From: Neeti on
Our MFC dialog based Installer application shows error loading
“newdev.dll” after Windows SP3 service pack is installed and also
after update with IE8 and Security updates for windows.

GetLastError() reveals error code 998 (ERROR_NOACCESS)

As suggested in the thread from Microsoft http://support.microsoft.com/kb/q196069/
I tried to get the stack trace to trace the issue using “user mode
dump process and WinDbg”.

Since its windows system DLL I have limited clue to the issue. Please
help.

Further info

1. I tried loading the “newdev.dll” from the small “console
application” and another small “MFC dialog based application”, on the
same machine, DLL could load successfully, but from the installer it
could not load. Is that some access permissions are required???
2. Our installer “GsiInst.exe” loads a DLL “GsiInst.dll” which further
loads the “newdev.dll”.
3. Before the security updates and IE8 update application worked fine.


Here is the dump…


WinDbg Dump

(fd4.ae4): Access violation - code c0000005 (first/second chance not
available)
eax=77606034 ebx=00000000 ecx=00000000 edx=7c90e514 esi=00000000
edi=78130000
eip=774fd070 esp=0012efa0 ebp=0012efa8 iopl=0 nv up ei pl zr
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010246
ole32!CoTaskMemAlloc+0x10:
774fd070 ff510c call dword ptr [ecx+0Ch] ds:
0023:0000000c=????????
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for kernel32.dll -
*** WARNING: Unable to verify checksum for GsiInst.dll


Call Stack

ChildEBP RetAddr
0012efa8 781331a7 ole32!CoTaskMemAlloc+0x10
WARNING: Stack unwind information not available. Following frames may
be wrong.
0012efb8 7813de38 urlmon!DllCanUnloadNow+0x16c3
0012efd8 78131cbb urlmon!CoInternetParseIUri+0x2338
0012f038 7c90118a urlmon!DllCanUnloadNow+0x1d7
0012f058 7c91c4fa ntdll!LdrInitializeThunk+0x24
0012f160 7c916371 ntdll!LdrFindResourceDirectory_U+0x28d
0012f40c 7c9164d3 ntdll!RtlValidateUnicodeString+0x507
0012f6b4 7c801bbd ntdll!LdrLoadDll+0x110
0012f71c 7c801d72 kernel32!LoadLibraryExW+0xc8
0012f730 7c801da8 kernel32!LoadLibraryExA+0x1f
0012f74c 1001604d kernel32!LoadLibraryA+0x2d
0012f8b0 10015f0e GsiInst_10000000!CSetupApi::loadDll+0x7d [d:\project
\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 102]
0012f910 10015d42 GsiInst_10000000!CSetupApi::CSetupApi+0x11e [d:
\project\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 67]
0012f964 10015cfd GsiInst_10000000!$E41+0x22 [d:\project\cvs\pcdrivers
\windows\installer\gsiinst\setupapi.cpp @ 20]
0012f9b8 10025dc8 GsiInst_10000000!$E44+0x1d
0012f9c0 10025c13 GsiInst_10000000!_initterm+0x18 [crt0dat.c @ 525]
0012f9d0 1001f316 GsiInst_10000000!_cinit+0x33 [crt0dat.c @ 192]
0012f9d8 1001f402 GsiInst_10000000!_CRT_INIT+0xb6 [dllcrt0.c @ 136]
0012f9f0 7c90118a GsiInst_10000000!_DllMainCRTStartup+0x62 [dllcrt0.c
@ 231]
0012fa10 7c91c4fa ntdll!LdrInitializeThunk+0x24
From: Jim on


http://www.dll-files.com/dllindex/dll-files.shtml?newdev





On Wed, 6 Jan 2010 23:53:55 -0800 (PST), Neeti <navs.kaur(a)gmail.com>
wrote:

