHECK_STR: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_NOSOS_CLRSETUP_MSCORLIBMISMATCH
DEFAULT_BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_NOSOS_CLRSETUP_MSCORLIBMISMATCH
PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION
STACK_TEXT:
778323b0 777b6035 ntdll!RtlFreeHeap+0x44485
778323b4 753050be gdi32!IcmDeleteLocalDC+0x92
778323b8 752fc2ff gdi32!InternalDeleteDC+0x171
778323bc 752c9e9e gdi32!DeleteDC+0xe
778323c0 70ca5b2d cmls22!LsMailViewW+0x1b42d
778323c4 70ccd44f cmls22!LsMailViewW+0x42d4f
778323c8 70bb046d cmls22!LlStgsysCopySubstorageTo+0x1e01d
778323cc 70bb116a cmls22!LlStgsysCopySubstorageTo+0x1ed1a
778323d0 70bb236a cmls22!LlStgsysCopySubstorageTo+0x1ff1a
778323d4 70bb3dc9 cmls22!LlStgsysCopySubstorageTo+0x21979
778323d8 75308c80 gdi32!bInternalPlayEMF+0x79b
778323dc 75308ecc gdi32!EnumEnhMetaFile+0x2c
778323e0 70bb6038 cmls22!LlStgsysCopySubstorageTo+0x23be8
778323e4 70b8f003 cmls22!LlStgsysDrawPage+0x453
778323e8 70b593b5 cmls22!Ordinal40+0x593b5
778323ec 70b577b5 cmls22!Ordinal40+0x577b5
778323f0 70c4ddcb cmls22!LsGetDDXForms+0x2bcab
778323f4 70c53c2d cmls22!LsGetDDXForms+0x31b0d
778323f8 70cbe423 cmls22!LsMailViewW+0x33d23
778323fc 70c505cd cmls22!LsGetDDXForms+0x2e4ad
77832400 70c66884 cmls22!LsGetDDXForms+0x44764
77832404 75ba8e71 user32!_InternalCallWinProc+0x2b
77832408 75ba90d1 user32!UserCallWinProcCheckWow+0x18e
7783240c 75bb4d95 user32!CallWindowProcW+0x8d
77832410 72eee125 comctl32!CallNextSubclassProc+0xf1
77832414 72eee106 comctl32!DefSubclassProc+0x56
77832418 70cc22fb cmls22!LsMailViewW+0x37bfb
7783241c 70c66591 cmls22!LsGetDDXForms+0x44471
77832420 70cc26dd cmls22!LsMailViewW+0x37fdd
77832424 70cc20b5 cmls22!LsMailViewW+0x379b5
77832428 72eee15c comctl32!CallNextSubclassProc+0x170
7783242c 72eeded5 comctl32!MasterSubclassProc+0xa1
THREAD_SHA1_HASH_MOD: 8a7695731b898ca57690adf3a9cd21f2d1e26d0d
FOLLOWUP_IP:
cmls22!LsMailViewW+1b42d
70ca5b2d c7466400000000 mov dword ptr [esi+64h],0
FAULT_INSTR_CODE: 6446c7
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: cmls22!LsMailViewW+1b42d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: cmls22
IMAGE_NAME: cmls22.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5961c718
STACK_COMMAND: dps 778323b0 ; kb
BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_NOSOS_CLRSETUP_MSCORLIBMISMATCH_cmls22!LsMailViewW+1b42d
FAILURE_EXCEPTION_CODE: c0000374
FAILURE_IMAGE_NAME: cmls22.dll
BUCKET_ID_IMAGE_STR: cmls22.dll
FAILURE_MODULE_NAME: cmls22
BUCKET_ID_MODULE_STR: cmls22
FAILURE_FUNCTION_NAME: LsMailViewW
BUCKET_ID_FUNCTION_STR: LsMailViewW
BUCKET_ID_OFFSET: 1b42d
BUCKET_ID_MODTIMEDATESTAMP: 5961c718
BUCKET_ID_MODCHECKSUM: 36a7ae
BUCKET_ID_MODVER_STR: 22.4.2017.19508
BUCKET_ID_PREFIX_STR: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_NOSOS_CLRSETUP_MSCORLIBMISMATCH_
FAILURE_PROBLEM_CLASS: HEAP_CORRUPTION
FAILURE_SYMBOL_NAME: cmls22.dll!LsMailViewW
FAILURE_BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_NOSOS_CLRSETUP_MSCORLIBMISMATCH_c0000374_cmls22.dll!LsMailViewW
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/PrefGest.exe/14.1.0.2793/5a216bdb/ntdll.dll/6.3.9600.18895/5a4b127e/c0000374/000e6214.htm?Retriage=1
TARGET_TIME: 2018-05-08T07:59:38.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE: x86
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 Server TerminalServer
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 02:58:22
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415
ANALYSIS_SESSION_ELAPSED_TIME: a280
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:heap_corruption_actionable_blocknotbusy_double_free_nosos_clrsetup_mscorlibmismatch_c0000374_cmls22.dll!lsmailvieww
FAILURE_ID_HASH: {e6232cf5-e651-5e5e-058c-3f1d6ac67adb}
Followup: MachineOwner
---------Wenn ich die Informationen zu der cmls22.dll anzeige kommt dieses Ergebnis.
0:000> lmvm cmls22
Browse full module list
start end module name
70b00000 70e6e000 cmls22 (export symbols) cmls22.dll
Loaded symbol image file: cmls22.dll
Image path: C:\Program Files (x86)\Preference\PrefSuite\cmls22.dll
Image name: cmls22.dll
Browse all global symbols functions data
Timestamp: Sun Jul 9 08:03:04 2017 (5961C718)
CheckSum: 0036A7AE
ImageSize: 0036E000
File version: 22.4.2017.19508
Product version: 22.4.2017.19508
File flags: 0 (Mask 0)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: combit GmbH
ProductName: combit List & Label Storage Management
ProductVersion: 22
FileVersion: 22.4.2017.19508
FileDescription: combit List & Label Storage Management
LegalCopyright: (c) combit GmbH 1992-2017Ich hoffe hier kann jemand helfen.
Mit freundlichen Grüßen
Helge Petersen