Results 1 to 3 of 3

Thread: DEP and debugging

  1. #1
    To crash or not to crash
    Join Date
    Dec 2001
    Posts
    120

    DEP and debugging

    Today I encountered two strange things that are DEP related. Our application ran on our Terminal Server and this server has DEP turned on for Windows services only. A colleague of mine reported she had problems with one of the actions she wanted to perform with our program. Windows would show an 0xc0000409 crash every time she performed the action. When I googled it I saw it's a DEP exception.

    Strange thing 1:
    How can I get a DEP exception when DEP is turned off for normal applications?

    To find out what was causing the exception I started my favourite debugger ollydbg. I ran the application, caused the error and the program terminated right away with all threads exiting with error 0xc0000409.

    Strange thing 2:
    Why did the application terminate instead of breaking on the instruction that caused the exception?

    Offcourse I had turned off all automatic exception handling within olly. Only the Floating Point exceptions where passed on.

    Can anybody shed some light on this?

    Thanks, I-Warez

  2. #2
    0xC0000409 is a stack overrun exception, not a "DEP exception". It is raised by the /GS cookie check code and works regardless of DEP. In fact it's not related to DEP because it's not reaching the stack code execution stage. __report_gsfailure() directly calls UnhandledExceptionFilter so it never arrives to the application's exception handler and is not reported to the debugger. See gs_report.c in the CRT sources.
    More info and debugging advice: http://msdn.microsoft.com/en-us/magazine/cc163311.aspx
    Last edited by reverser; November 19th, 2009 at 17:44.

  3. #3
    To crash or not to crash
    Join Date
    Dec 2001
    Posts
    120
    Thanks. That clears up a lot.

Similar Threads

  1. 64bit debugging
    By omega_red in forum Tools of Our Trade (TOT) Messageboard
    Replies: 17
    Last Post: July 31st, 2009, 16:26
  2. Kernel debugging with IDA
    By Hex Blog in forum Blogs Forum
    Replies: 1
    Last Post: June 3rd, 2009, 06:57
  3. debugging basics (gdb, ddd)
    By 0xf001 in forum Linux RCE
    Replies: 1
    Last Post: January 23rd, 2006, 08:23
  4. Exceptions when debugging???
    By homunculus in forum OllyDbg Support Forums
    Replies: 3
    Last Post: February 4th, 2003, 05:10
  5. Need help with debugging
    By crackzilla in forum The Newbie Forum
    Replies: 6
    Last Post: November 26th, 2002, 18:20

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •