Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to detect exceptions thrown by the CLR? [closed]

I'm using the WaitForDebugEvent() API to process debug events while debugging a third party application. Very often I catch an access violation thrown by the CLR (the debugee is using some .NET libraries). I see that later when I analyze the mini dump with the WinDbg. Can I detect such exception coming from the CLR immediately when WaitForDebugEvent() returns?

Here are the details on the caught exception:

EXCEPTION_RECORD:  (.exr -1)  
ExceptionAddress: 000007fef7e870eb (clr!EEFileLoadException::Throw+0x00000000000001ac)  
ExceptionCode: c0000005 (Access violation)  
ExceptionFlags: 00000000  
NumberParameters: 2  
   Parameter[0]: 0000000000000000  
   Parameter[1]: 000000000000007d  
Attempt to read from address 000000000000007d
like image 774
kytodrk Avatar asked Dec 08 '25 05:12

kytodrk


1 Answers

all exceptions from CLR have ExceptionCode in form 0xE0****** and NumberParameters > 3. most common, which i see - e0434352 (0xe0000000 + 'CCR') - look for example - this: -

The Unknown exception - code e0434352 (first chance) is a big clue here. If you look at the error you might see some hex that looks familiar ‘0x43’ ‘0x43’ ‘0x52’ or ‘C’ ‘C’ ‘R’. No, this isn’t a homage to Creedence and doesn’t mean there is a bad moon rising. This tells me the errors are being thrown from the CLR runtime. Sweet. Things just got a bit easier.

another common code - 0xE0434F4D (0xe0000000+'COM') - How CLR maps SEH exceptions to managed exception types

edited:

access violation thrown by the CLR

you mean direct STATUS_ACCESS_VIOLATION exception ? in this case no way detect, but i never see this in CLR direct. or when CLR throw RaiseException and in ExceptionInformation[0] -> STATUS_ACCESS_VIOLATION ?

like image 69
RbMm Avatar answered Dec 10 '25 18:12

RbMm