Re: Debugging the UnHandledExceptionFilter Function in VS.Net

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Vivek (Vivek_at_discussions.microsoft.com)
Date: 01/12/05 

Date: Wed, 12 Jan 2005 11:27:05 -0800

Thanks Oleg & Pavel for the responses.

Unfortunately i'm still unble to debug the filter function either by
attaching using cdb or starting the process with windbg.
I'm think my filter is registered properly because a printf in the filter
gets printed if i run the exe straight off from the command prompt!

Here's a sequence of steps i followed and the respective outcomes,

Using cdb - With a Sleep in filter and attaching to the process after exec
has
*******************************************************
reached the Sleep in the filter
*********************

cdb -pb -pn TestWinDbg.exe

Now i see the following!

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
ModLoad: 00400000 0042b000 <drive>:\WorkArea\TestWindbg\Debug\TestWindbg.exe
ModLoad: 77f50000 77ff7000 <drive>:\WINDOWS\System32\ntdll.dll
ModLoad: 77e60000 77f46000 <drive>:\WINDOWS\system32\kernel32.dll

I do not see the cdb prompt to set a beakpoint or to trace execution!

After waiting for duration of sleep call i see the following,

eax=c0000135 ebx=00000000 ecx=00000000 edx=00000000 esi=77f5c448 edi=00000000
eip=7ffe0304 esp=0012fda4 ebp=0012fe9c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
SharedUserData!SystemCallStub+0x4:
7ffe0304 c3 ret
0:000>

By now the filter has finished execution!!

Using windbg (without sleep in filter) here's what i see
****************************************
windbg -g <drive>:\WorkArea\TestWindbg\Debug\TestWindbg.exe

I see that execution is halted inside my function foo (i called this from
main) where i have an INT 3 (S/W Brkpoint) instruction
Now i Set breakpoint on first line in my filter function
Now i Set breakpoint "bp kernel32!UnhandledExceptionFilter"
Now i choose "Go Unhandled Exception"
I see execution now enters the API kernel32!UnhandledExceptionFilter

After stepping thru kernel32!UnhandledExceptionFilter
i reached the following line
call dword ptr [kernel32+0x10ac (77e610ac)]{ntdll!ZwQueryInformationProcess
(77f5bdd8)}
Stepped thru until i reached the return fom this function which was the
following line
ret 0x14
Changed the return value to zero (which i assumed is
EXCEPTION_CONTINUE_SEARCH) by writing into memory
Did a go
Saw the following
Access violation - code c0000005 (first chance)

Again execution did not reach my filter.

I tried "dds kernel32!BasepCurrentTopLevelFilter L1" however that showed me
the following
Couldn't resolve error at 'kernel32!BasepCurrentTopLevelFilter '

I'm pretty much stuck on this issue!
Could you please provide few more clues on how to go about this issue now,
if you don't mind.

Thanks a lot!
Vivek

Relevant Pages

  • Re: Debugging the UnHandledExceptionFilter Function in VS.Net
    ... Then i set a breakpoint inside the filter function ... chance" in the windbg command window) ... Alternativley i tried "attaching" using cdb ...
    (microsoft.public.win32.programmer.kernel)
  • Re: DS-CDMA simulation using Matlab
    ... T FILTER FUNCTION ... Rayleigh fading 0:nothing 1:consider ... %CDMA QPSK modulation ich ...
    (comp.soft-sys.matlab)
  • Re: Index not getting used
    ... plan was not good and also execution time was high. ... recommendation also, the plan is below, exection time and gets reduced. ... 1 FILTER ... less in USE_NL hint, so I think I should go with USE_NL ...
    (comp.databases.oracle.server)
  • Re: Joel on Anonymous methods
    ... In LINQ Where is just one extension method, that is "attached" to sequence of T, which is the basic interface to do an "for-in" over. ... it will defer execution to th point, where the user actually iterates over the result. ... The moment, you start iterating over it, it will filter and sort the list to return Value3 elements. ... And hopefully, they also added IEnumerableto native Delphi, which would then allow some of the cool parts of LINQ in native Delphi. ...
    (borland.public.delphi.non-technical)
  • Re: metaclass and customization with parameters
    ... > filter = int ... creating a basic integer-weighted Graph class starting with the ... #A Graph is a dict whose values are Vertex. ... certain type (through the filter function) before insertion into the ...
    (comp.lang.python)