VLD crashed application on Windows 10 x86

[Lyidgi]

Hello,
We have the application that launch many (~30) times with different params from one script.
Application do its job in notime, so lauching happend rigth one after another, consequentially

Crash happend randomly and only on x86 version.
We tried to manged the problem by ourselves by failed.

Could you us... May be you know where can be the problem and what exactly go wrong

This what we know from windows EventViewer:

Faulting Application Name: ApcGenConsole.exe, Version: 8.3.49620.0, Timestamp: 0x60006858
Faulting module name: vld_x86.dll, version: 2.6.0.0, timestamp: 0x600062b1
Exception code: 0xc0000005
Error offset: 0x00047ab6
Faulting Process ID: 0x8d08
Faulting application start time: 0x01d6ea8da2ffe75f
Faulting Application Path: C: \ ApcCodeGen \ ApcGenConsole.exe
Faulting module path: C: \ ApcCodeGen \ vld_x86.dll
Report ID: 47305d04-1a8d-4450-8716-7964682b12b9
Bad package full name:
Application code associated with the failing package:

So it crash without any stack or debug information and we can't debug by any tools.
We know it crashed in LPVOID FindRealCode(LPVOID pCode)
-> if (*(WORD *)pCode == 0x25ff) // JMP r/m32
pCode becomes invalid, so we get exception.

we tried to fix it by additional checks:

1. utility.cpp if ((idte == NULL) || (idte->OriginalFirstThunk == 0)) {

2. utility.cpp for (; origThunk->u1.Function != NULL && thunk->u1.Function != NULL;
   origThunk++, thunk++)

But all this have no use...

[mattdurak]

I am looking at the same issue. Unfortunately, this is just a fork of the original project and the original project isn't well documented in some of these areas. My suspicion is that this function is doing something wrong. It is possible that the code is making some assumptions about code generated with older compilers that is no longer true, but I'm really not sure at this point (I'm not sure what the purpose of FindRealCode really is and why it's following some JMP instructions).

LPVOID FindRealCode(LPVOID pCode)
{
    LPVOID result = pCode;
    if (pCode != NULL)
    {
        if (*(WORD *)pCode == 0x25ff) // JMP r/m32
        {
#ifdef _WIN64
            LONG offset = *((LONG *)((ULONG_PTR)pCode + 2));
            // RIP relative addressing
            PBYTE pNextInst = (PBYTE)((ULONG_PTR)pCode + 6);
            pCode = *(LPVOID*)(pNextInst + offset);
            return pCode;
#else
            DWORD addr = *((DWORD *)((ULONG_PTR)pCode + 2));
            pCode = *(LPVOID*)(addr);
            return FindRealCode(pCode);
#endif
        }
        if (*(BYTE *)pCode == 0xE9) // JMP rel32
        {
            // Relative next instruction
            PBYTE	pNextInst = (PBYTE)((ULONG_PTR)pCode + 5);
            LONG	offset = *((LONG *)((ULONG_PTR)pCode + 1));
            pCode = (LPVOID*)(pNextInst + offset);
            return FindRealCode(pCode);
        }
    }
    return result;
}

I have looked at a similar dump but VLD is built in Release mode without Debug symbols so much of the variables are optimized away.

If you want to try to debug further, I'd recommend building VLD with Debug mode. You can even create an installer with the debug version by changing the "ConfigType" to "Debug" in https://github.com/Azure/vld/blob/master/setup/vld-setup.iss and generating the installer again (assuming you've built the solution already).

If it helps, this is the callstack I have seen, and it seems to be patching gdi32full.dll at the time of the crash. One thing to note is it is a recursive call in FindRealCode, meaning it followed an 0xE9 JMP instruction to the resulting address, which was a read access violation when it derefenced it in the recursive call.

