Search code examples
delphiwindows-error-reporting

Delphi windows service and WER (app crash)

We have a Delphi windows service application (32bit), at one customer a complete application crash sometimes occurs, and the only thing we see is in the windows application log, the application it kicked out and doesn't appear to "see" any exception before it gone. Following the crash the Windows Error Reporting (WER) system generates a bunch of reports and some memory dump files, the report.wer is shown below.

Can this information be used for anything and does anyone have any tips on how to proceed with debugging this crash? We have a map file but I don't think that'll be of any help here.

Version=1
EventType=BEX
EventTime=130759752271115161
ReportType=2
Consent=1
ReportIdentifier=85f52eae-f940-11e4-940b-001dd8b71c48
IntegratorReportIdentifier=85f52ead-f940-11e4-940b-001dd8b71c48
WOW64=1
NsAppName=ADPluginServerService.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=ADPluginServerService.exe
Sig[1].Name=Application Version
Sig[1].Value=4.0.8.1
Sig[2].Name=Application Timestamp
Sig[2].Value=543e9ee9
Sig[3].Name=Fault Module Name
Sig[3].Value=StackHash_1bb6
Sig[4].Name=Fault Module Version
Sig[4].Value=0.0.0.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=00000000
Sig[6].Name=Exception Offset
Sig[6].Value=PCH_49_FROM_ntdll+0x0002DF8C
Sig[7].Name=Exception Code
Sig[7].Value=c0000005
Sig[8].Name=Exception Data
Sig[8].Value=00000008
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.2.9200.2.0.0.400.8
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1030
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=1bb6
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=1bb6e7b5b0454b525a58698238ba008a
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=5fd0
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=5fd03fa69b4d510842019451a200bf14
UI[2]=C:\AlarmDirector\Bin\ADPluginServerService.exe
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=AlarmDirector Plugin Server stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\AlarmDirector\Bin\ADPluginServerService.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\SYSTEM32\KERNEL32.DLL
LoadedModule[3]=C:\Windows\SYSTEM32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\SYSTEM32\oleaut32.dll
LoadedModule[5]=C:\Windows\SYSTEM32\advapi32.dll
LoadedModule[6]=C:\Windows\SYSTEM32\user32.dll
LoadedModule[7]=C:\Windows\SYSTEM32\msimg32.dll
LoadedModule[8]=C:\Windows\SYSTEM32\gdi32.dll
LoadedModule[9]=C:\Windows\SYSTEM32\version.dll
LoadedModule[10]=C:\Windows\SYSTEM32\ole32.dll
LoadedModule[11]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5\comctl32.dll
LoadedModule[12]=C:\Windows\SYSTEM32\msvcrt.dll
LoadedModule[13]=C:\Windows\SYSTEM32\shell32.dll
LoadedModule[14]=C:\Windows\SYSTEM32\winspool.drv
LoadedModule[15]=C:\Windows\SYSTEM32\wsock32.dll
LoadedModule[16]=C:\Windows\SYSTEM32\combase.dll
LoadedModule[17]=C:\Windows\SYSTEM32\RPCRT4.dll
LoadedModule[18]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[19]=C:\Windows\SYSTEM32\SHLWAPI.dll
LoadedModule[20]=C:\Windows\SYSTEM32\WS2_32.dll
LoadedModule[21]=C:\Windows\SYSTEM32\SspiCli.dll
LoadedModule[22]=C:\Windows\SYSTEM32\NSI.dll
LoadedModule[23]=C:\Windows\SYSTEM32\CRYPTBASE.dll
LoadedModule[24]=C:\Windows\SYSTEM32\bcryptPrimitives.dll
LoadedModule[25]=C:\Windows\SYSTEM32\imm32.dll
LoadedModule[26]=C:\Windows\SYSTEM32\MSCTF.dll
LoadedModule[27]=C:\Windows\SYSTEM32\wtsapi32.dll
