C# application crashes while building in Visual Studio 2010

  • Article

If we open an existing C# project and try to build the application, it works fine. This issue only occurs while building a new application.

I launched the devenv.exe in the debugger (https://www.microsoft.com/whdc/devtools/debugging/installx86.Mspx) and took a crash dump (https://support.microsoft.com/kb/286350).

After debugging I found that this is caused by McAffee’s Host Intrusion Prevention system. Looking at the thread 0 in the dump, it shows how the McAfee HIP is hooking into the process and intercepting the calls.

0:000> kL100
ChildEBP RetAddr
0012a99c 7c90df4a ntdll!KiFastSystemCallRet
0012a9a0 7c809590 ntdll!NtWaitForMultipleObjects+0xc
0012aa3c 7e4195f9 kernel32!WaitForMultipleObjectsEx+0x12c
0012aa98 7752ebd6 user32!RealMsgWaitForMultipleObjectsEx+0x13e
0012aac0 7752ecfd ole32!CCliModalLoop::BlockFn+0x80
0012aae8 77525fc1 ole32!ModalLoop+0x5b
0012aaf8 77601efe ole32!SwitchSTA+0x21
0012ab18 7760108a ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0xd1
0012abf8 7752edaa ole32!CRpcChannelBuffer::SendReceive2+0xc8
0012ac14 7752ed53 ole32!CCliModalLoop::SendReceive+0x1e
0012ac80 7752cdb2 ole32!CAptRpcChnl::SendReceive+0x6f
0012acd4 77ef4db5 ole32!CCtxComChnl::SendReceive+0x113
0012acf0 77ef4ead rpcrt4!NdrProxySendReceive+0x43
0012b0cc 77ef4e42 rpcrt4!NdrClientCall2+0x1fa
0012b0ec 77e8a83b rpcrt4!ObjectStublessClient+0x8b
0012b0fc 7752ddb1 rpcrt4!ObjectStubless+0xf
0012b114 7752dd52 ole32!RemoteReleaseRifRefHelper+0x84
0012b13c 7752c9f0 ole32!RemoteReleaseRifRef+0x74
0012b194 7752c7e9 ole32!CStdMarshal::DisconnectCliIPIDs+0x200
0012b1bc 77546735 ole32!CStdMarshal::Disconnect+0x178
0012b1d0 77546716 ole32!DisconnectSwitch+0x16
0012b1e8 77564f45 ole32!CStdMarshal::DisconnectAndRelease+0x44
0012b398 774ffd56 ole32!COIDTable::ThreadCleanup+0x80
0012b3c4 774ffca9 ole32!FinishShutdown+0x69
0012b3e0 774ff231 ole32!ApartmentUninitialize+0x7e
0012b3f8 774fee98 ole32!wCoUninitialize+0x41
0012b414 7752c269 ole32!CoUninitialize+0x5b
0012b420 774fd1ba ole32!DoThreadSpecificCleanup+0x4f
0012b428 774fd159 ole32!ThreadNotification+0x37
0012b448 774fd101 ole32!DllMain+0x147
0012b468 7c90118a ole32!_DllMainCRTStartup+0x52
0012b488 7c913a43 ntdll!LdrpCallInitRoutine+0x14
0012b500 7c80c136 ntdll!LdrShutdownThread+0xd7
0012b538 6af71b88 kernel32!ExitThread+0x3e
WARNING: Stack unwind information not available. Following frames may be wrong.
0012b588 65a5b734 HIPQA+0x1b88
0012b5a0 64203a29 HIPI!Exp_PPClientDll_Register+0x6024
0012b5b8 64203ee7 HIPIS0e0118e!Exp_FinalizeStub+0xa39
0012b6a8 44f88a85 HIPIS0e0118e!Exp_FinalizeStub+0xef7
0012b6f8 607effec FileTracker!IsTrackingEnabled+0x4f
0012b74c 607eaba7 mscorpehost!WszCreateProcess+0xbd
0012bc18 607eacfb mscorpehost!RunProcess+0x132
0012c070 607ead94 mscorpehost!ConvertResource+0xf5
0012c3dc 607eb562 mscorpehost!CeeFileGenWriter::emitResourceSection+0x45
0012c3ec 607eb59d mscorpehost!CeeFileGenWriter::link+0x12e
0012c3fc 607eb67a mscorpehost!CeeFileGenWriter::fixup+0x1e
0012c414 607e8b32 mscorpehost!CeeFileGenWriter::generateImage+0x74
0012c420 3ec56922 mscorpehost!ICeeFileGen::GenerateCeeFile+0x1a
0012cad0 3ec55346 cslangsvc!PEFile::EndOutputFile+0x818
0012cb08 3ebbca7d cslangsvc!LangCompiler::CreateAssembly+0xde
0012cb3c 3ebfc7bb cslangsvc!LangCompiler::DoCompile+0x129
0012cb78 3ebfc811 cslangsvc!LangCompiler::CompileAll+0xb7
0012cbb8 3ebfc8b2 cslangsvc!LangCompiler::Compile+0x27
0012cbf0 3ebfc943 cslangsvc!CController::RunCompilerImpl+0x3a
0012e3d8 3ebfc9ce cslangsvc!CController::Compile+0x6f
0012e468 3ee4d240 cslangsvc!CControllerIDE::Compile+0x46
0012e49c 3ee7f72a cslangsvc!CCSCompilerDelegator::Compile+0x28
0012e4d4 3ee4ce95 cslangsvc!CCSharpProjectSite::BuildProjectCore+0x6a
0012e50c 3e886225 cslangsvc!CProjectSite::BuildProject+0x27
0012e53c 3e88ac90 csproj!CCSharpBuildCompiler::DoMainBuild+0x17d

0:000> lmvm HIPI
start end module name
65a50000 65a76000 HIPI (export symbols) HIPI.dll
Loaded symbol image file: HIPI.dll
Image path: c:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPI.dll
Image name: HIPI.dll
Timestamp: Sun Oct 26 00:58:32 2008 (4903F8F8)
CheckSum: 00013873
ImageSize: 00026000
File version: 14.1.0.398
Product version: 0.0.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: McAfee, Inc.
ProductName: HIPSCORE.14.1.0.398.x86
FileVersion: HIPSCORE.14.1.0.398.x86
PrivateBuild: HIPSCORE.14.1.0.398.x86
FileDescription: HIPSCore Injected Library
LegalCopyright: Copyright© 1995-2008 McAfee, Inc. All Rights Reserved.

0:000> lmvm HIPIS0e0118e
start end module name
64200000 6420b000 HIPIS0e0118e (export symbols) HIPIS0e0118e.dll
Loaded symbol image file: HIPIS0e0118e.dll
Image path: C:\WINDOWS\system32\HIPIS0e0118e.dll
Image name: HIPIS0e0118e.dll
Timestamp: Sun Oct 26 00:58:19 2008 (4903F8EB)
CheckSum: 0001624C
ImageSize: 0000B000
File version: 14.1.0.398
Product version: 0.0.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: McAfee, Inc.
ProductName: HIPSCORE.14.1.0.398.x86
FileVersion: HIPSCORE.14.1.0.398.x86
PrivateBuild: HIPSCORE.14.1.0.398.x86
FileDescription: HIPSCore Injected Stub
LegalCopyright: Copyright© 1995-2008 McAfee, Inc. All Rights Reserved.

In McAfee Host Intrusion Prevention, there might be an option to add an exception for the devenv.exe file to allow the proper execution.