I'm using the WaitForDebugEvent() API to process debug events while debugging a third party application. Very often I catch an access violation thrown by the CLR (the debugee is using some .NET libraries). I see that later when I analyze the mini dump with the WinDbg. Can I detect such exception coming from the CLR immediately when WaitForDebugEvent() returns?
Here are the details on the caught exception:
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 000007fef7e870eb (clr!EEFileLoadException::Throw+0x00000000000001ac)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000000007d
Attempt to read from address 000000000000007d
all exceptions from CLR have ExceptionCode in form 0xE0****** and NumberParameters > 3. most common, which i see - e0434352 (0xe0000000 + 'CCR') - look for example - this: -
The Unknown exception - code e0434352 (first chance) is a big clue here. If you look at the error you might see some hex that looks familiar ‘0x43’ ‘0x43’ ‘0x52’ or ‘C’ ‘C’ ‘R’. No, this isn’t a homage to Creedence and doesn’t mean there is a bad moon rising. This tells me the errors are being thrown from the CLR runtime. Sweet. Things just got a bit easier.
another common code - 0xE0434F4D (0xe0000000+'COM') - How CLR maps SEH exceptions to managed exception types
edited:
access violation thrown by the CLR
you mean direct STATUS_ACCESS_VIOLATION exception ? in this case no way detect, but i never see this in CLR direct. or when CLR throw RaiseException and in ExceptionInformation[0] -> STATUS_ACCESS_VIOLATION ?
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With