From: Lars Uffmann on
R�diger Ranft wrote:
> You can examine the dependencies of your program with the Microsoft
> "dependency walker". Look for errors in the output, and which dll causes

Will
http://www.dependencywalker.com/
do the trick? I didn't know Microsoft had it's own...

Dependency Walker output:
------------
Started "SAMPLEMINIMAL.EXE" (process 0xF74) at address 0x00400000.
Successfully hooked module.
Loaded "NTDLL.DLL" at address 0x7C900000. Successfully hooked module.
Loaded "KERNEL32.DLL" at address 0x7C800000. Successfully hooked module.
DllMain(0x7C900000, DLL_PROCESS_ATTACH, 0x00000000) in "NTDLL.DLL" called.
DllMain(0x7C900000, DLL_PROCESS_ATTACH, 0x00000000) in "NTDLL.DLL"
returned 1 (0x1).

[..left out some other successful loads..]

Loaded "SHLWAPI.DLL" at address 0x77F60000. Successfully hooked module.
Second chance exception 0xC0000005 (Access Violation) occurred in
"NTDLL.DLL" at address 0x7C966668.
Exited "SAMPLEMINIMAL.EXE" (process 0xF74) with code -1073741819
(0xC0000005).
-------------

I'll google somewhat on that, however if anyone knows more about this,
please feel free to enlighten me...

> them. 0xc0000005 is likely related to either a missing execute right in
> the NTFS ACL of the dll, or a damaged dll manifest (either resource or
> .dll.manifest file). You can try to execute the program in Windows 2000.
> If the program works in W2K it is very likely a manifest problem, since
> the manifest resources are introduced win XP.

Virtual Machine 4tw... will try to get my hands on a copy of W2K.

Best Regards,

Lars
From: Lars Uffmann on
I have done some more profiling, found out that I did not log "first
chance exceptions" so far - possibly the error cause is in the first
chance exception?

-------------------
Started "SAMPLEMINIMALDEBUG.EXE" (process 0x7D8) at address 0x00400000
by thread 1. Successfully hooked module.
Loaded "NTDLL.DLL" at address 0x7C900000 by thread 1. Successfully
hooked module.

[...]

First chance exception 0xC0000005 (Access Violation) occurred in
"NTDLL.DLL" at address 0x7C919136 by thread 1.
First chance exception 0xC0000005 (Access Violation) occurred in
"NTDLL.DLL" at address 0x7C966668 by thread 1.
Second chance exception 0xC0000005 (Access Violation) occurred in
"NTDLL.DLL" at address 0x7C966668 by thread 1.
Exited "SAMPLEMINIMALDEBUG.EXE" (process 0x7D8) with code -1073741819
(0xC0000005) by thread 1.
------------------

This leads to address 0x19136 within ntdll.dll, being within function
RtlGetUserInfoHeap (entry point 0x18fa9)
at position 0x18fa9+0x18d (397 dec.)

Just to add some more info....