LoadedModule[28]=C:\Windows\SYSTEM32\WINSTA.dll
LoadedModule[29]=C:\Windows\SYSTEM32\uxtheme.dll
LoadedModule[30]=C:\Windows\SYSTEM32\security.dll
LoadedModule[31]=C:\Windows\SYSTEM32\SECUR32.DLL
LoadedModule[32]=C:\Windows\SYSTEM32\Fwpuclnt.dll
LoadedModule[33]=C:\Windows\system32\mswsock.dll
LoadedModule[34]=C:\Windows\SYSTEM32\clbcatq.dll
LoadedModule[35]=C:\Program Files (x86)\Common Files\System\ado\msado15.dll
LoadedModule[36]=C:\Windows\SYSTEM32\MSDART.DLL
LoadedModule[37]=C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll
LoadedModule[38]=C:\Windows\SYSTEM32\bcrypt.dll
LoadedModule[39]=C:\Windows\SYSTEM32\comsvcs.dll
LoadedModule[40]=C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll
LoadedModule[41]=C:\Windows\SYSTEM32\CRYPT32.dll
LoadedModule[42]=C:\Program Files (x86)\Common Files\System\Ole DB\MSDATL3.dll
LoadedModule[43]=C:\Windows\SYSTEM32\NETAPI32.dll
LoadedModule[44]=C:\Windows\SYSTEM32\MSASN1.dll
LoadedModule[45]=C:\Windows\SYSTEM32\netutils.dll
LoadedModule[46]=C:\Windows\SYSTEM32\srvcli.dll
LoadedModule[47]=C:\Windows\SYSTEM32\wkscli.dll
LoadedModule[48]=C:\Windows\SYSTEM32\DPAPI.DLL
LoadedModule[49]=C:\Windows\SYSTEM32\netbios.dll
LoadedModule[50]=C:\Windows\SYSTEM32\CRYPTSP.dll
LoadedModule[51]=C:\Windows\system32\rsaenh.dll
LoadedModule[52]=C:\Windows\SYSTEM32\DBNETLIB.DLL
LoadedModule[53]=C:\Windows\SYSTEM32\msv1_0.DLL
LoadedModule[54]=C:\Windows\SYSTEM32\cryptdll.dll
LoadedModule[55]=C:\Windows\SYSTEM32\ntdsapi.dll
LoadedModule[56]=C:\Windows\SYSTEM32\DSPARSE.DLL
LoadedModule[57]=C:\Windows\SYSTEM32\DNSAPI.dll
LoadedModule[58]=C:\Windows\System32\rasadhlp.dll
LoadedModule[59]=C:\Windows\SYSTEM32\IPHLPAPI.DLL
LoadedModule[60]=C:\Windows\SYSTEM32\WINNSI.DLL
LoadedModule[61]=C:\Windows\SYSTEM32\schannel.dll
LoadedModule[62]=C:\Windows\SYSTEM32\ncrypt.dll
LoadedModule[63]=C:\Windows\SYSTEM32\NTASN1.dll
LoadedModule[64]=C:\Windows\system32\ncryptsslp.dll
LoadedModule[65]=C:\Program Files (x86)\Common Files\System\msadc\msadce.dll
LoadedModule[66]=C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll
LoadedModule[67]=C:\Windows\System32\msxml6.dll
File[0].CabName=AppCompat.txt
File[0].Path=WER9A62.tmp.appcompat.txt
File[0].Flags=16842754
File[0].Type=5
File[0].Original.Path=C:\Users\alarmd\AppData\Local\Temp\WER9A62.tmp.appcompat.txt
File[1].CabName=WERInternalMetadata.xml
File[1].Path=WERA928.tmp.WERInternalMetadata.xml
File[1].Flags=327682
File[1].Type=5
File[1].Original.Path=C:\Users\alarmd\AppData\Local\Temp\WERA928.tmp.WERInternalMetadata.xml
File[2].CabName=memory.hdmp
File[2].Path=WERA929.tmp.hdmp
File[2].Flags=2097152
File[2].Type=3
File[2].Original.Path=C:\Users\alarmd\AppData\Local\Temp\WERA929.tmp.hdmp
File[3].CabName=triagedump.dmp
File[3].Path=WERB909.tmp.dmp
File[3].Flags=2424834
File[3].Type=6
File[3].Original.Path=C:\Users\alarmd\AppData\Local\Temp\WERB909.tmp.dmp
FriendlyEventName=Stopped working
ConsentKey=BEX
AppName=AlarmDirector Plugin Server
AppPath=C:\AlarmDirector\Bin\ADPluginServerService.exe
NsPartner=windows
NsGroup=windows8
Solution 
  • ....
Sig[7].Name=Exception Code
Sig[7].Value=c0000005
....

    The exception code is an NTSTATUS value, specifically STATUS_ACCESS_VIOLATION. That's an access violation. There's little more to be gleaned from what you have here.

    Your next step is to gather more information. I recommend adding either madExcept or EurekaLog to your executable and using them to gather detailed bug reports including stack traces leading to the fault.