调试Clickone程序安装错误

 

When you click a Clickone link and trying to install the application, an error dialog pops which looks like the following dialog:

 

Figure 1 Exception Screen snapshot

Because dfsvc.exe is launched by other process, you have no chance to have a debugger attached to dfsvc.exe. And sometimes it is too late for you to click “Debug” button and examine what happens inside the debuggee (dfsvc.exe). In this case, you need debugger automate attach to dfsvc.exe while it is launching. We can see the exception stack trace from information logged in Event Viewer, there is a AccessViolationException thrown from dfsvc.exe.

Please check wiki page http://blog.csdn.net/Donjuan/archive/2008/12/04/3446657.aspx to learn how to prepare the environment.

 

Below texts describe the whole debugging session:

 

 

CommandLine: d:/WINDOWS/Microsoft.NET/Framework/xxxx/dfsvc.exe

Symbol search path is: SRV*//symbols/symbols

Executable search path is:

ModLoad: 00400000 00408000   dfsvc.exe

ModLoad: 7c900000 7c9af000   ntdll.dll

ModLoad: 79630000 7967e000   D:/WINDOWS/system32/mscoree.dll

ModLoad: 7c800000 7c8f6000   D:/WINDOWS/system32/KERNEL32.dll

(c60.3ac): Break instruction exception - code 80000003 (first chance)

eax=00251ea4 ebx=7ffda000 ecx=00000000 edx=00000001 esi=00251f18 edi=00251ea4

eip=7c90120e esp=0012fb20 ebp=0012fc94 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

ntdll!DbgBreakPoint:

7c90120e cc              int     3

0:000> g

ModLoad: 77dd0000 77e6b000   D:/WINDOWS/system32/ADVAPI32.dll

…

ModLoad: 76d60000 76d79000   D:/WINDOWS/system32/iphlpapi.dll

(c60.a4): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=017116a5 ebx=00000017 ecx=04960016 edx=017116a5 esi=04a19eb8 edi=00000017

eip=4ed9b280 esp=0446eddc ebp=0446ee04 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202

gdiplus!LZWDecompressor::FHandleNext+0x10a:

4ed9b280 8801            mov     byte ptr [ecx],al          ds:0023:04960016=??

0:008> kp

ChildEBP RetAddr 

0446ee04 4ed991de gdiplus!LZWDecompressor::FHandleNext(void)+0x10a

0446f4d8 4ed99fc1 gdiplus!GpGifCodec::ProcessImageChunk(int bNeedProcessData = 1, int sinkdata = 1, struct ImageInfo dstImageInfo = struct ImageInfo)+0x935

0446f580 4ed9a0e7 gdiplus!GpGifCodec::DoDecode(int processdata = 1, int sinkdata = 1, int decodeframe = 1)+0x1d6

0446f5b4 4eca846a gdiplus!GpGifCodec::Decode(void)+0x91

0446f5c8 4eca8425 gdiplus!GpDecodedImage::InternalPushIntoSink(struct IImageSink * sink = 0x049fdcf0)+0x2e

0446f5e0 4ec94b74 gdiplus!GpDecodedImage::PushIntoSink(struct IImageSink * sink = 0x049fdcf0)+0x2e

0446f648 4ec94ac8 gdiplus!GpMemoryBitmap::InitImageBitmap(struct IImage * image = 0x049f5bd8, unsigned int width = 0, unsigned int height = 0, int pixfmt = 2498570, InterpolationHint hints = InterpolationHintAveraging (3), <function> * callback = 0x00000000, void * callbackData = 0x00000000)+0xcc

#

# From the stack, we can that dfsvc.exe is extracting a image from the assembly’s resource, after the assembly is downloaded completely. But seems that there some problems with the resource, which triggers a access violation exception.

