Why is ntdll.dll crashing my c++ executable?

Question

I am having trouble to get a Visual C++ executable to work, the app crashes , here is what I have seen in the event viewer.

Faulting application name: submit.exe, version: 0.0.0.0, time stamp: 0x50a3cce7
Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58
Exception code: 0xc0000374
Fault offset: 0x000ce653
Faulting process id: 0x8fc
Faulting application start time: 0x01cdc2a3da4f2997
Faulting application path: c:\submit.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 1813823a-2e97-11e2-8675-000c29229191

The executable compiled in old versions of Visual Studio work but I get the error with the executable compiled with newer VS like 2008 or 2010. please advice

Pyemia

It's almost certainly not ntdll.dll crashing your executable. It's most likely your program having some undefined behavior that was previously masked, and some otherwise trivial change in compiler or library happened to allow the problem to become visible. You really need to trace back to what your app was doing at the time to find the problem though. – Byrom

the problem is its 3,000 lines of codes I can't tell where in the program there is a flaw. If someone could point me to the right direction. – Pyemia

First, build your code with debugging information and run it under a debugger. That will (usually, anyway) let you stop it and see what's going on when it crashes, and probably get a stack trace to figure out what part of your code did what that led up to the crash. – Byrom

Exception code 0xC0000374 means STATUS_HEAP_CORRUPTION. It is the most common way to crash a C++ program. – Vadnee

You fix it by running it in debug mode under a debugger... – Tiros

Answer 1

Troubleshooting this type of problem can be a real challenge... particularly when you are not familiar with the code base.

Consider using the Application Verifier in conjunction with the Visual Studio debugger.

1. Start Visual Studio and compile your application
2. Start the application Verifier utility.
3. File => Add Application
4. Select the appropriate Tests (e.g. heaps, exceptions,...)
5. Use Visual Studio Debug to start your application.

When something bad happens... your debugger will stop. This should give you a pretty good idea of the source of the problem.

Also, it might help to load the missing symbols before starting your test. In Visual Studio 2012, you can do this by: Debug => Options and Settings => Debugging => Symbols => Load all symbols.

Good luck!

REFERENCES

• MSDN: "Application Verifier" article
• Download: Application Verifier
  • Previously this application was available as a separate download: here
    • This download is no longer available.
  • The application is now included with the Windows SDK. (previously known as Platfrom SDK)
  • Be mindful that you may have two versions installed:
    • C:\Windows\SysWOW64\appverif.exe [32 bit version]
    • C:\Windows\System32\appverif.exe [64 bit version]
• TechNet: Two Minute Drill: Application Verifier

UPDATE: July 2015

When you are done, be sure to disable the AppVerfier checks that you enabled... otherwise you may experience some unexpected side-effects 6 months down the road when you have forgotten about AppVerifier.

Grefe

Just used this approach to troubleshoot heap corruption in ntdll.dll when running mstsc.exe. Turned out it was a third-party bluetooth stack that caused that, and Application Verifier helped me catch it. – Mccallister

I'm new to Application Verifier. On the first line it tells me "VERIFIER STOP 00000900: pid 0x136C: A heap allocation was leaked. " "0BA92FE8 : Address of the leaked allocation. Run !heap -p -a <address> to get additional information about the allocation." This line above. it says "Run" where do I run this command? I have never messed with these commands I'm sorry if it's a noob question. I assume it was in Command Line or something? I've never seen that command style anywhere else. – Rigger

I just experienced the nightmare yesterday. Without doing this (disable apps that you enabled...), you will waste lots of time to investigate.. it crashes over and over again even you reinstall it. – Matchmark

Link to download application verifier is dead – Yungyunick

For win10 : developer.microsoft.com/en-us/windows/downloads/windows-10-sdk ; Archive: developer.microsoft.com/windows/downloads/sdk-archive – Seko