Windows Error Reporting and CLR integration


Windows Error Reporting (WER) monitors and collects information on crashes and hangs on Windows platforms newer that Windows XP. The information collected can be sent to a server for investigation (read more in my previous WER article).


When creating reports, WER generates some parameters to bucket-ize the failures. Since the OS doesn’t know anything about managed applications, CLR integrates WER and adds these parameters to create correct buckets:


-          AppName - The filename of the EXE (e.g., “Explorer.exe”);


-          AppVer – Assembly version number for an managed EXE (major.minor.build.revision) or the PE header version number (e.g. “2.0.40220.13”) for unmanged


-          AppStamp - The timestamp on the executable.


-          AsmAndModName – Assembly and module name if the module is part of a multi-module assembly (e.g., “MyAssembly+MyModule.dll”)


-           AsmVer - Managed assembly version number of the faulting assembly (major.minor.build.revision)


-          ModStamp - The timestamp of the faulting module.


-          MethodDef - MethodDef token for the faulting method, after stripping off the high byte.


-          Offset - The IL offset of the faulting instruction.


-          ExceptionType -               The name of the type of the most-inner exception, with "Exception" removed from the end, if present. (E.g., "System.AccessViolation")


For example, I have a managed app (TestWERDefaultCategorizationAndDumps) that crashed. A report was created with these parameters:


Problem signature


Problem Event Name:                      CLR20r3


Problem Signature 01:                     XFU1LOPV1B5JQH0HBYGNH00TXWMZP45M


Problem Signature 02:                     1.0.0.0


Problem Signature 03:                     49833e70


Problem Signature 04:                     TestWERDefaultCategorizationAndDumps


Problem Signature 05:                     1.0.0.0


Problem Signature 06:                     49833e70


Problem Signature 07:                     1            -> methodDesc


Problem Signature 08:                     16          -> offset


Problem Signature 09:                     System.ArgumentNullException   -> exception type


OS Version:                                        6.0.6001.2.1.0.256.4


Locale ID:                                           1033


 


So the application crashed because a System.ArgumentNullException was unhandled. If we attach the debugger to the application (windbg –pn TestWERDefaultCategorizationAndDumps if the application is running or windbg TestWERDefaultCategorizationAndDumps to start the app under debugger), we can use the offset and the methodDesc to find out what happened. First, we need to load sos (.loadby sos mscorwks) and then we can use !token2ee Module MethodDesc to find out the method that threw. To determine the methodDesc, append 060000 to the number in the report.


0:000> !token2ee TestWERDefaultCategorizationAndDumps 06000001


Module: 0000064280012e20 (TestWERDefaultCategorizationAndDumps.exe)


Token: 0x0000000006000001


MethodDesc: 0000064280013580


Name: TestWERDefaultCategorizationAndDumps.Program.ThrowUnhandledException()


JITTED Code Address: 00000642801504b0


 


So the function that threw the exception is ThrowUnhandledException  in class Program (TestWERDefaultCategorizationAndDumps.Program.ThrowUnhandledException). Once we know the method desc, we can dump the IL of the method and see what line failed:


0:000> !dumpil 0000064280013580


ilAddr = 0000000000eb2050


IL_0000: nop


IL_0001: ldstr "Thow Argument Null Exception"


IL_0006: call System.Console::WriteLine


IL_000b: nop


IL_000c: ldstr "test"


IL_0011: newobj System.ArgumentNullException::.ctor


IL_0016: throw


The report says the offset is 16, so we look at IL_0016 and we find our throw. If we take a look at the code, it all makes sense:



static void ThrowUnhandledException()


{


    Console.WriteLine("Thow Argument Null Exception");


    throw new ArgumentNullException("test");


}

Comments (16)

  1. Like I mentioned in my previous article , CLR integrates WER in order to be able to add managed-specific

  2. TERRY MORRIS says:

    So what is the fix? How do you eliminate the Report.wer files from building up in the computer?

