heap - Why is Windows Safe Mode Magic? -
everyone.
i out i.t. medical practice. turns out there’s bug in emr software shows once in while. (all computers run on windows 10 currently)
the program dies , popup “a problem has caused program stop working…”
i hook debugger. looks heap issue in code according stack trace. turn on gflags , hits every time. tell emr software folks don’t claim bugs , want prove it’s not them.
they boot computer safe mode networking , low , behold there’s no heap problem they’re off hook. it’s not them.
i’ve reproduced problem on machines (32 , 64 bit) , in clean mode , logged in under activated administrator account safe mode works every time.
i've reproduced problem running in command window:
gflags /p /enable emrprogram.exe /full cdb -g -x emrname.exe
questions:
how can safe mode make heap bug disappear?
any suggestions reproducing bug in safe mode, i.e. what’s happening in safe mode can make more normal mode?
p.s. here's stack trace:
verifier stop 00000010: pid 0x238: corrupted start stamp 04f61000 : heap handle 0014f09c : heap block 00000000 : block size 00000000 : corrupted stamp 0:000> kb childebp retaddr args child 0014ed20 5fa0aac9 00000010 5fa01bc8 04f61000 verifier!verifierstopmessage+0x27e 0014ed84 5fa0ae8a 04f61000 00000004 0014f09c verifier!avrfpdphreportcorruptedblock+0x239 0014ede0 5fa0b3c2 04f61000 0014f09c 00000004 verifier!avrfpdphchecknormalheapblock+0x11a 0014ee00 5fa09cf3 04f61000 05230000 01000002 verifier!avrfpdphnormalheapfree+0x22 0014ee24 77d76c42 04f60000 01000002 0014f09c verifier!avrfdebugpageheapfree+0xe3 0014ee84 77cca934 0014f09c 014b1fe2 04f60000 ntdll!rtldebugfreeheap+0x3c 0014ef40 77cc9238 00000000 0014f09c 44ce6ff8 ntdll!rtlpfreeheap+0xb4 *** error: module load completed symbols not loaded image00400000 0014ef68 01f3d902 04f60000 00000000 0014f09c ntdll!rtlfreeheap+0x268 warning: stack unwind information not available. following frames may wrong. 0014f0b8 01f3c6c6 0014f1dc 08f58f70 0dab2f88 image00400000+0x1b3d902 0014f21c 01f3c4b9 0dab2f88 0014f2d8 08f58f70 image00400000+0x1b3c6c6 0014f320 02053935 0dab2f88 0014f454 0014f500 image00400000+0x1b3c4b9 *** error: symbol file not found. defaulted export symbols c:\windows\system32\msvbvm60.dll - 0014f4f4 66051d33 08f58f70 0014f510 0051c783 image00400000+0x1c53935 0014f510 66052034 0051c783 0014f57c 00000002 msvbvm60!iid_ivbahost+0x236f3 0014f528 6605211a 08f58fe8 0014f6c4 0014f57c msvbvm60!iid_ivbahost+0x239f4 0014f6cc 77b3b3cc 00000009 0659b040 00000000 msvbvm60!iid_ivbahost+0x23ada *** error: symbol file not found. defaulted export symbols c:\program files\emrname\igthreed40.ocx - 0014f72c 2411bead 0c7e0fac 00000016 241343f8 gdi32!scriptstringanalyzeglyphs+0x2cc 0014f98c 2410ae97 0c71fd60 2413794c 0c71fff0 igthreed40!dllgetdocumentation+0x27d1 0014f9a4 24116fda 09f4b6fc 16fa9fd4 759fb0ff igthreed40+0xae97 0014f9c8 759dc807 0c71fff0 000001cc 00000004 igthreed40+0x16fda 0014fc70 2411b679 0cac5638 0c71fff0 fffffdd9 oleaut32!ctypeinfo2::invoke+0x517 0014fc9c 24106d11 0c71fd60 fffffdd9 0cac5638 igthreed40!dllgetdocumentation+0x1f9d 0014fcd0 241179f6 0c71fd60 fffffdd9 6601aea8 igthreed40+0x6d11 0014fcfc 66049039 0c71fd60 fffffdd9 6601aea8 igthreed40+0x179f6 0014fd44 66049a8a 0c7e0e8c 08baaf0c 0000000d msvbvm60!iid_ivbahost+0x1a9f9 0014fd74 66083900 0c7e0e8c 000a037e 0000104d msvbvm60!iid_ivbahost+0x1b44a 0014fd9c 66083d58 08b8ce6c 0014fe50 00000001 msvbvm60!iid_ivbahost+0x552c0 0014fdd8 6601ca5e 08b8ce6c 00c8030c 7552d390 msvbvm60!iid_ivbahost+0x55718 0014fe08 6600a782 0014fe50 ffffffff 6600a72e msvbvm60!zombie_release+0xe005 0014fe34 6600a6b0 07097f8c 0014fe50 ffffffff msvbvm60!_vbastrtoansi+0x3ab 0014fe78 6600a63f ffffffff 07097f8c 07080000 msvbvm60!_vbastrtoansi+0x2d9 0014febc 6600a51d 0709dfcc ffffffff 00000238 msvbvm60!_vbastrtoansi+0x268 0014fed8 6600a4e8 07097f88 0709dfcc ffffffff msvbvm60!_vbastrtoansi+0x146 0014fefc 66003644 ffffffff 03f40670 03f40670 msvbvm60!_vbastrtoansi+0x111 0014ff78 00489fca 004a30b4 779995f4 0020d000 msvbvm60!thunrtmain+0xa0 0014ff94 77cb241a 0020d000 014b0f7e 00000000 image00400000+0x89fca 0014ffdc 77cb23e9 ffffffff 77d339e7 00000000 ntdll!__rtluserthreadstart+0x2b 0014ffec 00000000 03f40670 0020d000 00000000 ntdll!_rtluserthreadstart+0x1b 0:000>
Comments
Post a Comment