>Our MFC dialog based Installer application shows error loading
>�newdev.dll� after Windows SP3 service pack is installed and also
>after update with IE8 and Security updates for windows.
>
>GetLastError() reveals error code 998 (ERROR_NOACCESS)
>
>As suggested in the thread from Microsoft http://support.microsoft.com/kb/q196069/
>I tried to get the stack trace to trace the issue using �user mode
>dump process and WinDbg�.
>
>Since its windows system DLL I have limited clue to the issue. Please
>help.
>
>Further info
>
>1. I tried loading the �newdev.dll� from the small �console
>application� and another small �MFC dialog based application�, on the
>same machine, DLL could load successfully, but from the installer it
>could not load. Is that some access permissions are required???
>2. Our installer �GsiInst.exe� loads a DLL �GsiInst.dll� which further
>loads the �newdev.dll�.
>3. Before the security updates and IE8 update application worked fine.
>
>
>Here is the dump�
>
>
>WinDbg Dump
>
>(fd4.ae4): Access violation - code c0000005 (first/second chance not
>available)
>eax=77606034 ebx=00000000 ecx=00000000 edx=7c90e514 esi=00000000
>edi=78130000
>eip=774fd070 esp=0012efa0 ebp=0012efa8 iopl=0 nv up ei pl zr
>na pe nc
>cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
>efl=00010246
>ole32!CoTaskMemAlloc+0x10:
>774fd070 ff510c call dword ptr [ecx+0Ch] ds:
>0023:0000000c=????????
>*** ERROR: Symbol file could not be found. Defaulted to export
>symbols for kernel32.dll -
>*** WARNING: Unable to verify checksum for GsiInst.dll
>
>
>Call Stack
>
>ChildEBP RetAddr
>0012efa8 781331a7 ole32!CoTaskMemAlloc+0x10
>WARNING: Stack unwind information not available. Following frames may
>be wrong.
>0012efb8 7813de38 urlmon!DllCanUnloadNow+0x16c3
>0012efd8 78131cbb urlmon!CoInternetParseIUri+0x2338
>0012f038 7c90118a urlmon!DllCanUnloadNow+0x1d7
>0012f058 7c91c4fa ntdll!LdrInitializeThunk+0x24
>0012f160 7c916371 ntdll!LdrFindResourceDirectory_U+0x28d
>0012f40c 7c9164d3 ntdll!RtlValidateUnicodeString+0x507
>0012f6b4 7c801bbd ntdll!LdrLoadDll+0x110
>0012f71c 7c801d72 kernel32!LoadLibraryExW+0xc8
>0012f730 7c801da8 kernel32!LoadLibraryExA+0x1f
>0012f74c 1001604d kernel32!LoadLibraryA+0x2d
>0012f8b0 10015f0e GsiInst_10000000!CSetupApi::loadDll+0x7d [d:\project
>\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 102]
>0012f910 10015d42 GsiInst_10000000!CSetupApi::CSetupApi+0x11e [d:
>\project\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 67]
>0012f964 10015cfd GsiInst_10000000!$E41+0x22 [d:\project\cvs\pcdrivers
>\windows\installer\gsiinst\setupapi.cpp @ 20]
>0012f9b8 10025dc8 GsiInst_10000000!$E44+0x1d
>0012f9c0 10025c13 GsiInst_10000000!_initterm+0x18 [crt0dat.c @ 525]
>0012f9d0 1001f316 GsiInst_10000000!_cinit+0x33 [crt0dat.c @ 192]
>0012f9d8 1001f402 GsiInst_10000000!_CRT_INIT+0xb6 [dllcrt0.c @ 136]
>0012f9f0 7c90118a GsiInst_10000000!_DllMainCRTStartup+0x62 [dllcrt0.c
>@ 231]
>0012fa10 7c91c4fa ntdll!LdrInitializeThunk+0x24
From: Andrew McLaren on
Actually, newdev.dll is part of Windows itself (it detetcs new PnP
devices) so it is not a good solution to go replacing the canonical
Microsoft-supplied file with random downloads from the web. I suspect
the download is simply the pre-SP3 version of the DLL.

Neeti, another way to get some insights into you app's behaviour would
be to run it under Microsoft's SysInternals Process Monitor. this will
show you all the file and registry access which the process makes, and
may reveal some unexpected behaviour under the covers. Get process
monitor from www.sysinternals.com (it's actually a Microsoft website).

Any permissions error will appear in ProcMon, so this might help isolate
the problem.

When LoadLibrary fails, it returns a NULL and sets GetLastEroor to 998 -
I'd guess that the NULL ended up in ecx, which is why teh final
instruction "all dcword ptr [ecx+0Ch]" failed. URLMon thought it was
calling some function but was going to an invalid address!

You might also want to add the PDB symbols for your GSIinst process to
WinDBG, so that you'll get the full stack.. As you can see the stack is
slightly munged and perhaps missing vital clues.

Hope it helps a bit ...

