Discussion:
Using windbg to retrieve dialog box error from a VB6 service
(too old to reply)
Rodv92
2010-09-27 10:15:00 UTC
Permalink
Hello group, i developped a little service based on ntsvc.ocx (i know
it is not supported) and sometime it throws me a dialogbox that cannot
be seen because the service does not run under localsystem and thus
cannot interact with the desktop, i could run the app not in service
mode, but the error is so sporadic that i would like to use the
present state of the error that juste happened today, to find where
the problem is, i suspect a WMI ou of memory kind of message.

So if i could have the VB error, win32 or WMI specific error code from
windbg it would be nice. If such commands or procedure exists, it
would be nice to let me know, thank you !

Here is the callstack for the main thread :

0 Id: 1528.1994 Suspend: 1 Teb: 7efdd000 Unfrozen
ChildEBP RetAddr
0018ee34 76432674 USER32!NtUserWaitMessage+0x15
0018ee70 7643288a USER32!DialogBox2+0x222
0018ee9c 7646f8d0 USER32!InternalDialogBox+0xe5
0018ef50 7646fbac USER32!SoftModalMessageBox+0x757
0018f0a8 7646fdf5 USER32!MessageBoxWorker+0x269
0018f128 729af829 USER32!MessageBoxIndirectA+0x94
WARNING: Stack unwind information not available. Following frames may
be wrong.
0018f168 729af6a5 MSVBVM60!IID_IVbaHost+0x411e9
0018f190 729af9a0 MSVBVM60!IID_IVbaHost+0x41065
0018f1c0 729a3d68 MSVBVM60!IID_IVbaHost+0x41360
0018f224 729a3db6 MSVBVM60!IID_IVbaHost+0x35728
0018f244 72a0c411 MSVBVM60!IID_IVbaHost+0x35776
0018f260 72a0c6f3 MSVBVM60!_vbaOnGoCheck+0xba
0018f2a0 775c87b9 MSVBVM60!EbGetErrorInfo+0x115
0018f2c4 775c878b ntdll!ExecuteHandler2+0x26
0018f374 7758010f ntdll!ExecuteHandler+0x24
0018f374 754eb727 ntdll!KiUserExceptionDispatcher+0xf
0018f714 72a10dcf KERNELBASE!RaiseException+0x58
0018f734 72a0e228 MSVBVM60!EbGetHandleOfExecutingProject+0x22b3
0018f748 72a194f7 MSVBVM60!rtcDoEvents+0x131
0018f780 72a45fb1 MSVBVM60!TipInvokeMethod+0x601
Rodv92
2010-09-27 10:44:51 UTC
Permalink
OK i found it, just had to inspect the memory at the good spot :

~0kb

0018ee9c 7646f8d0 76400000 02c58a78 00000000
USER32!InternalDialogBox+0xe5

and then dc 02c58a78 02c58a78 +512

and it gave me this :

2c58ae8 000e0029 00190090 ffffffff 00450082 ).............E.
02c58af8 00720072 00750065 00200072 00270064 r.r.e.u.r. .d.'.
02c58b08 00780065 006300e9 00740075 006f0069 e.x...c.u.t.i.o.
02c58b18 0020006e 002d0027 00310032 00370034 n. .'.-.2.1.4.7.
02c58b28 00310032 00340037 00320030 00280020 2.1.7.4.0.2. .(.
02c58b38 00300038 00340030 00300031 00360030 8.0.0.4.1.0.0.6.
02c58b48 00270029 000a003a 0045000a 00720072 ).'.:.....E.r.r.
02c58b58 00750065 00200072 00750041 006f0074 e.u.r. .A.u.t.o.
02c58b68 0061006d 00690074 006e006f 00000000 m.a.t.i.o.n.....
02c58b78 00000000 00610074 0067006e 00000000 ....t.a.n.g.....
02c58b88 44de5a59 94000049 75bd5b70 89abcdef YZ.DI...p[.u...

wichi is pretty readable...
Post by Rodv92
Hello group, i developped a little service based on ntsvc.ocx (i know
it is not supported) and sometime it throws me a dialogbox that cannot
be seen because the service does not run under localsystem and thus
cannot interact with the desktop, i could run the app not in service
mode, but the error is so sporadic that i would like to use the
present state of the error that juste happened today, to find where
the problem is, i suspect a WMI ou of memory kind of message.
So if i could have the VB error, win32 or WMI specific error code from
windbg it would be nice. If such commands or procedure exists, it
would be nice to let me know, thank you !
0 Id: 1528.1994 Suspend: 1 Teb: 7efdd000 Unfrozen
ChildEBP RetAddr
0018ee34 76432674 USER32!NtUserWaitMessage+0x15
0018ee70 7643288a USER32!DialogBox2+0x222
0018ee9c 7646f8d0 USER32!InternalDialogBox+0xe5
0018ef50 7646fbac USER32!SoftModalMessageBox+0x757
0018f0a8 7646fdf5 USER32!MessageBoxWorker+0x269
0018f128 729af829 USER32!MessageBoxIndirectA+0x94
WARNING: Stack unwind information not available. Following frames may
be wrong.
0018f168 729af6a5 MSVBVM60!IID_IVbaHost+0x411e9
0018f190 729af9a0 MSVBVM60!IID_IVbaHost+0x41065
0018f1c0 729a3d68 MSVBVM60!IID_IVbaHost+0x41360
0018f224 729a3db6 MSVBVM60!IID_IVbaHost+0x35728
0018f244 72a0c411 MSVBVM60!IID_IVbaHost+0x35776
0018f260 72a0c6f3 MSVBVM60!_vbaOnGoCheck+0xba
0018f2a0 775c87b9 MSVBVM60!EbGetErrorInfo+0x115
0018f2c4 775c878b ntdll!ExecuteHandler2+0x26
0018f374 7758010f ntdll!ExecuteHandler+0x24
0018f374 754eb727 ntdll!KiUserExceptionDispatcher+0xf
0018f714 72a10dcf KERNELBASE!RaiseException+0x58
0018f734 72a0e228 MSVBVM60!EbGetHandleOfExecutingProject+0x22b3
0018f748 72a194f7 MSVBVM60!rtcDoEvents+0x131
0018f780 72a45fb1 MSVBVM60!TipInvokeMethod+0x601
Loading...