#

0446f674 4eca87ba gdiplus!GpMemoryBitmap::CreateFromImage(struct IImage * image = 0x049f5bd8, unsigned int width = 0, unsigned int height = 0, int pixfmt = 2498570, InterpolationHint hints = InterpolationHintAveraging (3), class GpMemoryBitmap ** bmp = 0x049f6294, <function> * callback = 0x00000000, void * callbackData = 0x00000000)+0x49

0446f6ac 4ecaa943 gdiplus!CopyOnWriteBitmap::LoadIntoMemory(int format = 2498570, <function> * callback = 0x00000000, void * callbackData = 0x00000000, int width = 0, int height = 0)+0x9e

0446f6cc 4ecaa906 gdiplus!GpBitmap::ForceValidation(void)+0x1a

0446f6e4 7e1cb151 gdiplus!GdipImageForceValidation(class GpImage * image = 0x049fc9f8)+0x5b

0446f72c 7e1d13d5 System_Drawing_ni!DomainBoundILStubClass.IL_STUB(<HRESULT 0x80004001>)+0x51

0446f760 7e1d1309 System_Drawing_ni!System.Drawing.Image.FromStream(<HRESULT 0x80004001>)+0xb5

0446f794 636a1a70 System_Drawing_ni!System.Drawing.Image.FromStream(<HRESULT 0x80004001>)+0x9

0446f794 636d40b9 System_Deployment_ni!System.Deployment.Application.Resources.GetImage(<HRESULT 0x80004001>)+0x50

0446f7a0 636d3d87 System_Deployment_ni!System.Deployment.Application.SplashPiece.InitializeContent(<HRESULT 0x80004001>)+0x19

0446f7b8 636bf63b System_Deployment_ni!System.Deployment.Application.SplashPiece..ctor(<HRESULT 0x80004001>)+0x37

0446f7cc 636bf3d0 System_Deployment_ni!System.Deployment.Application.UserInterfaceForm.InitializeContent(<HRESULT 0x80004001>)+0x4b

0446f7dc 636a48d7 System_Deployment_ni!System.Deployment.Application.UserInterfaceForm..ctor(<HRESULT 0x80004001>)+0x40

0446f80c 7996d676 System_Deployment_ni!System.Deployment.Application.UserInterface.UIThread(<HRESULT 0x80004001>)+0x47

0:008> g

#

# A CLR exception is thrown, e0434f4d stands for all CLR exceptions, but the exception is catch by managed code.

#

(c60.bb0): CLR exception - code e0434f4d (first chance)

#

# another access violation exception occurs.

#

(c60.bb0): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=058cc67c ebx=058cc6a4 ecx=00000000 edx=2d18dd60 esi=0436f580 edi=0436f548

eip=603b2bd0 esp=0436f4f8 ebp=0436f514 iopl=0         nv up ei pl nz na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206

dfshim!CHashElementEntry::Internal_QueryInterface+0x20:

603b2bd0 890a            mov     dword ptr [edx],ecx  ds:0023:2d18dd60=????????

#

# When an exception occurs, the first thing should be done is checking the stack trace.  

#

0:007> kp

ChildEBP RetAddr 

#

# Please notice that the following stack trace means managed code is trying to cast a object (COM object instance) to a COM interface in most cases.

#

#   COM object (The managed object (CCW object) is an instance of class CHashElementEntry, and we are trying to get COM interface ({00000000-dd01-2d18-80c6-8c0500000000}) from that object. The

#   method is very simple (All COM objects have this method, several COM libraries (ATL, MFC) implicit implement this method), so it is interesting an access violation exception thrown from this method.

#   dfshim!CHashElementEntry::Internal_QueryInterface(struct _GUID * riid = 0x0436f580 {00000000-dd01-2d18-80c6-8c0500000000}, void ** ppv = 0x2d18dd60)+0x20

#   ATL wrapper for QueryInterface

#   dfshim!IsolationImplementation::Com::CComObject<CHashElementEntry>::QueryInterface(struct _GUID * riid = 0x0436f580 {00000000-dd01-2d18-80c6-8c0500000000}, void ** ppvUnknown = 0x2d18dd60)+0x85

#   Transition from managed code to native code.

#   System_Deployment_ni!DomainBoundILStubClass.IL_STUB(<HRESULT 0x80004001>)+0x79

#   This the managed method which initiate the COM Interop call.

#   0436f5d8 636af535 System_Deployment_ni!System.Deployment.Application.Manifest.AssemblyManifest.get_CompatibleFrameworks(<HRESULT 0x80004001>)+0x4b

#

#   The call stack shows above can be represented by following managed statement:

#  

#                     IComInterface ici = (IComInterface)objCHashElementEntryCCW;

#

0436f514 603b5f33 dfshim!CHashElementEntry::Internal_QueryInterface(struct _GUID * riid = 0x0436f580 {00000000-dd01-2d18-80c6-8c0500000000}, void ** ppv = 0x2d18dd60)+0x20

