up vote 4 down vote favorite
share [g+] share [fb]

I have an auto-run application that says:

enter image description here

So, I go on and debug it and see:

(df0.c2c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
006a75ba cc              int     3

Which still doesn't say much, so I am walking the stack to check if there is more information:

0:000:x86> dda esp
0018fdc4  006851cc "..u.j...]g"
0018fdc8  023dcd38 "..g"
0018fdcc  0018fdf4 "..."
0018fdd0  006a7701 "3.ZYYd.....X........_^[]."
0018fdd4  006a771c "Protection Error"
0018fdd8  023dcc80 "Debugger detected  - please close it down and restart!."

Which tells me that a debugger has been detected, but which one...

Is there an easy way to discover this?

Things tried:

  • Process Monitor trace doesn't reveal anything containing Debug and reading through it I see nothing.
  • I do not have Divx or Nero installed.

Because this is buried so deep, I suspect this could also be other software that has this protection...

link|improve this question
98% accept rate
Is this Vista? What are you trying to auto-run? I'm guessing an installer on a disk, but for which software? – techie007 Jun 1 '11 at 15:22
@techie007: Solved, that information is irrelevant as I've wanted a more general way to troubleshoot these kind of messages because it's not the first time I see such message. But yes, I was installing software for video capturing from a CD... – Tom Wijsman Jun 1 '11 at 15:24
feedback

2 Answers

up vote 3 down vote accepted

DEP seems to be interpreted as a debugger, solved...

enter image description here

link|improve this answer
feedback
up vote 2 down vote

In Windows previous to Vista the default debugger was Dr. Watson, these days it just seems to be an unnamed part of the larger "Windows Error Reporting" services.

DEP is not a debugger, it is a security feature to prevent data execution from memory space that's not marked as executable (to prevent buffer-overflows from being used for code execution).

The odds are it's DEP that's causing the program to crash because it (the program) is incorrectly trying to access memory that's not marked as executable, so DEP correctly prevents it and the program doesn't know how to deal with being prevented, so it crashes.

You excluded the program from DEP, so it allows the memory to be (unsafely) read.

Hauppage has some Vista information and drivers here that may help with this one specific embodiment you're running into.

Also: I think the "Protection Error" and "Debugger detected - please close it down and restart!" messages may be the Hauppage software using anti-piracy techniques, but that's just a guess.

link|improve this answer
Yeah, I've got WinDBG set as my default debugger. DEP is indeed not one but it seems to trigger the error though, it's seen as a hook most likely. Probably anti piracy techniques, but I'm happy DEP solved it... – Tom Wijsman Jun 1 '11 at 18:43
DEP didn't solve anything. It was actually showing you a problem the software has (incorrectly executing code from memory that's not marked as executable). What you did was tell DEP to ignore that program and let it go about accessing memory as it wishes. Just hope nothing malicious comes along and uses that software as a launch point. :) You'd be better off updating the Hauppage software and turning off the DEP exception you made - but hey, it's your computer. ;) – techie007 Jun 1 '11 at 19:23
Can you explain to me how something verified of which I can see the memory access and I have only ran once and that is later inaccessible because it's a CD can be of any harm to my computer? Also note that I'm running DEP with non-default settings, and with this correction I did solve a thing and that entry is now removed. Yes, it's my computer and I'm not running a virus scanner or firewall and I know what I'm doing, never had any problems... ;) – Tom Wijsman Jun 1 '11 at 23:25
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.