App crashing on Windows 11

chaoscreater

New member
Joined
Apr 25, 2022
Posts
3
Hi all,

I'm new to this forum and hopefully I've posted this thread in the right section. I have a very annoying app crashing issue and I've tried pretty much everything I can think of. Hopefully someone here will be able to help me identity what the issue is!

Basically, a while ago I've done an in-place upgrade from Win10 to Win11. Everything works fine, except that I have an app (TOW.exe) that seems to crash after running for about 20 mins ~ 2 hours. Sometimes it would work for 20 minutes and crash, sometimes it would work for hours and crash. The crash is always the same. This was never an issue running on Windows 10.

Below is a screenshot of the crash shown in Nirsoft's AppCrashView:

1650941026479.png

The exception code is always the same - "0xc0000005". I Googled this a bit and apparently, apps that are made using Unity don't seem to like RAM running at 3200MHz (which is what I'm using). The problem is, I'm running this on a laptop. I can't change the RAM timing in the BIOS and again, I never had this problem in Windows 10.

I've also tried installing Unity 2017.4.40 and then replacing the UnityPlayer.dll file in the path (D:\tow\app\UnityPlayer.dll) with the UnityPlayer.dll from the (Program Files\Unity) folder. The end result is the same.

I'm using the latest Win11 stable build as of this writing (22000.613) and my system is fully patched with Windows Update. I've also installed the latest AMD chipset driver and AMD display driver. Dependencies such as C++ are fully up to date. I've used the one from here - Visual C++ Redistributable Runtimes All-in-One (Feb 2022) Download.

I'm not using any 3rd party antivirus either, it's just using Windows Defender and I've added D:\ to the Folder Exclusion list.

I've tried to use Sysinternal's Process Monitor (ProcMon) to debug the app, but whenever I run ProcMon, the app (TOW.exe) wouldn't start. I've also tried using WinDBG (Preview) to launch the app and hook into it, but again the app wouldn't start if it is launched from WinDBG.



Possibly related, I also noticed that another app (Line.exe) always shows up in the AppCrashView logs. The weird thing is, this app doesn't crash and still works fine, but it always registers an entry in AppCrashView. The crash error is always the same and it is generated whenever the app process is launched.

1650941799456.png

However, on Windows 10, this error never shows up. It's only on Windows 11.

To completely rule out the fact that it's a Windows 11 issue, I did a fresh Win11 install on a test machine and then ran the 2 apps (Tow.exe and Line.exe). No crash errors generated and TOW.exe runs fine for hours and hours. So at this point, I believe the issue is specific to my machine with the Win11 that was installed via the in-place upgrade.



I also used Process Explorer to look at the "Threads" column for both Line.exe and Tow.exe. I noticed that they're both referencing ntdll.dll:

1650942182440.png


1650942239005.png



So then I used Nirsoft's LoadedDllsView to look at what apps are loading/using the ntdll.dll. I then closed all the apps found in the list. Here's an example:

1650942334611.png


However, the crash error for Line still registers in AppCrashView, whenever the process is launched. Also, TOW.exe still crashes after running for a while.

Below are links to the .WER and .DMP files, which I found from here - C:\Users\All Users\Microsoft\Windows\WER\ReportArchive and %localappdata%\CrashDumps
https://easyupload.io/zuiien
https://easyupload.io/1xxls9
 
Last edited:
Just to add to the above, if I look at the .DMP file for LINE using WinDBG, it suggests that the heap corruption issue is related to ntdll.dll and so I feel like I'm looking in the right direction. I just don't know how to troubleshoot with WinDBG, I've never really used it before.


Code:
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 22000 MP (8 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Debug session time: Tue Apr 26 14:38:39.000 2022 (UTC + 12:00)
System Uptime: not available
Process Uptime: 0 days 0:00:06.000
................................................................
............................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5208.42f4): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
eax=00000000 ebx=00000000 ecx=03cff8e8 edx=77e058c8 esi=00000000 edi=00000002
eip=77d54fec esp=03cff180 ebp=03cff1c0 iopl=0         nv up ei pl nz ac po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212
ntdll!NtWaitForMultipleObjects+0xc:
77d54fec c21400          ret     14h
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for ExplorerPatcher.IA-32.dll

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 3906

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 111676

Key  : Analysis.Init.CPU.mSec
Value: 968

Key  : Analysis.Init.Elapsed.mSec
Value: 6582243

Key  : Analysis.Memory.CommitPeak.Mb
Value: 147

Key  : Timeline.Process.Start.DeltaSec
Value: 6

Key  : WER.OS.Branch
Value: co_release

Key  : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key  : WER.OS.Version
Value: 10.0.22000.1

Key  : WER.Process.Version
Value: 7.8.1.2731


FILE_IN_CAB:  LINE.exe.21000.dmp

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
eax=03cff8b8 ebx=00000000 ecx=03cff8e8 edx=77e058c8 esi=00000002 edi=03e85760
eip=77dc9f79 esp=03cff890 ebp=03cff8c8 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!RtlReportFatalFailure+0x16:
77dc9f79 eb33            jmp     ntdll!RtlReportFatalFailure+0x4b (77dc9fae)
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 77dc9f79 (ntdll!RtlReportFatalFailure+0x00000016)
   ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 77e058c8

PROCESS_NAME:  LINE.exe

ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

EXCEPTION_CODE_STR:  c0000374

EXCEPTION_PARAMETER1:  77e058c8

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Heap_Error_Type] from Frame:[0] on thread:[PSEUDO_THREAD] ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

FAULTING_THREAD:  ffffffff

STACK_TEXT: 
00000000 00000000 ntdll!RtlpFreeHeapInternal+0x0


STACK_COMMAND:  !heap ; ** Pseudo Context ** ManagedPseudo ** Value: ffffffff ** ; kb

SYMBOL_NAME:  ntdll!RtlpFreeHeapInternal+0

MODULE_NAME: ntdll

IMAGE_NAME:  ntdll.dll

FAILURE_BUCKET_ID:  HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_ntdll.dll!RtlpFreeHeapInternal

OS_VERSION:  10.0.22000.1

BUILDLAB_STR:  co_release

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.22000.527

FAILURE_ID_HASH:  {f9e860eb-b03f-7415-804c-7e671e26c730}

Followup:     MachineOwner
---------
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top