Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

The Case of the Runtime Error (or Check Your Time Zones & DST Settings)

Posted by William Diaz on May 7, 2012


One of our helpdesk technician’s in a remote office reached out to me recently and asked me to assist with an application that suddenly started crashing on him with the following error: “Microsoft Visual C++ Runtime Library. Runtime Error! This application has requested the Runtime to terminate it in an unusual way…”
image

 

We fired up Process Monitor, started the problem application again and collected a trace of the executable up until the message box appeared. Usually, I like to filter for unusual suspects, like access denied, invalid path, or some other out of the ordinary result but nothing really stood out in the Count Occurrences > Results filter, so we set it aside and I told him I would look later. I also captured a dump of the application with Process Explorer and would look for clues using WinDbg.

Following up the next day, I started by examining the dump. I don’t really know the internals of the application well (or for that matter advanced WinDbg techniques) and didn’t really know what I was looking to uncover. It’s a 3rd party app so I can’t take the approach I would normally take with a Microsoft application when it crashes by looking for some 3rd party modules in the thread stacks and then disable them from the program (although, in hindsight, the dump did reveal an important clue).

Turning back to the procmon log, I took a more practical and simplified approach: rather than examining results and file or reg operations, I just followed the log to the end to see what happened just before the application crashed. This is what I saw:
image 
There are a series of registry operations for the workstation time zone. This is nothing remarkable … except for that fact that this workstation is in Arizona but the registry activity points to Mountain Standard Time on the workstation. Checking the workstation time, however, revealed it was correct for Arizona, which doesn’t make sense because, during this time of year, Arizona is offset by 1 hour behind Mountain Time. Opening the clock revealed why: DST was not checked for mountain:
image
In fact, the time zone did not matter at all; as long as the DST option is not checked, the application would crash. Checking this option or setting the time zone to Arizona resolved the problem. In the case of the Arizona Time Zone, this does not matter since Arizona doesn’t use DST at all and the option is not available.

As for the dump I had captured previously, this clue also revealed itself in the first parameter of the second frame right before the exception:

STACK_TEXT: 
0012f470 2d0efb7a e06d7363 00000001 00000003 kernel32!RaiseException+0x53
WARNING: Stack unwind information not available. Following frames may be wrong.
0012f4b0 2d07f114 0012f4f8 2d171798 00000000 BHXMLDatabase!CXMLParser::GetOutputString+0x56e0a
0012f5fc 2d007938 0012f68c 0012f674 0012f680 BHXMLDatabase!CXMLParser::CXMLParser+0x1734
0012f6d8 7c91005d 2d0eff42 00f50000 00000000 BHXMLDatabase!CBHDatabase::GetRootDataFolder+0x4128
0012f794 2d006c0f 2d1ccd10 0308da20 021e60ba ntdll!RtlFreeHeap+0x647
0012f7b0 2d008e3a 0012f7d4 00000000 0308da40 BHXMLDatabase!CBHDatabase::GetRootDataFolder+0x33ff
0012f7e4 2d0118f0 0012f81c 021e60ba 0308da2c BHXMLDatabase!CBHDatabase::GetRootDataFolder+0x562a
00000000 00000000 00000000 00000000 00000000 BHXMLDatabase!CBHReplication::operator=+0x980

0:000> du 0012f4f8
0012f4f8  ".."
0:000> du
0012f4fe  ""
0:000>
0:000>

0012f544  "Mountain Standard Time"
0:000>
0012f572  ""
0:000>
0012f574  ""
0:000>
0012f576  ""

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: