Windows Error Reporting and CLR integration

  • Article

Windows Error Reporting (WER) monitors and collects information on crashes and hangs on Windows platforms newer that Windows XP. The information collected can be sent to a server for investigation (read more in my previous WER article).

When creating reports, WER generates some parameters to bucket-ize the failures. Since the OS doesn’t know anything about managed applications, CLR integrates WER and adds these parameters to create correct buckets:

- AppName - The filename of the EXE (e.g., “Explorer.exe”);

- AppVer – Assembly version number for an managed EXE (major.minor.build.revision) or the PE header version number (e.g. “2.0.40220.13”) for unmanged

- AppStamp - The timestamp on the executable.

- AsmAndModName – Assembly and module name if the module is part of a multi-module assembly (e.g., “MyAssembly+MyModule.dll”)

-  AsmVer - Managed assembly version number of the faulting assembly (major.minor.build.revision)

- ModStamp - The timestamp of the faulting module.

- MethodDef - MethodDef token for the faulting method, after stripping off the high byte.

- Offset - The IL offset of the faulting instruction.

- ExceptionType - The name of the type of the most-inner exception, with "Exception" removed from the end, if present. (E.g., "System.AccessViolation")

For example, I have a managed app (TestWERDefaultCategorizationAndDumps) that crashed. A report was created with these parameters:

Problem signature

Problem Event Name: CLR20r3

Problem Signature 01: XFU1LOPV1B5JQH0HBYGNH00TXWMZP45M

Problem Signature 02: 1.0.0.0

Problem Signature 03: 49833e70

Problem Signature 04: TestWERDefaultCategorizationAndDumps

Problem Signature 05: 1.0.0.0

Problem Signature 06: 49833e70

Problem Signature 07: 1 -> methodDesc

Problem Signature 08: 16 -> offset

Problem Signature 09: System.ArgumentNullException -> exception type

OS Version: 6.0.6001.2.1.0.256.4

Locale ID: 1033

 

So the application crashed because a System.ArgumentNullException was unhandled. If we attach the debugger to the application (windbg –pn TestWERDefaultCategorizationAndDumps if the application is running or windbg TestWERDefaultCategorizationAndDumps to start the app under debugger), we can use the offset and the methodDesc to find out what happened. First, we need to load sos (.loadby sos mscorwks) and then we can use !token2ee Module MethodDesc to find out the method that threw. To determine the methodDesc, append 060000 to the number in the report.

0:000> !token2ee TestWERDefaultCategorizationAndDumps 06000001

Module: 0000064280012e20 (TestWERDefaultCategorizationAndDumps.exe)

Token: 0x0000000006000001

MethodDesc: 0000064280013580

Name: TestWERDefaultCategorizationAndDumps.Program.ThrowUnhandledException()

JITTED Code Address: 00000642801504b0

 

So the function that threw the exception is ThrowUnhandledException in class Program (TestWERDefaultCategorizationAndDumps.Program.ThrowUnhandledException). Once we know the method desc, we can dump the IL of the method and see what line failed:

0:000> !dumpil 0000064280013580

ilAddr = 0000000000eb2050

IL_0000: nop

IL_0001: ldstr "Thow Argument Null Exception"

IL_0006: call System.Console::WriteLine

IL_000b: nop

IL_000c: ldstr "test"

IL_0011: newobj System.ArgumentNullException::.ctor

IL_0016: throw

The report says the offset is 16, so we look at IL_0016 and we find our throw. If we take a look at the code, it all makes sense:

static void ThrowUnhandledException()

{

    Console.WriteLine("Thow Argument Null Exception");

    throw new ArgumentNullException("test");

}

Comments

  • Anonymous
    January 30, 2009
    PingBack from http://blog.a-foton.ru/index.php/2009/01/30/windows-error-reporting-and-clr-integration/

  • Anonymous
    February 01, 2009
    Like I mentioned in my previous article , CLR integrates WER in order to be able to add managed-specific

  • Anonymous
    July 02, 2012
    So what is the fix? How do you eliminate the Report.wer files from building up in the computer?

  • Anonymous
    September 22, 2012
    The comment has been removed

  • Anonymous
    May 08, 2013
    Problem signature:  Problem Event Name: CLR20r3  Problem Signature 01: trainersoftware.exe  Problem Signature 02: 4.7.0.0  Problem Signature 03: 5183d63f  Problem Signature 04: mscorlib  Problem Signature 05: 4.0.0.0  Problem Signature 06: 50484bd7  Problem Signature 07: 14b7  Problem Signature 08: 5e  Problem Signature 09: System.ArgumentOutOfRange  OS Version: 6.1.7601.2.1.0.256.48  Locale ID: 5129  Additional Information 1: 0a9e  Additional Information 2: 0a9e372d3b4ad19135b953a78882e789  Additional Information 3: 0a9e  Additional Information 4: 0a9e372d3b4ad19135b953a78882e789 Read our privacy statement online:  go.microsoft.com/fwlink If the online privacy statement is not available, please read our privacy statement offline:  C:Windowssystem32en-USerofflps.txt I have this issue Can anyone help Mark

  • Anonymous
    October 16, 2013
    The comment has been removed

  • Anonymous
    May 10, 2014
    The comment has been removed

  • Anonymous
    May 12, 2014
    please please help me Problem signature:  Problem Event Name: CLR20r3  Problem Signature 01: comsol.exe  Problem Signature 02: 4.4.0.150  Problem Signature 03: 5294b7bc  Problem Signature 04: Util  Problem Signature 05: 4.4.0.150  Problem Signature 06: 5294b795  Problem Signature 07: 95  Problem Signature 08: 1f0  Problem Signature 09: System.BadImageFormatException  OS Version: 6.1.7600.2.0.0.256.1  Locale ID: 1033  Additional Information 1: 5fb5  Additional Information 2: 5fb52475b7d5707da06b20e0977b8f49  Additional Information 3: dce9  Additional Information 4: dce93b64bf19e8ad7196e4ca2eb32f0a Read our privacy statement online:  go.microsoft.com/fwlink If the online privacy statement is not available, please read our privacy statement offline:  C:Windowssystem32en-USerofflps.txt

  • Anonymous
    May 12, 2014
    RE: windbg –pn TestWERDefaultCategorizationAndDumps if the application is running or windbg TestWERDefaultCategorizationAndDumps to start the app under debugger), Isn't all that the dereferencing metioned above supposed to by handled by the .PDB files I have installed with my application?  If not, how do I get WER / CLR to make use of the available .PDB files?

