How do I determine the name of the missing entry point in an exception handler?
Stephane Barizien
get the name of the offending DLL and of the missing entry point?
Ben Voigt [C++ MVP]
Under what conditions can that value reach an exception handler?
Raymond Chen explains that you see that as a process exit code, which often
are created from unhandled exceptions, but load-time imports are processed
before you get a chance to set up your exception handlers. LoadLibrary
would SetLastError instead of throwing an exception. Is it an attached
debugger receiving the exception? Or are you using delay-load?
Stephane Barizien
OK, apologies for not having given enough context.
The question pertains to a shell-style program that launches other commands
using CreateProcess() and needs to report why the CreateProcess() fails with
as much detail as possible.
Heavily borrowing code from koders.com (search for ldd.c) I was able to
create a
thingie that knows how to tell me if a DLL is missing and what DLL, but not
what entry point is missing if the DLL is present but an entry point cannot
be found:
$ ldd.exe -v m:/tmp/mks/missingdll/Debug/missingdll.exe
ntdll.dll => ntdll.dll (0x7c900000)
kernel32.dll => G:\WINDOWS\system32\kernel32.dll (0x7c800000)
code: c0000135, flags:1, params: 0, addr: 7c964ed1
TheDLL.dll => ?
KERNEL32.dll => G:\WINDOWS\system32\KERNEL32.dll
ntdll.dll => G:\WINDOWS\system32\ntdll.dll
$ ldd.exe -v m:/tmp/mks/missingentrypoint/Debug/missingentrypoint.exe
ntdll.dll => ntdll.dll (0x7c900000)
kernel32.dll => G:\WINDOWS\system32\kernel32.dll (0x7c800000)
TheDLL.dll => m:\tmp\mks\missingentrypoint\Debug\TheDLL.dll
(0x10000000)
code: c0000139, flags:1, params: 0, addr: 7c964ed1
Missing entry point in DLL!
Here's the related code snippet:
case EXCEPTION_DEBUG_EVENT:
{
EXCEPTION_RECORD *ex=&de->u.Exception.ExceptionRecord;
if (ex->ExceptionCode==EXCEPTION_BREAKPOINT && !opt_continous)
return 0;
printf("code: %x, flags:%x, params: %x, addr:
%x\n",ex->ExceptionCode,
ex->ExceptionFlags,
ex->NumberParameters,
ex->ExceptionAddress
);
if (ex->ExceptionCode==0xc0000135) walk_dependencies(cmdline);
if (ex->ExceptionCode==0xc0000139)
{
printf("Missing entry point in DLL!\n");
}
if (ex->ExceptionFlags==EXCEPTION_NONCONTINUABLE) return 0;
}
}
Stephane Barizien
OK, apologies for not having given enough context.
roge...@gmail.com
<steNphOane.SbarPiz...@oAcMe.com> wrote:
> Stephane Barizien wrote:
> When I get an STATUS_ENTRYPOINT_NOT_FOUND (0xC0000139) exception,
> how do I get the name of the offending DLL and of the missing entry
> point?
You could try depends.exe (part of various MS products, eg Visual
Studio)
This can run in console mode writing output to a file.
Example:
depends /c /of:output.txt missingentrypoint.exe
grep "\[.*E.*\]" output.txt
[Note that you may get some false positives as missing
delay load entry points may be being handled in code.]
Alternatively you could write the code yourself and
have control over
(a) the output
and
(b) shipping the program [it's not redistibutable]
The PE format is documented and for your needs you
probably don't need to process the delayed load entries.
Regards,
Roger.
Sam Hobbs
news:OWUOXJ1...@TK2MSFTNGP05.phx.gbl...
>
> Heavily borrowing code from koders.com (search for ldd.c) I was able to
> create a
> thingie that knows how to tell me if a DLL is missing and what DLL, but
> not
> what entry point is missing if the DLL is present but an entry point
> cannot
> be found:
I think you have cross-posted to too many groups.
If you can use the data that Depends shows, except you need to gather the
data in your program, then there is one or more articles you need. There are
atricles about the PE format in a magazine such as the MSJ magazine or the
MSDN magazine. I am nearly sure that the old articles shows code that is now
part of Depends.
I know for example that by using that code, it is possible to determine
(and/or update) what DLLs are loaded for a exe. This is one way to inject a
DLL into another process.