 	vld_x64.dll!FindRealCode(void * pCode) Line 433	C++
 	[Inline Frame] vld_x64.dll!FindRealCode(void * pCode) Line 453	C++
>	[Inline Frame] vld_x64.dll!PatchImport(HINSTANCE__ *) Line 551	C++
 	vld_x64.dll!PatchModule(HINSTANCE__ * importmodule, moduleentry_t *) Line 666	C++
 	vld_x64.dll!VisualLeakDetector::attachToLoadedModules(Set<moduleinfo_t> * newmodules) Line 903	C++
 	vld_x64.dll!VisualLeakDetector::RefreshModules() Line 2332	C++
 	vld_x64.dll!LdrpCallInitRoutine(void * BaseAddress, unsigned long Reason, void * Context, unsigned char(*)(void *, unsigned long, _CONTEXT *) EntryPoint) Line 98	C++
 	ntdll.dll!LdrpCallInitRoutine(unsigned char(*)(void *, unsigned long, _CONTEXT *) InitRoutine, void * DllHandle, unsigned long Reason, _CONTEXT * Context) Line 212	C
 	ntdll.dll!LdrpInitializeNode(_LDR_DDAG_NODE * Node) Line 999	C
 	ntdll.dll!LdrpInitializeGraphRecurse(_LDR_DDAG_NODE * Node, long * LoadStatus, unsigned char * DynamicCycle) Line 1753	C
 	[Inline Frame] ntdll.dll!LdrpInitializeGraph(_LDR_DDAG_NODE *) Line 1772	C
 	ntdll.dll!LdrGetProcedureAddressForCaller(void * DllHandle, const _STRING * ProcedureName, unsigned long ProcedureNumber, void * * ProcedureAddress, unsigned long Flags, void * CallerAddress) Line 1943	C
 	[Inline Frame] KERNELBASE.dll!GetProcAddressForCaller(HINSTANCE__ * CallerAddress, const char *) Line 2033	C
 	KERNELBASE.dll!GetProcAddress(HINSTANCE__ * hModule, const char * lpProcName) Line 2064	C
 	[Inline Frame] vld_x64.dll!VisualLeakDetector::_RGetProcAddress(HINSTANCE__ *) Line 2171	C++
 	[Inline Frame] vld_x64.dll!PatchImport(HINSTANCE__ *) Line 534	C++
 	vld_x64.dll!PatchModule(HINSTANCE__ * importmodule, moduleentry_t *) Line 666	C++
 	vld_x64.dll!VisualLeakDetector::attachToLoadedModules(Set<moduleinfo_t> * newmodules) Line 903	C++
 	vld_x64.dll!VisualLeakDetector::RefreshModules() Line 2332	C++
 	vld_x64.dll!LdrpCallInitRoutine(void * BaseAddress, unsigned long Reason, void * Context, unsigned char(*)(void *, unsigned long, _CONTEXT *) EntryPoint) Line 98	C++
 	ntdll.dll!LdrpCallInitRoutine(unsigned char(*)(void *, unsigned long, _CONTEXT *) InitRoutine, void * DllHandle, unsigned long Reason, _CONTEXT * Context) Line 212	C
 	ntdll.dll!LdrpInitializeNode(_LDR_DDAG_NODE * Node) Line 999	C
 	ntdll.dll!LdrpInitializeGraphRecurse(_LDR_DDAG_NODE * Node, long * LoadStatus, unsigned char * DynamicCycle) Line 1753	C
 	[Inline Frame] ntdll.dll!LdrpInitializeGraph(_LDR_DDAG_NODE *) Line 1772	C
 	ntdll.dll!LdrGetProcedureAddressForCaller(void * DllHandle, const _STRING * ProcedureName, unsigned long ProcedureNumber, void * * ProcedureAddress, unsigned long Flags, void * CallerAddress) Line 1943	C
 	[Inline Frame] KERNELBASE.dll!GetProcAddressForCaller(HINSTANCE__ * CallerAddress, const char *) Line 2033	C
 	KERNELBASE.dll!GetProcAddress(HINSTANCE__ * hModule, const char * lpProcName) Line 2064	C
 	[Inline Frame] vld_x64.dll!VisualLeakDetector::_RGetProcAddress(HINSTANCE__ *) Line 2171	C++
 	[Inline Frame] vld_x64.dll!PatchImport(HINSTANCE__ *) Line 534	C++
 	vld_x64.dll!PatchModule(HINSTANCE__ * importmodule, moduleentry_t *) Line 666	C++
 	vld_x64.dll!VisualLeakDetector::attachToLoadedModules(Set<moduleinfo_t> * newmodules) Line 903	C++
 	vld_x64.dll!VisualLeakDetector::VisualLeakDetector() Line 499	C++
 	vld_x64.dll!`dynamic initializer for 'g_vld''() Line 61	C++
 	vld_x64.dll!_initterm(void(*)() * first, void(*)() * last) Line 16	C++
 	vld_x64.dll!dllmain_crt_process_attach(HINSTANCE__ * const instance, void * const reserved) Line 66	C++
 	vld_x64.dll!DllEntryPoint(HINSTANCE__ * hinstDLL, unsigned long fdwReason, void * lpReserved) Line 294	C++
 	ntdll.dll!LdrpCallInitRoutine(unsigned char(*)(void *, unsigned long, _CONTEXT *) InitRoutine, void * DllHandle, unsigned long Reason, _CONTEXT * Context) Line 212	C
 	ntdll.dll!LdrpInitializeNode(_LDR_DDAG_NODE * Node) Line 999	C
 	ntdll.dll!LdrpInitializeGraphRecurse(_LDR_DDAG_NODE * Node, long * LoadStatus, unsigned char * DynamicCycle) Line 1753	C
 	ntdll.dll!LdrpInitializeGraphRecurse(_LDR_DDAG_NODE * Node, long * LoadStatus, unsigned char * DynamicCycle) Line 1706	C
 	[Inline Frame] ntdll.dll!LdrpInitializeGraph(_LDR_DDAG_NODE *) Line 1772	C
 	ntdll.dll!LdrpInitializeProcess(_CONTEXT * Context, void * SystemDllBase) Line 5969	C
 	ntdll.dll!_LdrpInitialize(_CONTEXT * UserContext, void * NtdllBaseAddress) Line 1617	C
 	ntdll.dll!LdrpInitialize(_CONTEXT * UserContext, void * NtdllBaseAddress) Line 1423	C
 	ntdll.dll!LdrInitializeThunk(_CONTEXT * UserContext, void * NtdllBaseAddress) Line 91	C

[dcristoloveanu]

We have narrowed down this issue and a PR will be available for this soon.
This is a problem due to FindRealCode accessing pages that have PAGE_NOACCESS.
FindRealCode should call VirtualProtect to make sure it can read the memory in all the cases where it attempts to compute the addresses.

[dcristoloveanu]

#8 is addressing this issue, needs to be reviewed and afterwards merged.

[dcristoloveanu]

This should now be fixed with v2.5.7.
Closing.