iisrecycle

IIS problem, web application


When I use the web application, the application logs me out. I think it might be an IIS recycle.

EventViewer Message:

.NET Runtime version 2.0.50727.4927 - Fatal Execution Engine Error (000007FEF582FA42) (80131506)
----------

Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bd0eb
Faulting module name: mscorwks.dll, version: 2.0.50727.4927, time stamp: 0x4a27466f
Exception code: 0xc0000005
Fault offset: 0x00000000006be81f
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13

-------------
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: w3wp.exe
P2: 7.5.7600.16385
P3: 4a5bd0eb
P4: mscorwks.dll
P5: 2.0.50727.4927
P6: 4a27466f
P7: c0000005
P8: 00000000006be81f
P9: 
P10: 

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_6a41af6fc5f73afd65a4b62225f4f0ff51ba820_60e9d666

Analysis symbol: 
Rechecking for solution: 0
Report Id: d745615a-e67c-11df-83c0-d8d385b73c58
Report Status: 4

I analyzed the crash dump with windbg but I dont know how can I solve and what is problem:

0:056> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\9a017aa8d51322f18a40f414fa35872d\mscorlib.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.RegularE#\bf11731ff6e75c72e9939a05151e7484\System.Web.RegularExpressions.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Web.RegularExpressions.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web\d753bba0990df9a19883f05d5b681d3b\System.Web.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Web.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data\46a0336046744a9f29986b208b8d38d4\System.Data.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Data.ni.dll
Unable to load image C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_2b4f45e87195fcc4\GdiPlus.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for GdiPlus.dll
Unable to load image C:\Windows\assembly\NativeImages_v2.0.50727_64\System\247913fa7ae6fcf04ea33d28d24ab611\System.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.ni.dll
GetPageUrlData failed, server returned HTTP status 500
URL requested: http://watson.microsoft.com/StageOne/w3wp_exe/7_5_7600_16385/4a5bd0eb/mscorwks_dll/2_0_50727_4927/4a27466f/c0000005/006be81f.htm?Retriage=1

FAULTING_IP: 
mscorwks!COMCryptography::_GetKeyParameter+24f
000007fe`f5dde81f 418b4514        mov     eax,dword ptr [r13+14h]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fef5dde81f (mscorwks!COMCryptography::_GetKeyParameter+0x000000000000024f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000014
Attempt to read from address 0000000000000014

PROCESS_NAME:  w3wp.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000014

READ_ADDRESS:  0000000000000014 

FOLLOWUP_IP: 
mscorwks!COMCryptography::_GetKeyParameter+24f
000007fe`f5dde81f 418b4514        mov     eax,dword ptr [r13+14h]

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK: !dumpstack -EE
No export dumpstack found

MANAGED_BITNESS_MISMATCH: 
Managed code needs matching platform of sos.dll for proper analysis. Use 'x64' debugger.

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 000007fef3a0bf50 to 000007fef5dde81f

FAULTING_THREAD:  ffffffffffffffff

DEFAULT_BUCKET_ID:  NOSOS

PRIMARY_PROBLEM_CLASS:  NOSOS

BUGCHECK_STR:  APPLICATION_FAULT_NOSOS_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_CALL_STACKIMMUNE

STACK_TEXT:  
00000000`00000000 00000000`00000000 w3wp.exe+0x0


SYMBOL_NAME:  w3wp.exe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: w3wp

IMAGE_NAME:  w3wp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bd0eb

STACK_COMMAND:  ** Pseudo Context ** ; kb

FAILURE_BUCKET_ID:  NOSOS_c0000005_w3wp.exe!Unknown

BUCKET_ID:  X64_APPLICATION_FAULT_NOSOS_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_CALL_STACKIMMUNE_w3wp.exe


Followup: MachineOwner

Solution

  • I solved this problem. Solution Steps:

    Windbg analized and show a text like this:

    GetPageUrlData failed, server returned HTTP status 404
    URL requested: http://watson.microsoft.com/StageOne/w3wp_exe/7_5_7600_16385/4a5bd0eb/mscorwks_dll/2_0_50727_4927/4a27466f/c0000005/006be81f.htm?Retriage=1
    
    FAULTING_IP: 
    mscorwks!COMCryptography::_GetKeyParameter+24f
    000007fe`f5dde81f 418b4514        mov     eax,dword ptr [r13+14h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007fef5dde81f (mscorwks!COMCryptography::_GetKeyParameter+0x000000000000024f)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000014
    Attempt to read from address 0000000000000014
    
    PROCESS_NAME:  w3wp.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000014
    
    READ_ADDRESS:  0000000000000014 
    
    FOLLOWUP_IP: 
    mscorwks!COMCryptography::_GetKeyParameter+24f
    000007fe`f5dde81f 418b4514        mov     eax,dword ptr [r13+14h]
    
    MOD_LIST: <ANALYSIS/>
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    MANAGED_STACK: !dumpstack -EE
    No export dumpstack found
    
    MANAGED_BITNESS_MISMATCH: 
    Managed code needs matching platform of sos.dll for proper analysis. Use 'x64' debugger.
    
    ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
    
    LAST_CONTROL_TRANSFER:  from 000007fef3a0bf50 to 000007fef5dde81f
    
    FAULTING_THREAD:  ffffffffffffffff
    
    DEFAULT_BUCKET_ID:  NOSOS
    
    PRIMARY_PROBLEM_CLASS:  NOSOS
    
    BUGCHECK_STR:  APPLICATION_FAULT_NOSOS_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_CALL_STACKIMMUNE
    
    STACK_TEXT:  
    00000000`00000000 00000000`00000000 w3wp.exe+0x0
    
    
    SYMBOL_NAME:  w3wp.exe
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: w3wp
    
    IMAGE_NAME:  w3wp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bd0eb
    
    STACK_COMMAND:  ** Pseudo Context ** ; kb
    
    FAILURE_BUCKET_ID:  NOSOS_c0000005_w3wp.exe!Unknown
    
    BUCKET_ID:  X64_APPLICATION_FAULT_NOSOS_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_CALL_STACKIMMUNE_w3wp.exe
    
    WATSON_STAGEONE_URL:
    Followup: MachineOwner
    
    0:056> .exr 0xffffffffffffffff
    ExceptionAddress: 000007fef5dde81f (mscorwks!COMCryptography::_GetKeyParameter+0x000000000000024f)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000014
    Attempt to read from address 0000000000000014
    

    So I added this code to Decrypt Method: if (String.IsNullOrEmpty(value)) return String.Empty;

    public static string Decrypt(string value)
        {
            SymmetricAlgorithm algorithm = SymmetricAlgorithm.Create();
            ICryptoTransform decryptor = algorithm.CreateDecryptor(EncryptionKey, EncryptionVector);
    
            // I control value
            **if (String.IsNullOrEmpty(value))
                return String.Empty;**
    
            byte[] encryptedBytes = Convert.FromBase64String(value);
            MemoryStream memoryStream = new MemoryStream(encryptedBytes);
            CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
            ...
        }
    

    problem was solved.