An application does not start, or crashes, yet no Application Error event ID 1000 is logged

Products

• Symantec Products

Issue/Introduction

An application does not start, or crashes, yet no Application Error event ID 1000 is logged in the Windows Application log. You would like to know why the application is not starting or crashing and what may be done to remedy it.

Environment

Any application, on any version of Windows.

Cause

When an exception is raised in an application, its exception handler may correct or ignore the condition, rather than allow a failure to propagate up through intervening layers. This is very useful in scenarios where partial failures are expected and it is not desirable to fail an entire operation just because one of several optional parts failed. This exception is called a "first-chance exception", as the application first gets a chance to handle the exception through its exception handler. As a simple example, a console application may allow to enter Y or N in response to a question, but what if the user enters any other character? If the programmer would not take this possible exception into account, the application would crash. More often than not, an application will succesfully handle such an exception (if that were not the case, applications would be crashing all the time).

If an application is unable to handle an exception, whether by error of its own or through outside interference (e.g. injection of a Symantec user-mode component), it will crash. If a debugger (WinDBG, DebugDiag, ProcDump, etc.) is attached to the application, it will be given a second chance to deal with the exception (typically, by saving a memory dump, which will allow further investigation). Hence, the name "second-chance exception".

If an application is either not starting, or crashes, and no Application Error event ID 1000 is logged in the Windows Application log, then it is usually a result of a first-chance exception.

Resolution

If available, update the application to the latest version to determine whether or not the issue has since been fixed. If the issue continues to occur with the latest version available, generate a dump of the first-chance exception that resulted in the process' termination:

1. Download and extract https://download.sysinternals.com/files/Procdump.zip to C:\Windows.
2. Prior to attempting to start the application, run the command procdump -ma -e 1 -t -w <process> (replace <process> with the excecutable name, e.g. notepad.exe) to wait for the specified process to start and create a first-chance exception dump on process termination.

For further investigation, contact the application vendor (which may or may not be Symantec) and provide them with this dump, along with a Process Monitor trace, which can be generated in the following way:

1. Download and extract https://download.sysinternals.com/files/ProcessMonitor.zip.
2. Start Process Monitor. When the Process Monitor Filter pop-up window appears, click on the Reset button, then Apply and OK. 
3. In the File menu, press Ctrl-E, then Ctrl-X to stop the capture and clear the display. 
4. In the Filter menu, make sure Enable Advanced Output is ticked. Press Ctrl-E again to start capturing. 
5. Reproduce the issue.
6. Return to the Process Monitor window and press Ctrl-E to stop capturing. Press Ctrl-S and select to save All events in the Native Process Monitor Format (PML).
7. Zip the saved PML file.