A forum for reverse engineering, OS internals and malware analysis 

 #33007  by Iradicator
 Sun Jun 16, 2019 2:15 pm
Hi,

I Have a service that once loaded, open "C++ runtime library" window, that indicate abort() function call.

when I connect windbg to my machine and retry, it enters the breakpoint, but too late since the exception already occurred and is nowhere in the stacktree :

[0x0] MyService!issue_debug_notification + 0x30
[0x1] MyService!__acrt_report_runtime_error + 0x11
[0x2] MytService!abort + 0x1a
[0x3] MyService!terminate + 0x7d
[0x4] MyService!__scrt_unhandled_exception_filter + 0x55
[0x5] KERNELBASE!UnhandledExceptionFilter + 0x149
[0x6] ntdll!__RtlUserThreadStart + 0x83ddc
[0x7] ntdll!_RtlUserThreadStart + 0x1b

Some more information about the error :

kd> !gle
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0xc0000034 - Object Name not found.

I wonder what can lead to this error ?

- is it a loader issue ?
- how can i get the original stack-trace?
- how can i get the object name it supposedly cannot found ?

thanks !