  3. Leigh McCulloch says:

    Thanks OanaPlaton, this blog entry was really useful for understanding what each line of the problem signature means. I did not seem to have windbg on my system though, and it was going to be much faster to find the method without needing to have the application running, so I used the following method to translate the method token into the actual method: http://www.codeilove.com/…/debugging-using-windows-error-reporting.html

  4. mark gray says:

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: trainersoftware.exe

     Problem Signature 02: 4.7.0.0

     Problem Signature 03: 5183d63f

     Problem Signature 04: mscorlib

     Problem Signature 05: 4.0.0.0

     Problem Signature 06: 50484bd7

     Problem Signature 07: 14b7

     Problem Signature 08: 5e

     Problem Signature 09: System.ArgumentOutOfRange

     OS Version: 6.1.7601.2.1.0.256.48

     Locale ID: 5129

     Additional Information 1: 0a9e

     Additional Information 2: 0a9e372d3b4ad19135b953a78882e789

     Additional Information 3: 0a9e

     Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:Windowssystem32en-USerofflps.txt

    I have this issue

    Can anyone help

    Mark

  5. I_HATE_YOUR_ERROR_REPORTING says:

    what about this…

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: app.exe

     Problem Signature 02: 1.0.0.0

     Problem Signature 03: 521e5a51

     Problem Signature 04: App

     Problem Signature 05: 1.0.0.0

     Problem Signature 06: 521e5a51

     Problem Signature 07: 19c

     Problem Signature 08: 443

     Problem Signature 09: PSZQOADHX1U5ZAHBHOHGHLDGIY4QIXHX   Uhhhhh… what???

     OS Version: 6.1.7601.2.1.0.256.48

     Locale ID: 1033

     Additional Information 1: 0a9e

     Additional Information 2: 0a9e372d3b4ad19135b953a78882e789

     Additional Information 3: 0a9e

     Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:windowssystem32en-USerofflps.txt

    wtf is this crap?!

  6. JIMBOB TIM JOE HAMBERGER says:

    Fuke Dhis Shiet

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: gdaap.exe

     Problem Signature 02: 1.0.0.0

     Problem Signature 03: 52d2281d

     Problem Signature 04: System

     Problem Signature 05: 4.0.30319.18408

     Problem Signature 06: 52311185

     Problem Signature 07: 21b0

     Problem Signature 08: 61

     Problem Signature 09: System.Net.WebException

     OS Version: 6.1.7600.2.0.0.768.3

     Locale ID: 1033

     Additional Information 1: 5981

     Additional Information 2: 598144a8ad1f1820bb959c4084e791f2

     Additional Information 3: 9515

     Additional Information 4: 951502d4932ac715056e29b9a4f8434b

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:Windowssystem32en-USerofflps.txt

  7. kiana says:

    please please help me

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: comsol.exe

     Problem Signature 02: 4.4.0.150

     Problem Signature 03: 5294b7bc

     Problem Signature 04: Util

     Problem Signature 05: 4.4.0.150

     Problem Signature 06: 5294b795

     Problem Signature 07: 95

     Problem Signature 08: 1f0

     Problem Signature 09: System.BadImageFormatException

     OS Version: 6.1.7600.2.0.0.256.1

     Locale ID: 1033

     Additional Information 1: 5fb5

     Additional Information 2: 5fb52475b7d5707da06b20e0977b8f49

     Additional Information 3: dce9

     Additional Information 4: dce93b64bf19e8ad7196e4ca2eb32f0a

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:Windowssystem32en-USerofflps.txt

  8. John Washburn says:

    RE:

    windbg –pn TestWERDefaultCategorizationAndDumps if the application is running or windbg TestWERDefaultCategorizationAndDumps to start the app under debugger),

    Isn't all that the dereferencing metioned above supposed to by handled by the .PDB files I have installed with my application?  If not, how do I get WER / CLR to make use of the available .PDB files?

  9. whats problome of my application code says:

    Hello

    can you help me please

    I have an application that i write with Visual basic 2013

    1-old exe file of my project is running carefully on all OS (xp-7-8)

    2- but i change some code and i add some form to my application and then build a project , but new exe file on other computers is not running and the below error is happend

    3- Runs properly on development machine(windows8.1) .

