Crash while invoking hook procedure RRS feed

  • Question

  • We are facing crash which is happening while invoking the hook procedure. The call stack is similar to 

    0:000> k
     # Child-SP          RetAddr           Call Site
    00 00000043`6b51f8d8 00007ffa`fc5a292f 0x00000001`80305c70
    01 00000043`6b51f8e0 00007ffa`fc58f399 user32!DispatchHookA+0x1af
    02 00000043`6b51f950 00007ffa`fc58f25e user32!CallHookWithSEH+0x29
    03 00000043`6b51f9a0 00007ffa`fe389684 user32!_fnHkINLPMOUSEHOOKSTRUCTEX+0x1e
    04 00000043`6b51f9f0 00007ffa`faa910c4 ntdll!KiUserCallbackDispatcherContinue
    05 00000043`6b51fa98 00007ffa`fc58e61d win32u!NtUserPeekMessage+0x14
    06 00000043`6b51faa0 00007ffa`fc58e403 user32!_PeekMessage+0x2d
    07 00000043`6b51fae0 00007ffa`ef274294 user32!PeekMessageA+0xa3
    08 00000043`6b51fb20 00007ffa`ef2aa107 mfc140!CWinThread::Run+0xc4 
    09 00000043`6b51fb70 00007ff6`fe0b2c43 mfc140!AfxWinMain+0xd7 
    0a (Inline Function) --------`-------- MyApp!invoke_main+0x21
    0b 00000043`6b51fbb0 00007ffa`fe238364 MyApp!__scrt_common_main_seh+0x117
    0c 00000043`6b51fbf0 00007ffa`fe34e851 kernel32!BaseThreadInitThunk+0x14
    0d 00000043`6b51fc20 00000000`00000000 ntdll!RtlUserThreadStart+0x21

    The address it is trying to invoke is freed.

    0:000> !address 0x00000001`80305c70
    Mapping file section regions...
    Mapping module regions...
    Mapping PEB regions...
    Mapping TEB and stack regions...
    Mapping heap regions...
    Mapping page heap regions...
    Mapping other regions...
    Mapping stack trace database regions...
    Mapping activation context regions...
    Usage:                  Free
    Base Address:           00000001`800b4000
    End Address:            00000043`6b420000
    Region Size:            00000041`eb36c000 ( 263.675 GB)
    State:                  00010000          MEM_FREE
    Protect:                00000001          PAGE_NOACCESS
    Type:                   <info not present at the target>
    Content source: 0 (invalid), length: 41eb205390

    We are not able to locate which procedure it is trying to invoke. Also 0x00000001`80305c70 is not part of any region in memory.

    Any help would be appreciated.


    Renjith V R

    Thanks, Renjith V R

    Tuesday, February 26, 2019 6:57 AM


All replies