0436f534 636fd4a9 dfshim!IsolationImplementation::Com::CComObject<CHashElementEntry>::QueryInterface(struct _GUID * riid = 0x0436f580 {00000000-dd01-2d18-80c6-8c0500000000}, void ** ppvUnknown = 0x2d18dd60)+0x85

0436f5b0 636aba4b System_Deployment_ni!DomainBoundILStubClass.IL_STUB(<HRESULT 0x80004001>)+0x79

0436f5d8 636af535 System_Deployment_ni!System.Deployment.Application.Manifest.AssemblyManifest.get_CompatibleFrameworks(<HRESULT 0x80004001>)+0x4b

0436f6d8 636abe56 System_Deployment_ni!System.Deployment.Application.Manifest.AssemblyManifest.ValidateSemanticsForDeploymentRole(<HRESULT 0x80004001>)+0x1b5

0436f6e0 636c3473 System_Deployment_ni!System.Deployment.Application.Manifest.AssemblyManifest.ValidateSemantics(<HRESULT 0x80004001>)+0x16

0436f77c 636aa8e5 System_Deployment_ni!System.Deployment.Application.ManifestReader.FromDocument(<HRESULT 0x80004001>)+0x193

0436f838 636a937d System_Deployment_ni!System.Deployment.Application.DownloadManager.DownloadDeploymentManifestDirectBypass(<HRESULT 0x80004001>)+0x445

0436f898 6369f166 System_Deployment_ni!System.Deployment.Application.DownloadManager.DownloadDeploymentManifestBypass(<HRESULT 0x80004001>)+0x7d

0436f9c0 6369eb36 System_Deployment_ni!System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(<HRESULT 0x80004001>)+0x216

0436fa28 79935497 System_Deployment_ni!System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(<HRESULT 0x80004001>)+0x296

0436fa44 79975abf mscorlib_ni!System.Threading._ThreadPoolWaitCallback.WaitCallback_Context(<HRESULT 0x80004001>)+0x2f

0436fa44 79935b73 mscorlib_ni!System.Threading.ExecutionContext.Run(<HRESULT 0x80004001>)+0x6f

0436fa5c 7993599e mscorlib_ni!System.Threading._ThreadPoolWaitCallback.PerformWaitCallbackInternal(<HRESULT 0x80004001>)+0x53

0436faa0 79024af3 mscorlib_ni!System.Threading._ThreadPoolWaitCallback.PerformWaitCallback(<HRESULT 0x80004001>)+0x8e

0436fab0 79024a78 clr!CallDescrWorker(unsigned long pSrcEnd = 0, unsigned long numStackSlots = 0, unsigned long pArgumentRegisters = 0x436fc64, unsigned long fpRetSize = 0, unsigned long pTarget = 0x79935910)+0x33

0436fb2c 79025021 clr!CallDescrWorkerWithHandler(void * pSrcEnd = 0x00000000, unsigned int numStackSlots = 0, struct ArgumentRegisters * pArgumentRegisters = 0x0436fc64, unsigned int fpReturnSize = 0, void * pTarget = 0x79935910, int fCriticalCall = 0)+0x8e

0436fb4c 7902509a clr!DispatchCallBody(unsigned long * pSrc = 0x00000000, unsigned long numStackSlotsToCopy = 0, unsigned long * pRegisterArgs = 0x0436fc64, unsigned int64 uRegTypeMap = 0, void * pvRetBuff = 0x00000000, unsigned int64 cbRetBuff = 0, unsigned int fpRetSize = 0, unsigned char * pTargetAddress = 0x79935910 "U???")+0x20

0436fbe0 7902510b clr!DispatchCallDebuggerWrapper(unsigned long * pSrc = 0x00000000, unsigned long numStackSlotsToCopy = 0, unsigned long * pRegisterArgs = 0x0436fc64, unsigned int64 uRegTypeMap = 0, void * pvRetBuff = 0x00000000, unsigned int64 cbRetBuff = 0, unsigned int fpRetSize = 0, unsigned char * pTargetAddress = 0x79935910 "U???", class ContextTransitionFrame * pFrame = 0x00000000)+0x75