Andrew

--
amclar at optusnet dot com dot au



Jim wrote:
>
> http://www.dll-files.com/dllindex/dll-files.shtml?newdev
>
>
>
>
>
> On Wed, 6 Jan 2010 23:53:55 -0800 (PST), Neeti <navs.kaur(a)gmail.com>
> wrote:
>
>> Our MFC dialog based Installer application shows error loading
>> �newdev.dll� after Windows SP3 service pack is installed and also
>> after update with IE8 and Security updates for windows.
>>
>> GetLastError() reveals error code 998 (ERROR_NOACCESS)
>>
>> As suggested in the thread from Microsoft http://support.microsoft.com/kb/q196069/
>> I tried to get the stack trace to trace the issue using �user mode
>> dump process and WinDbg�.
>>
>> Since its windows system DLL I have limited clue to the issue. Please
>> help.
>>
>> Further info
>>
>> 1. I tried loading the �newdev.dll� from the small �console
>> application� and another small �MFC dialog based application�, on the
>> same machine, DLL could load successfully, but from the installer it
>> could not load. Is that some access permissions are required???
>> 2. Our installer �GsiInst.exe� loads a DLL �GsiInst.dll� which further
>> loads the �newdev.dll�.
>> 3. Before the security updates and IE8 update application worked fine.
>>
>>
>> Here is the dump�
>>
>>
>> WinDbg Dump
>>
>> (fd4.ae4): Access violation - code c0000005 (first/second chance not
>> available)
>> eax=77606034 ebx=00000000 ecx=00000000 edx=7c90e514 esi=00000000
>> edi=78130000
>> eip=774fd070 esp=0012efa0 ebp=0012efa8 iopl=0 nv up ei pl zr
>> na pe nc
>> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
>> efl=00010246
>> ole32!CoTaskMemAlloc+0x10:
>> 774fd070 ff510c all dcword ptr [ecx+0Ch] ds:
>> 0023:0000000c=????????
>> *** ERROR: Symbol file could not be found. Defaulted to export
>> symbols for kernel32.dll -
>> *** WARNING: Unable to verify checksum for GsiInst.dll
>>
>>
>> Call Stack
>>
>> ChildEBP RetAddr
>> 0012efa8 781331a7 ole32!CoTaskMemAlloc+0x10
>> WARNING: Stack unwind information not available. Following frames may
>> be wrong.
>> 0012efb8 7813de38 urlmon!DllCanUnloadNow+0x16c3
>> 0012efd8 78131cbb urlmon!CoInternetParseIUri+0x2338
>> 0012f038 7c90118a urlmon!DllCanUnloadNow+0x1d7
>> 0012f058 7c91c4fa ntdll!LdrInitializeThunk+0x24
>> 0012f160 7c916371 ntdll!LdrFindResourceDirectory_U+0x28d
>> 0012f40c 7c9164d3 ntdll!RtlValidateUnicodeString+0x507
>> 0012f6b4 7c801bbd ntdll!LdrLoadDll+0x110
>> 0012f71c 7c801d72 kernel32!LoadLibraryExW+0xc8
>> 0012f730 7c801da8 kernel32!LoadLibraryExA+0x1f
>> 0012f74c 1001604d kernel32!LoadLibraryA+0x2d
>> 0012f8b0 10015f0e GsiInst_10000000!CSetupApi::loadDll+0x7d [d:\project
>> \cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 102]
>> 0012f910 10015d42 GsiInst_10000000!CSetupApi::CSetupApi+0x11e [d:
>> \project\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 67]
>> 0012f964 10015cfd GsiInst_10000000!$E41+0x22 [d:\project\cvs\pcdrivers
>> \windows\installer\gsiinst\setupapi.cpp @ 20]
>> 0012f9b8 10025dc8 GsiInst_10000000!$E44+0x1d
>> 0012f9c0 10025c13 GsiInst_10000000!_initterm+0x18 [crt0dat.c @ 525]
>> 0012f9d0 1001f316 GsiInst_10000000!_cinit+0x33 [crt0dat.c @ 192]
>> 0012f9d8 1001f402 GsiInst_10000000!_CRT_INIT+0xb6 [dllcrt0.c @ 136]
>> 0012f9f0 7c90118a GsiInst_10000000!_DllMainCRTStartup+0x62 [dllcrt0.c
>> @ 231]
>> 0012fa10 7c91c4fa ntdll!LdrInitializeThunk+0x24
From: Neeti on
Thanks. The issue is fixed. I was calling the LoadLibrary() from the
constructor of the global object. Moving the LoadLibrary out of this
resolved the issue.

