Introduction

One easy way to make a program more robust is to put a try block around code that causes crashes, catch all exceptions and continue the program as if nothing happened. This works like charm and with a little luck the deflected Access Violation meteor is hitting areas of your heap that isn't too important at the moment.

Figure 1: Meteor crater in Arizona

Detecting bad first chance exceptions

There is an easy way for anyone to look at exceptions that happened during program execution and that get handled without causing any sign of problem. These exceptions are called first chance exceptions. Microsoft provides a free set of tools for Windows that can be downloaded here: Debugging Tools for Windows

Once the Debugging Tools are installed on your system you can attach the debugger to your process of choice and start logging first chance exceptions into a text file.

ADPlus configuration file

The Debugging Tools ship with a VB Script called ADPlus.vbs that launches the debugger and configures it by providing the appropriate command line parameters. The values for these parameters can be defined in an ADPlus configuration file.

Here is an example configuration file:

   1: <ADPlus>

   2:  

   3:     <!--

   4: 

   5:     Configuring ADPlus to log and list the stack for only first chance AVs

   6:     Will still create full dump for any type of second chance exceptions

   7: 

   8:     To define an output directory uncomment the line in the Settings section

   9:       changing the directory to the one you want to use

  10: 

  11:     -->

  12:  

  13:   <Settings>

  14:       <RunMode> CRASH </RunMode>

  15:       <OutputDir> c:\Dumps </OutputDir>

  16:       <ProcessName> notepad.exe </ProcessName>   

  17:   </Settings>

  18:   <Exceptions>

  19:      <Config>

  20:        <Code>AllExceptions</Code>

  21:        <Actions1> Log;Stacks; </Actions1>

  22:        <Actions2> FullDump;Log;Stacks; </Actions2>

  23:      </Config>

  24:   </Exceptions>

  25: </ADPlus>

Just replace the name of the process with the name of your application and you are ready to go. In this example I am logging first chance exceptions of notepad.exe.

Launch and attach the debugger

Run the following command from the CMD command prompt to attach the debugger. I added a batch file to the zip archive that can be downloaded from the download section of this post.

   1: ADPlus -quiet -c ADPlusLogFirstChance.cfg

What catches to look out for

After you attached the debugger, just run the program you are testing as usual. Later analyze the results of your test run by examining the debugger log files. Here is a screen shot of the files that the debugger generated.

Figure 2: ADPlus debugging log files

Here is a short list of bullet items that should make you suspicious:

• First chance Access Violations are in 99% of the cases evil and should not be ignored by just continuing the program 
• Exceptions that get thrown every 10 ms are usually not good either, because they will have a significant performance impact
• Exceptions that you didn't expect are worth looking into as well

Resources

More information about ADPlus can be found here: KB286350 - How to use ADPlus to troubleshoot Hangs and Crashes

Download

The files mentioned in this post can be downloaded here: LogFirstChanceExceptions.zip

Ausblick

I hope this information will help improving the quality of software. Filtering out evil first chance exceptions can be completely automated. Now you have a low cost tool that might catch a few serious bugs before they go wild at a customer's system.