    4- on other computers(xp,7) that i tested it,  it not run carefully.

    on windows 7: i encountered the error (Applcation has Stopped working)

    On windows xp: when i run exe file ,the error was not show, but the programm not run

    ****

    Description:

     Stopped working

    Problem signature:

     Problem Event Name:    CLR20r3

     Problem Signature 01:    bimeh.net.exe

     Problem Signature 02:    1393.5.6.38

     Problem Signature 03:    53d49559

     Problem Signature 04:    bimeh.net

     Problem Signature 05:    1393.5.6.38

     Problem Signature 06:    53d49559

     Problem Signature 07:    63

     Problem Signature 08:    ea

     Problem Signature 09:    System.InvalidOperationException

     OS Version:    6.1.7601.2.1.0.256.1

     Locale ID:    1033

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:Windowssystem32en-USerofflps.txt

  10. Amir says:

    You need to publish you application and install it on the other machine,

    amirrazi506(a)yahoo.fr

  11. AMir says:

    Due to the fact that the application in the other machine is not able to retrieve the correct DLL, you can also go into  :project settings/ Publish / Application Files and include all the file, and go to preference and change the "Copy Local" under Project Settings / References for all if you want

    please make backup before to start, amirrazi506(a)yahoo.fr

    kr

  12. Pankaj says:

    Problem Event Name: CLR20r3

     Problem Signature 01: PokeGen.exe

     Problem Signature 02: 1.0.0.0

     Problem Signature 03: 51a7d7b9

     Problem Signature 04: System

     Problem Signature 05: 4.0.30319.34209

     Problem Signature 06: 53489ac1

     Problem Signature 07: 21bc

     Problem Signature 08: 1fb

     Problem Signature 09: System.Net.WebException

     OS Version: 6.1.7600.2.0.0.256.1

     Locale ID: 1033

     Additional Information 1: 0a9e

     Additional Information 2: 0a9e372d3b4ad19135b953a78882e789

     Additional Information 3: 0a9e

     Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  13. akash says:

    how do i fix this problem? please help

    Problem Event Name: CLR20r3

     Problem Signature 01: OQLCGYNOGX2TO0TNBRRFFCGPXYRL0ZTJ

     Problem Signature 02: 1.0.0.0

     Problem Signature 03: 5578b550

     Problem Signature 04: Indie Softworks Installer

     Problem Signature 05: 1.0.0.0

     Problem Signature 06: 5578b550

     Problem Signature 07: 1a

     Problem Signature 08: 0

     Problem Signature 09: System.IO.FileNotFoundException

     OS Version: 6.1.7601.2.1.0.256.48

     Locale ID: 16393

     Additional Information 1: 0a9e

     Additional Information 2: 0a9e372d3b4ad19135b953a78882e789

     Additional Information 3: 0a9e

     Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  14. John says:

    Need help please.

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: mp3skyperecorder.exe

     Problem Signature 02: 4.13.1.0

     Problem Signature 03: 55eb8f83

     Problem Signature 04: mscorlib

     Problem Signature 05: 4.0.0.0

     Problem Signature 06: 53b50a71

     Problem Signature 07: 11fe

     Problem Signature 08: 9d

     Problem Signature 09: System.TypeLoadException

     OS Version: 6.1.7601.2.1.0.256.1

     Locale ID: 1033

     Additional Information 1: 0a9e

     Additional Information 2: 0a9e372d3b4ad19135b953a78882e789

     Additional Information 3: 0a9e

     Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

  15. TenJed says:

    Problem signature:

     Problem Event Name: CLR20r3

     Problem Signature 01: ServerManager.exe

     Problem Signature 02: 6.3.9600.17238

     Problem Signature 03: 53d0b3e7

     Problem Signature 04: System.Configuration

     Problem Signature 05: 4.6.1055.0

     Problem Signature 06: 563c0fcc

     Problem Signature 07: 208

     Problem Signature 08: 34

     Problem Signature 09: IOIBMURHYNRXKW0ZXKYRVFN0BOYYUFOW

     OS Version: 6.3.9600.2.0.0.400.8

     Locale ID: 1033

     Additional Information 1: bd0c

     Additional Information 2: bd0c5627670a049dcb44401dbdc27612

     Additional Information 3: e6d2

     Additional Information 4: e6d2bbeb59edb20a550707822bde4611

    Read our privacy statement online:

     go.microsoft.com/fwlink

    If the online privacy statement is not available, please read our privacy statement offline:

     C:Windowssystem32en-USerofflps.txt

Skip to main content