Thanks
N
---

On Jan 8, 6:05 am, Andrew McLaren <m...(a)somewhere.com> wrote:
> Actually, newdev.dll is part of Windows itself (it detetcs new PnP
> devices) so it is not a good solution to go replacing the canonical
> Microsoft-supplied file with random downloads from the web. I suspect
> the download is simply the pre-SP3 version of the DLL.
>
> Neeti, another way to get some insights into you app's behaviour would
> be to run it under Microsoft's SysInternals Process Monitor. this will
> show you all the file and registry access which the process makes, and
> may reveal some unexpected behaviour under the covers. Get process
> monitor fromwww.sysinternals.com(it's actually a Microsoft website).
>
> Any permissions error will appear in ProcMon, so this might help isolate
> the problem.
>
> When LoadLibrary fails, it returns a NULL and sets GetLastEroor to 998 -
> I'd guess that the NULL ended up in ecx, which is why teh final
> instruction "all    dcword ptr [ecx+0Ch]" failed. URLMon thought it was
> calling some function but was going to an invalid address!
>
> You might also want to add the PDB symbols for your GSIinst process to
> WinDBG, so that you'll get the full stack.. As you can see the stack is
> slightly munged and perhaps missing vital clues.
>
> Hope it helps a bit ...
>
> Andrew
>
> --
> amclar at optusnet dot com dot au
>
>
>
> Jim wrote:
>
> >http://www.dll-files.com/dllindex/dll-files.shtml?newdev
>
> > On Wed, 6 Jan 2010 23:53:55 -0800 (PST), Neeti <navs.k...(a)gmail.com>
> > wrote:
>
> >> Our MFC dialog based Installer application shows error loading
> >> “newdev.dll” after Windows SP3 service pack is installed and also
> >> after update with IE8 and Security updates for windows.
>
> >> GetLastError() reveals error code 998 (ERROR_NOACCESS)
>
> >> As suggested in the thread from Microsofthttp://support.microsoft.com/kb/q196069/
> >> I tried to get the stack trace to trace the issue using “user mode
> >> dump process and WinDbg”.
>
> >> Since its windows system DLL I have limited clue to the issue. Please
> >> help.
>
> >> Further info
>
> >> 1. I tried loading the “newdev.dll” from the small “console
> >> application” and another small “MFC dialog based application”, on the
> >> same machine, DLL could load successfully, but from the installer it
> >> could not load. Is that some access permissions are required???
> >> 2. Our installer “GsiInst.exe” loads a DLL “GsiInst.dll” which further
> >> loads the “newdev.dll”.
> >> 3. Before the security updates and IE8 update application worked fine.
>
> >> Here is the dump…
>
> >> WinDbg Dump
>
> >> (fd4.ae4): Access violation - code c0000005 (first/second chance not
> >> available)
> >> eax=77606034 ebx=00000000 ecx=00000000 edx=7c90e514 esi=00000000
> >> edi=78130000
> >> eip=774fd070 esp=0012efa0 ebp=0012efa8 iopl=0         nv up ei pl zr
> >> na pe nc
> >> cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
> >> efl=00010246
> >> ole32!CoTaskMemAlloc+0x10:
> >> 774fd070 ff510c          all    dcword ptr [ecx+0Ch]  ds:
> >> 0023:0000000c=????????
> >> *** ERROR: Symbol file could not be found.  Defaulted to export
> >> symbols for kernel32.dll -
> >> *** WARNING: Unable to verify checksum for GsiInst.dll
>
> >> Call Stack
>
> >> ChildEBP RetAddr
> >> 0012efa8 781331a7 ole32!CoTaskMemAlloc+0x10
> >> WARNING: Stack unwind information not available. Following frames may
> >> be wrong.
> >> 0012efb8 7813de38 urlmon!DllCanUnloadNow+0x16c3
> >> 0012efd8 78131cbb urlmon!CoInternetParseIUri+0x2338
> >> 0012f038 7c90118a urlmon!DllCanUnloadNow+0x1d7
> >> 0012f058 7c91c4fa ntdll!LdrInitializeThunk+0x24
> >> 0012f160 7c916371 ntdll!LdrFindResourceDirectory_U+0x28d
> >> 0012f40c 7c9164d3 ntdll!RtlValidateUnicodeString+0x507
> >> 0012f6b4 7c801bbd ntdll!LdrLoadDll+0x110
> >> 0012f71c 7c801d72 kernel32!LoadLibraryExW+0xc8
> >> 0012f730 7c801da8 kernel32!LoadLibraryExA+0x1f
> >> 0012f74c 1001604d kernel32!LoadLibraryA+0x2d
> >> 0012f8b0 10015f0e GsiInst_10000000!CSetupApi::loadDll+0x7d [d:\project
> >> \cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 102]
> >> 0012f910 10015d42 GsiInst_10000000!CSetupApi::CSetupApi+0x11e [d:
> >> \project\cvs\pcdrivers\windows\installer\gsiinst\setupapi.cpp @ 67]
> >> 0012f964 10015cfd GsiInst_10000000!$E41+0x22 [d:\project\cvs\pcdrivers
> >> \windows\installer\gsiinst\setupapi.cpp @ 20]
> >> 0012f9b8 10025dc8 GsiInst_10000000!$E44+0x1d
> >> 0012f9c0 10025c13 GsiInst_10000000!_initterm+0x18 [crt0dat.c @ 525]
> >> 0012f9d0 1001f316 GsiInst_10000000!_cinit+0x33 [crt0dat.c @ 192]
> >> 0012f9d8 1001f402 GsiInst_10000000!_CRT_INIT+0xb6 [dllcrt0.c @ 136]
> >> 0012f9f0 7c90118a GsiInst_10000000!_DllMainCRTStartup+0x62 [dllcrt0.c
> >> @ 231]
> >> 0012fa10 7c91c4fa ntdll!LdrInitializeThunk+0x24- Hide quoted text -
>
> - Show quoted text -