  • Anonymous
    July 27, 2014
    Hello can you help me please I have an application that i write with Visual basic 2013 1-old exe file of my project is running carefully on all OS (xp-7-8) 2- but i change some code and i add some form to my application and then build a project , but new exe file on other computers is not running and the below error is happend 3- Runs properly on development machine(windows8.1) . 4- on other computers(xp,7) that i tested it,  it not run carefully. on windows 7: i encountered the error (Applcation has Stopped working) On windows xp: when i run exe file ,the error was not show, but the programm not run

Description:  Stopped working Problem signature:  Problem Event Name:    CLR20r3  Problem Signature 01:    bimeh.net.exe  Problem Signature 02:    1393.5.6.38  Problem Signature 03:    53d49559  Problem Signature 04:    bimeh.net  Problem Signature 05:    1393.5.6.38  Problem Signature 06:    53d49559  Problem Signature 07:    63  Problem Signature 08:    ea  Problem Signature 09:    System.InvalidOperationException  OS Version:    6.1.7601.2.1.0.256.1  Locale ID:    1033 Read our privacy statement online:  go.microsoft.com/fwlink If the online privacy statement is not available, please read our privacy statement offline:  C:Windowssystem32en-USerofflps.txt

  • Anonymous
    November 12, 2014
    You need to publish you application and install it on the other machine, amirrazi506(a)yahoo.fr

  • Anonymous
    November 12, 2014
    Due to the fact that the application in the other machine is not able to retrieve the correct DLL, you can also go into  :project settings/ Publish / Application Files and include all the file, and go to preference and change the "Copy Local" under Project Settings / References for all if you want please make backup before to start, amirrazi506(a)yahoo.fr kr

  • Anonymous
    May 12, 2015
    Problem Event Name: CLR20r3  Problem Signature 01: PokeGen.exe  Problem Signature 02: 1.0.0.0  Problem Signature 03: 51a7d7b9  Problem Signature 04: System  Problem Signature 05: 4.0.30319.34209  Problem Signature 06: 53489ac1  Problem Signature 07: 21bc  Problem Signature 08: 1fb  Problem Signature 09: System.Net.WebException  OS Version: 6.1.7600.2.0.0.256.1  Locale ID: 1033  Additional Information 1: 0a9e  Additional Information 2: 0a9e372d3b4ad19135b953a78882e789  Additional Information 3: 0a9e  Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  • Anonymous
    June 21, 2015
    how do i fix this problem? please help Problem Event Name: CLR20r3  Problem Signature 01: OQLCGYNOGX2TO0TNBRRFFCGPXYRL0ZTJ  Problem Signature 02: 1.0.0.0  Problem Signature 03: 5578b550  Problem Signature 04: Indie Softworks Installer  Problem Signature 05: 1.0.0.0  Problem Signature 06: 5578b550  Problem Signature 07: 1a  Problem Signature 08: 0  Problem Signature 09: System.IO.FileNotFoundException  OS Version: 6.1.7601.2.1.0.256.48  Locale ID: 16393  Additional Information 1: 0a9e  Additional Information 2: 0a9e372d3b4ad19135b953a78882e789  Additional Information 3: 0a9e  Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  • Anonymous
    September 08, 2015
    Need help please. Problem signature:  Problem Event Name: CLR20r3  Problem Signature 01: mp3skyperecorder.exe  Problem Signature 02: 4.13.1.0  Problem Signature 03: 55eb8f83  Problem Signature 04: mscorlib  Problem Signature 05: 4.0.0.0  Problem Signature 06: 53b50a71  Problem Signature 07: 11fe  Problem Signature 08: 9d  Problem Signature 09: System.TypeLoadException  OS Version: 6.1.7601.2.1.0.256.1  Locale ID: 1033  Additional Information 1: 0a9e  Additional Information 2: 0a9e372d3b4ad19135b953a78882e789  Additional Information 3: 0a9e  Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  • Anonymous
    March 07, 2016
    Problem signature:  Problem Event Name: CLR20r3  Problem Signature 01: ServerManager.exe  Problem Signature 02: 6.3.9600.17238  Problem Signature 03: 53d0b3e7  Problem Signature 04: System.Configuration  Problem Signature 05: 4.6.1055.0  Problem Signature 06: 563c0fcc  Problem Signature 07: 208  Problem Signature 08: 34  Problem Signature 09: IOIBMURHYNRXKW0ZXKYRVFN0BOYYUFOW  OS Version: 6.3.9600.2.0.0.400.8  Locale ID: 1033  Additional Information 1: bd0c  Additional Information 2: bd0c5627670a049dcb44401dbdc27612  Additional Information 3: e6d2  Additional Information 4: e6d2bbeb59edb20a550707822bde4611 Read our privacy statement online:  go.microsoft.com/fwlink If the online privacy statement is not available, please read our privacy statement offline:  C:Windowssystem32en-USerofflps.txt