October 2006 - Posts

OllyDbg, Windows XP SP2 (32-bit) and Kaspersky Antivirus

I use OllyDbg debugger from time to time. The most wonderful debugger I ever seen: it's light, powerful and does not require installation ... This evening I got a few BSOD's on my Windows XP SP2 after running OllyDbg. So I started the investigations.

Analyzing minidump using WinDbg showed that system went down because of csrss.exe crash. This actually does not answer the question: why exactly OllyDbg causes BSODing. Debugging OllyDbg using WinDbg I found the function where the system dies:

ntdll!KiUserApcDispatcher:
7c90eac0 8d7c2410        lea     edi,[esp+10h]
7c90eac4 58              pop     eax
7c90eac5 ffd0            call    eax
7c90eac7 6a01            push    1
7c90eac9 57              push    edi
7c90eaca e84aebffff      call    ntdll!ZwContinue (7c90d619)

Done! Once I realized it's connected with kernel I remembered that recently I installed Kaspersky Antivirus...Uninstalling antivirus solved the problem.
 
Posted by Volodymyr Shcherbyna | 3 comment(s)
Filed under:

Sometimes you DO need to invent the wheels

There is a well-known approach that states 'there is no need to re-invent the wheel'. In other words, it means that if you decided to implement some functionality in your program, you should googlize to make sure it's not implemented by other people and if it is then just use it and don't waste the time. The time seems to be very important in software development cycle. Sure.

Nice. But in fact there are some problems.

In any operating system to reuse some functionality you need some interfaces to be exposed to communicate with them. Let's say your program should load some library and communicate with it via exported functions. It gives your application the flexibility - you may load/unload the code you want to run any time, the only one problem is that: in most cases you cannot control the code.

I will omit the scenario when the library that contains needed for your program functionality is developed by the developer in your company. I want to tell about the scenario when your application uses different components from different vendors.

So let's say you have the video rendering application. The application takes the video file as the input and produces the screenshots as the output. The application uses COM to communicate with Microsoft DirectShow (DS) 9.0.

This is what I told above: application uses DS interfaces to process the video file. It does not even know what components implement those interfaces - your application really does not care about it... And this causes a lot of  problems(all problems refer to using inproc server):

- when your application process video using 3rd party codecs you cannot control memory allocation/dealloaction by the codec

- the 3rd pary component code have an access to your application memory: thus it may cause heap corruption, etc

- exotic situations (like described below)

My exotic case was connected with strange MessageBox I saw when debugging my application. The following call to IFilterGraph->Connect(...) showed message box like this:

 

The output window contains list of interesting strings:

'console.exe': Loaded 'D:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax', Binary was not built with debug information.
'console.exe': Loaded 'D:\WINDOWS\system32\ddraw.dll', No symbols loaded.
'console.exe': Loaded 'D:\WINDOWS\system32\dciman32.dll', No symbols loaded.
First-chance exception at 0x04eca8ed in console.exe: 0xC0000005: Access violation writing location 0x00000000.
First-chance exception at 0x04ec9ed6 in console.exe: 0xC0000005: Access violation writing location 0x00000000.
First-chance exception at 0x04eca0e7 in console.exe: 0xC0000005: Access violation writing location 0x00000000.
First-chance exception at 0x04eca225 in console.exe: 0xC0000005: Access violation writing location 0x00000000.
First-chance exception at 0x04ec7e76 in console.exe: 0xC0000005: Access violation writing location 0x00000000.
First-chance exception at 0x04ec7fcb in console.exe: 0xC0000005: Access violation writing location 0x00000000.

Looking at 'D:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax' sections:

answers the question: the dll file is packed using AsProtect protector - the typical behavour of protector is to add 'adata' section. The message box I saw was the protection action of AsProtect. It detects my Visual Studio debugger as WinIce/SoftIce (I don't have none of them installed) and terminate my process.

Now I back to the topic of my post. If somebody invented the wheel for you, make sure it's safe.  In this situation I can only deinstall Nero codecs and never install them again...

Posted by Volodymyr Shcherbyna | 1 comment(s)
Filed under:

CEE MVP Open Days Moscow, September 2006 ... (in short)

Here I am. A lot of time have passed since I wrote my last post... Now I hope the situation will be changed.

I was in Moscow in CEE MVP Open Days 2006, and I can tell you - it was cool! MVP's from Ukraine, Russia, Poland, Checzh republic and other countries were listening reports from MS and Russian MVPs. There were several topics for reports: the technical part was represented by the cool guys from WCF and VS Team System; non-technical part was covered by russian MSFT's and MVP's.

Moscow is marvelous city. But after closer look it becomes "alien" for me. I am attaching several pictures from russian MS office.

 Russia office


MVP's are entering the Microsoft Russia office ... 

Registration ... 

Aleksandr Lozechkin - russian MVP Lead (from the left) and me 

Russian MVP's and me... 

 You can look at all pictures from Open Days on my gallery here
 

Posted by Volodymyr Shcherbyna | with no comments
Filed under: