process termination C++

Question

I have the following problem: I have an application (server that never ends) written in C++ running as a service containing inside the main thread also 3 threads (mainly doing IO).

In the main loop I CATCH all possible exceptions.

The process terminated and nothing was printed either by the main loop or by the threads themselves. I saw in the event log that the process stopped with code 1000.

1. Does Windows creates Core files like in unix ?
2. If from the event log I get a memory address, is there any way of knowing in which part in the application it occurred?
3. Maybe this is a clue: at the same time that it happened I started another application (not the same type).

Answer 1

Bear in mind that catch(...) does not intercept everything that can go wrong in your code, unless you are using Structured Exception Handling. Eg

#include "stdio.h"
int main(char** argv, int c)
{
  try {
    int this_will_be_zero = (c == 9999);
    int blowup = 1 / this_will_be_zero;
  } catch (...) {
    printf("you won't see this message\n");
  }
}

Answer 2

try to set windbg as the postmortem debugger.

1. install windbg
2. from commandline execute "windbg -I"
3. start you application, then you when your application get an unhandled exception, the windbg will be activated .

4. from windbg use "kb" or "!uniqstack" to see the stacktrace.

   look here for more commands.
   and look here for how to analysis.

and try use SEH:

#include "windows.h"
#include "stdio.h"

DWORD FilterFunction() 
{ 
 printf("you will see this message first.\n");
 return EXCEPTION_EXECUTE_HANDLER; 
} 


int main(char** argv, int c)
{
 __try
 {
  int this_will_be_zero = (c == 9999);
  int blowup = 1 / this_will_be_zero;
 }
 __except ( FilterFunction()) 
 {
  printf("you will see this message\n");
 }

 return 0;
}

Answer 3

You need to use the /EHa compiler switch when building your application in order to catch windows structured exceptions (such as access violation) with the C++ try/catch constructs.

In Visual Studio this is in project properties Configuration Properties -> C/C++ -> Code Generation -> Enable C++ Exceptions. You want "Yes With SEH Exceptions (/EHa)". I remember reading setting this has some significant drawbacks, although I cannot recall what they were exactly.

Link: MSDN on C++ exception handling model

Edit: As whunmr suggests, directly using structured exceptions is probably better idea than /EHa

Answer 4

Does Windows creates Core files like in unix ?

it does not, automatically. however you can enable such a files by either implementing it in your code or by using external application as windbg, or Dr. Watson

If from the event log I get a memory address, is there any way of knowing in which part in the application it occurred?

There is no way if in general, if you don't keep debug information files (pdb)

Maybe this is a clue: at the same time that it happened I started another application (not the same type).

this is not helpful information, unless both of the applications are interacted each other

Answer 5

Windows will whatever program you are using as a debugger depending on the setting in:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
"Auto"="0"
"Debugger"="My_Debugger" -p %ld -e %ld"
"UserDebuggerHotKey"=dword:00000000

You can change My_Debugger to the full path of whatever program/IDE you are using for debugging.

This is often set to Dr Watson which will create a log entry of the crash which is not what you want.