heap - Why is Windows Safe Mode Magic? -


everyone.

i out i.t. medical practice. turns out there’s bug in emr software shows once in while. (all computers run on windows 10 currently)

the program dies , popup “a problem has caused program stop working…

i hook debugger. looks heap issue in code according stack trace. turn on gflags , hits every time. tell emr software folks don’t claim bugs , want prove it’s not them.

they boot computer safe mode networking , low , behold there’s no heap problem they’re off hook. it’s not them.

i’ve reproduced problem on machines (32 , 64 bit) , in clean mode , logged in under activated administrator account safe mode works every time.

i've reproduced problem running in command window:

gflags /p /enable emrprogram.exe /full  cdb -g -x emrname.exe 

questions:

  1. how can safe mode make heap bug disappear?

  2. any suggestions reproducing bug in safe mode, i.e. what’s happening in safe mode can make more normal mode?

p.s. here's stack trace:

verifier stop 00000010: pid 0x238: corrupted start stamp   04f61000 : heap handle  0014f09c : heap block  00000000 : block size  00000000 : corrupted stamp     0:000> kb childebp retaddr  args child  0014ed20 5fa0aac9 00000010 5fa01bc8 04f61000 verifier!verifierstopmessage+0x27e  0014ed84 5fa0ae8a 04f61000 00000004 0014f09c  verifier!avrfpdphreportcorruptedblock+0x239  0014ede0 5fa0b3c2 04f61000 0014f09c 00000004 verifier!avrfpdphchecknormalheapblock+0x11a  0014ee00 5fa09cf3 04f61000 05230000 01000002 verifier!avrfpdphnormalheapfree+0x22  0014ee24 77d76c42 04f60000 01000002 0014f09c verifier!avrfdebugpageheapfree+0xe3  0014ee84 77cca934 0014f09c 014b1fe2 04f60000 ntdll!rtldebugfreeheap+0x3c  0014ef40 77cc9238 00000000 0014f09c 44ce6ff8 ntdll!rtlpfreeheap+0xb4  *** error: module load completed symbols not loaded image00400000  0014ef68 01f3d902 04f60000 00000000 0014f09c ntdll!rtlfreeheap+0x268  warning: stack unwind information not available. following frames may wrong.  0014f0b8 01f3c6c6 0014f1dc 08f58f70 0dab2f88 image00400000+0x1b3d902  0014f21c 01f3c4b9 0dab2f88 0014f2d8 08f58f70 image00400000+0x1b3c6c6  0014f320 02053935 0dab2f88 0014f454 0014f500 image00400000+0x1b3c4b9  *** error: symbol file not found.  defaulted export symbols c:\windows\system32\msvbvm60.dll -  0014f4f4 66051d33 08f58f70 0014f510 0051c783 image00400000+0x1c53935  0014f510 66052034 0051c783 0014f57c 00000002 msvbvm60!iid_ivbahost+0x236f3  0014f528 6605211a 08f58fe8 0014f6c4 0014f57c msvbvm60!iid_ivbahost+0x239f4  0014f6cc 77b3b3cc 00000009 0659b040 00000000 msvbvm60!iid_ivbahost+0x23ada  *** error: symbol file not found.  defaulted export symbols c:\program files\emrname\igthreed40.ocx -  0014f72c 2411bead 0c7e0fac 00000016 241343f8 gdi32!scriptstringanalyzeglyphs+0x2cc  0014f98c 2410ae97 0c71fd60 2413794c 0c71fff0 igthreed40!dllgetdocumentation+0x27d1  0014f9a4 24116fda 09f4b6fc 16fa9fd4 759fb0ff igthreed40+0xae97  0014f9c8 759dc807 0c71fff0 000001cc 00000004 igthreed40+0x16fda  0014fc70 2411b679 0cac5638 0c71fff0 fffffdd9 oleaut32!ctypeinfo2::invoke+0x517  0014fc9c 24106d11 0c71fd60 fffffdd9 0cac5638 igthreed40!dllgetdocumentation+0x1f9d  0014fcd0 241179f6 0c71fd60 fffffdd9 6601aea8 igthreed40+0x6d11  0014fcfc 66049039 0c71fd60 fffffdd9 6601aea8 igthreed40+0x179f6  0014fd44 66049a8a 0c7e0e8c 08baaf0c 0000000d msvbvm60!iid_ivbahost+0x1a9f9  0014fd74 66083900 0c7e0e8c 000a037e 0000104d msvbvm60!iid_ivbahost+0x1b44a  0014fd9c 66083d58 08b8ce6c 0014fe50 00000001 msvbvm60!iid_ivbahost+0x552c0  0014fdd8 6601ca5e 08b8ce6c 00c8030c 7552d390 msvbvm60!iid_ivbahost+0x55718  0014fe08 6600a782 0014fe50 ffffffff 6600a72e msvbvm60!zombie_release+0xe005  0014fe34 6600a6b0 07097f8c 0014fe50 ffffffff msvbvm60!_vbastrtoansi+0x3ab  0014fe78 6600a63f ffffffff 07097f8c 07080000 msvbvm60!_vbastrtoansi+0x2d9  0014febc 6600a51d 0709dfcc ffffffff 00000238 msvbvm60!_vbastrtoansi+0x268  0014fed8 6600a4e8 07097f88 0709dfcc ffffffff msvbvm60!_vbastrtoansi+0x146  0014fefc 66003644 ffffffff 03f40670 03f40670 msvbvm60!_vbastrtoansi+0x111  0014ff78 00489fca 004a30b4 779995f4 0020d000 msvbvm60!thunrtmain+0xa0  0014ff94 77cb241a 0020d000 014b0f7e 00000000 image00400000+0x89fca  0014ffdc 77cb23e9 ffffffff 77d339e7 00000000 ntdll!__rtluserthreadstart+0x2b  0014ffec 00000000 03f40670 0020d000 00000000 ntdll!_rtluserthreadstart+0x1b  0:000> 


Comments

Popular posts from this blog

Django REST Framework perform_create: You cannot call `.save()` after accessing `serializer.data` -

Why does Go error when trying to marshal this JSON? -