ASM Community

another crash :P

Module name: RadASM (RadASM version 2.0.4.3)
Windows XP Service Pack. 1
Exception code: C0000005h (ACCESS_VIOLATION)
Instruction pointer: 00401239h

eax=0001C543h ebx=00000000h ecx=00000023h
edx=00000001h esi=00204000h edi=001766CCh
ebp=0012EFC4h esp=0012EFBCh eip=00401239h

CS=001Bh DS=0023h SS=0023h
ES=0023h FS=0038h GS=0Flags: IF
Flags: IF
F001Bh DS=0023h SS=0023h
ES=0023h FS=0038h GS=0000h

Stack:
00452B1A 00203FDD 0012EFEC 00401327
0000004D 00000000 00203FDD 00000002
00453666 00000F0A 00203010 00000084
0012F104 004031B6 0000004D 00000000

almost identical to the one above :P

last steps:
i was editing "LINK" parameters, after "APPLY" radasm asked to restart the project. this time all files were saved, so it didnt ask to save. right after i pressed "yes" - stating that i want to reopen the project -- it crashed :P

Hi

The bug happends when RadASM is building its wordlist. Most likely it is project dependant.

AddWordToWordList proc uses esi edi,nType:DWORD,nOwner:DWORD,lpszStr:DWORD,nParts:DWORD



	mov		eax,rpWordListPos

	add		eax,16384

	mov		edi,WordListSize

	.if eax>edi

		add		edi,WRDMEM

		invoke GlobalAlloc,GMEM_MOVEABLE or GMEM_ZEROINIT,edi

		push	eax

		invoke GlobalLock,eax

		push	eax

		push	edi

		mov		esi,lpWordList

		mov		edi,eax

		mov		ecx,WordListSize

		shr		ecx,2

		rep movsd

		pop		edi

		invoke GlobalUnlock,hWordList

		invoke GlobalFree,hWordList

		pop		eax

		mov		lpWordList,eax

		pop		eax

		mov		hWordList,eax

		mov		WordListSize,edi

	.endif

	mov		edi,lpWordList

	add		edi,rpWordListPos

	xor		ecx,ecx

	mov		esi,lpszStr

	.if esi

		mov		edx,nParts

		.while edx

(401239h)		mov		al,[esi]

			.if al==0Dh || al==0Ah

				dec		esi

				xor		al,al

			.elseif al==':' && nType=='S'

				mov		al,VK_TAB

			.endif

			mov		[edi+ecx+sizeof	PROPERTIES],al

			.if !al

				dec		edx

			.endif

			inc		esi

			inc		ecx

		.endw

		mov		eax,nOwner

		mov		[edi].PROPERTIES.Owner,eax

		mov		eax,nType

		mov		[edi].PROPERTIES.nType,al

		mov		[edi].PROPERTIES.nSize,ecx

		lea		edi,[edi+ecx+sizeof	PROPERTIES]

		mov		[edi].PROPERTIES.nSize,0

		sub		edi,lpWordList

		mov		rpWordListPos,edi

		dec		ecx

	.endif

	mov		eax,ecx

	ret



AddWordToWordList endp

Installing OllyDbg as a JIT debugger and disabeling RadASM's exception handler (FlipCase addin) will help
tracking the bug.

KetilO

Hi QS_Ong,

As you can see,
<quote>
Exception code: C0000005h (ACCESS_VIOLATION)
eax=0001C543h ebx=00000000h ecx=00000023h
edx=00000001h esi=00200000h edi=001766CCh
ebp=0012F314h esp=0012F30Ch eip=00401239h

CS=001Bh DS=0023h SS=0023h
ES=0023h FS=0038h GS=0
Flags: IF
Flags: IF
F001Bh DS=0023h SS=0023h
ES=0023h FS=0038h GS=0000h

Stack:
00452B1A 001FFFDD 0012F33C 00401327
0000004D 00000000 001FFFDD 00000002
00453666 00000F0A 001FF010 00000198
0012F454 004031B6 0000004D 00000000
</quote>

You need to debug the same executable with a debugger(say Olly).

Where will you go?;

Instruction pointer: 00401239h <- where the code crashes

what happened?;

ACCESS_VIOLATION (most likely tried to write to a memory part which not initialized yet. Means address has lots of ??????????)

What is the status of registers etc:?

:) you have full of info. All registers, variables on stack etc.

Now think, what reported and what must be and WHY?

then try to fix it. Not so easy especially if ti works well for you and/or u dont have same PC equipment and/or software. Pain in a..

Good Luck

another crash.

from what i see - the only thing which connects these crashes is that they occur while i restart/close the project/radasm

i attached full debug info (got it using ollydbg)

.ini and .api files (from radasm asm folder)

these are the only ones i changed

if this won't help - i'll try to prepare my project for unclassifying :P