Re: Meaning of exception 0xC0000006 (EXCEPTION_IN_PAGE_ERROR)

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Pavel Lebedinsky (m_pll)
Date: 05/25/04 

Date: Mon, 24 May 2004 17:46:55 -0700

This does look a lot like what would happen if an executable
was run from a network share that was later disconnected.

Since you have a crash dump you can load it in windbg
and try to get more information about why the exception
occurred.

For example, you could probably get the I/O status code
explaining why the page could not be loaded. I tried to
reproduce your problem by running notepad from a network
share then disconnecting it and forcing the system to page
out notepad's pages by running mspaint and setting image
attributes to 10000x10000. Here's what I got as a result:

(e4c.818): In-page I/O error ffffffffc000020c - code c0000006 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=c0000000 ebx=00000000 ecx=00000000 edx=007743c8 esi=01003429
edi=0006fe98
eip=01003429 esp=0006fd58 ebp=0006fd80 iopl=0 nv up ei pl nz na po
cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010207
notepad+0x3429:
01003429 ?? ???

0:000> .lastevent
Last event: e4c.818: In-page I/O error ffffffffc000020c - code c0000006
(first chance)

0:000> !error c000020c
Error code: (NTSTATUS) 0xc000020c (3221225996) - The transport connection is
now disconnected.

It would be interesting to see what status code you get
in the case where the executable is running from a
local disk.

(By the way, are you sure that in the local case you
don't have any DLLs loaded from a network share? You
can use !dlls command in windbg to see if any modules
are loaded from a network path)

"Rob Yampolsky" wrote:

> Pavel Lebedinsky wrote:
>
> > I can't think of a way a memory corrupting bug in the
> > application could cause a STATUS_IN_PAGE_ERROR.
> >
> > Do you have a DrWatson crash dump? Or better yet, can you
> > reproduce the problem under a debugger such as windbg?
>
> Yes, I do have a DrWatson dump? That's where I'm getting the exception
> code and failure address from. Haven't figured out how to use windbg to
> debug this remotely. This is the first remotely reported bug that I
> haven't been able to reproduce locally. Have VS6.0 on my machine along
> with NuMega BoundsChecker, which reports no bad memory accesses - for
> what that's worth.
>
> In case it tells you anything useful, here's a sample of one of the
> crashes courtesy of DrWatson. A Google search turned up a comment that
> the ???'s reported at the failure point support the notion that the page
> was unreadable at the time

<snip>

Relevant Pages

  • Running the network stack without Giant -- what to try and when
    ... As many of you have seen from status reports, e-mails, bug reports, etc, ... the FreeBSD Project has been working for some time on getting the network ... without the Giant lock, and we're ready for more people to start running ... - While we've been doing pretty heavy testing in MPSAFE configurations, ...
    (freebsd-current)
  • RE: Vulnerability scanners
    ... Qualys was that all you had to do is plug the appliance into your network ... It breaks it down into reports for techies and reports for ... >> to include some equipment costs in there. ...
    (Pen-Test)
  • Re: "Dont panic"?
    ... > I'm not sure what you mean by "public access through ssh". ... But I don't think reporting port scans is a clear win for anyone. ... >> port scan reports back to an ISP a lot of people time and network bandwidth ...
    (comp.security.ssh)
  • Re: Boot time extremely long
    ... 1003 reports relate to a Stop errors and would ... Here are the error and warning events. ... Your computer was not able to renew its address from the network ... I had previously checked the event viewer and found that the ati ...
    (microsoft.public.windowsxp.perform_maintain)
  • RE: IDS Players?
    ... Well, I really am sorry about this, but since the direct links to our ... and end users who are reading our reports. ... >> A comment on Signature vs. Protocol vs. Anomaly IDS environments: ... >> DaemonLabs Network Security ...
    (Focus-IDS)