0436fc14 7907e505 clr!DispatchCallNoEH(unsigned long * pSrc = 0x00000000, unsigned long numStackSlotsToCopy = 0, unsigned long * pRegisterArgs = 0x0436fc64, unsigned int64 uRegTypeMap = 0, void * pvRetBuff = 0x00000000, unsigned int64 cbRetBuff = 0, unsigned int fpRetSize = 0, unsigned char * pTargetAddress = 0x79935910 "U???")+0x53

#

# Disassemble the method dfshim!CHashElementEntry::Internal_QueryInterface, show 30 lines of assembly code.

#

0:007> u dfshim!CHashElementEntry::Internal_QueryInterface L30

dfshim!CHashElementEntry::Internal_QueryInterface:

#

# below assembly code is method prologue; all C++ methods have the same assembly code sequence.

#

603b2bb0 8bff            mov     edi,edi

603b2bb2 55              push    ebp

603b2bb3 8bec            mov     ebp,esp

603b2bb5 83ec10          sub     esp,10h

603b2bb8 8b550c          mov     edx,dword ptr [ebp+0Ch]

603b2bbb 8bc1            mov     eax,ecx

#

# if ( ppv == NULL )

#

603b2bbd 33c9            xor     ecx,ecx

603b2bbf 3bd1            cmp     edx,ecx

603b2bc1 c745fc4f050780  mov     dword ptr [ebp-4],8007054Fh

#

#             return 8007054Fh;

#

603b2bc8 744f            je      dfshim!CHashElementEntry::Internal_QueryInterface+0x69 (603b2c19)

603b2bca 53              push    ebx

603b2bcb 56              push    esi

603b2bcc 8b7508          mov     esi,dword ptr [ebp+8]

603b2bcf 57              push    edi

#

# *ppv = NULL; // Error happens here, edx contains an invalid memory address, which triggers the access violation exception.

#

603b2bd0 890a            mov     dword ptr [edx],ecx

603b2bd2 6a04            push    4

603b2bd4 59              pop     ecx
#

# if ( riid == guid(9d46fb70_7b54_4f4f_9331_ba9e87833ff5) )

#    ...

#

603b2bd5 bfc03f3460      mov     edi,offset dfshim!_GUID_9d46fb70_7b54_4f4f_9331_ba9e87833ff5 (60343fc0)

603b2bda 33db            xor     ebx,ebx

603b2bdc f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]

603b2bde 742b            je      dfshim!CHashElementEntry::Internal_QueryInterface+0x5b (603b2c0b)

603b2be0 8b7508          mov     esi,dword ptr [ebp+8]

603b2be3 6a04            push    4

603b2be5 59              pop     ecx

603b2be6 bfd03e3460      mov     edi,offset dfshim!_GUID_285a8861_c84a_11d7_850f_005cd062464f (60343ed0)

603b2beb 33db            xor     ebx,ebx

603b2bed f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]

603b2bef 7411            je      dfshim!CHashElementEntry::Internal_QueryInterface+0x52 (603b2c02)

603b2bf1 8b7508          mov     esi,dword ptr [ebp+8]

603b2bf4 6a04            push    4

603b2bf6 59              pop     ecx

603b2bf7 bf98333360      mov     edi,offset dfshim!_GUID_00000000_0000_0000_c000_000000000046 (60333398)

603b2bfc 33db            xor     ebx,ebx

603b2bfe f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]

603b2c00 752e            jne     dfshim!CHashElementEntry::Internal_QueryInterface+0x80 (603b2c30)

603b2c02 8d4804          lea     ecx,[eax+4]

603b2c05 f7d8            neg     eax

603b2c07 1bc0            sbb     eax,eax

603b2c09 23c1            and     eax,ecx

603b2c0b 8902            mov     dword ptr [edx],eax

603b2c0d 8b08            mov     ecx,dword ptr [eax]

603b2c0f 50              push    eax

603b2c10 ff5104          call    dword ptr [ecx+4]

603b2c13 8365fc00        and     dword ptr [ebp-4],0

603b2c17 eb2b            jmp     dfshim!CHashElementEntry::Internal_QueryInterface+0x94 (603b2c44)

603b2c19 894df0          mov     dword ptr [ebp-10h],ecx

603b2c1c 894df8          mov     dword ptr [ebp-8],ecx

603b2c1f 8d4df0          lea     ecx,[ebp-10h]

 

From the above description, we can assert that CCW feed garbage address for parameter ppv, while calling Internal_QueryInterface, so this is an .NET issue.