skylined/bugid

Detect, analyze and uniquely identify crashes in Windows applications

BugId

Detect, analyze and uniquely identify application bugs.

TL;DR

Do you...

• want to know what kind of bug is causing an application to crash?
• want to know if a bug might be security vulnerability?
• want to find out if two or more crashes are caused by the same bug?
• want a human readable report with an analysis of a bug?

...then BugId may be for you!

Quick setup

To use BugId, please download and install the following software:

• Latest Python 2.7.14
• Latest Debugging Tools for Windows
• Latest BugId release

If you install Python and Debugging Tools for Windows with their default settings, BugId should be able to run without adjusting any settings. You can unzip BugId anywhere you want on your local file system.

Before you start BugId, you should enable full page heap in the target application. This can be done per binary by setting certain Global Flags. The easiest way to do this is to use the pageheap.cmd script that comes with BugId. For instance, to enable full page heap for notepad, run the following command:

C:\BugId>pageheap notepad.exe ON

(Note that this command must be run from an elevated command-prompt with administrative access to the machine).

To make things even easier, pageheap.cmd has a list of known applications. You can enable or disable full page heap for any one of them by providing its name, e.g. pageheap msie ON enables full page heap for Microsoft Internet Explorer. Use pageheap /? to get more information about command-line arguments.

At this point, you may want to test if BugId is working correctly. We can do this by running an application in BugId and crashing it to see if BugId reports the bug correctly. A good application to use for this test is rundll32.exe which is found on all Windows installations in the system32 sub-folder of the Windows folder (%WinDir%). It can be used to load any dll found on the local file system and call an exported function in this dll with a certain call format. There are many dlls in the system32 folder that export functions. Most of these exported functions expect arguments in a completely different format than what rundll32 will provide, causing the application to crash.

First we must turn on full page heap in rundll32 with the following command:

C:\BugId>pageheap rundll32.exe ON

Next we will start BugId and tell it to start rundll32 with arguments that instruct it to load advapi32.dll and call CloseThreadWaitChainSession. At the time of this writing that causes a so-called NULL pointer access violation, which BugId should detect and report.

C:\BugId>BugId.cmd %WinDir%\system32\rundll32.exe -- advapi32 CloseThreadWaitChainSession

Notice there is a -- between rundll32.exe and the arguments passed to it. This is because you may want to provide arguments to both BugId itself and the application you want to test. These two sets of arguments should be separated by -- on the command-line. Everything before -- is handled by BugId and everything after is ignored by BugId but passed to the application.

If all is well, the output of BugId will look like this:

* Command line: C:\WINDOWS\system32\rundll32.exe advapi32 CloseThreadWaitChainSession
+ Main process 8024/0x1F58 (rundll32.exe): Attached; command line = C:\WINDOWS\system32\rundll32.exe advapi32 CloseThreadWaitChainSession.
,-- A bug was detect in the application ----------------------------------------
| Id @ Location:    AVR@NULL a1f.904 @ rundll32.exe!advapi32.dll!WctRemoveEntry
| Description:      Access violation while reading memory at 0x0 using a NULL pointer.
| Security impact:  Denial of Service
| Version:          rundll32.exe 10.0.16299.15 (x64)
|                   advapi32.DLL 10.0.16299.15 (x64)
| Bug report:       AVR@NULL a1f.904 @ rundll32.exe!advapi32.dll!WctRemoveEntry.html (60703 bytes)
'-------------------------------------------------------------------------------

The first line tells you the command-line BugId is going to start. The second line tells you that this caused a new process to be created with process id 8024, running rundll32.exe and the command line for this process (which is of course the same as in the first line). Soon after starting the application, a bug was detected. BugId generated a unique id (AVR@NULL a1f.904) for this bug and reported its location is in the WctRemoveEntry function of the advapi32.dll dll loaded by rundll32.exe. Since NULL pointer crashes are normally not exploitable other than to crash the application, the bug's security impact is Denial of Service. BugId by default generates a HTML formatted report for every bug it finds and tells you the location where this report was stored. As you can see, the file name of the report is based on the bug id and location.

Every bug id generated by BugId consists of two part separated by a space. The first part describes the type of bug. In the above example, AVR@NULL, this means Access Violation Reading memory at address NULL. The second part describes the location of the bug; it consists of two short hashes separated by a dot. These hashes are calculated from the top functions on the stack that are considered relevant to the bug. In the example, a1f.904 consists of a1f (calculated from advapi32.dll!WctRemoveEntry) and 904 (calculated from advapi32.dll!CloseThreadWaitChainSession).

If you run that same command again, BugId will report the exact same BugId, as this should couse the exact same bug in the exact some code.

Congratulations! You are now ready to test your own crashes with BugId, but you may want to run BugId.cmd --help at some point to get information about the many different command-line options BugId supports.

Notes

BugId has been developed for and tested on a large number of applications during fuzzing to analyze hundreds of thousands of crashes caused by hundreds of different bugs. In this role it has proven to be extremely accurate in analyzing bugs with a very low false positive and negative rate; both are less than 1%.

Of course not all types of bugs are easy to detect and analyze. Some bugs cannot currently be detected reliably at the time they happen but cause a crash much later on in completely unrelated code, leading to a completely incorrect analysis. In such cases, repeatedly reproducing the same bug will lead to a number of different bug ids as the application crashes in different ways at different times. To make sure this is not the case, you are advised to run your test case in BugId a number of times to see if the bug id stays the same.

Others bugs cause crashes that look like they are caused by a different type of bug. This can result in incorrect analysis and bug ids. Most notably, bugs that are the result of bad casts in C/C++ code are currently impossible to detect and report by BugId. They can result in various different types of crashes; most commonly access violations when values stored in properties of an object are incorrectly used as pointers. If you expect bad casts might be the cause of a crash, you should double check the analysis done by BugId to make sure it is correct.

BugId is highly dependent on full page heap being used by the application to be able to detect and analyze a large number of heap related bugs. This means that it will be much less effective at detecting and analyzing bugs in application that use their own internal heap manager that does not rely on the standard Windows heap.

License

BugId has a free 30-day trial period for commercial and non-commercial use. During this trial period this work is licensed under a [Creative Commons Attribution-NonCommercial 4.0 International License](http://creativecommons.org/licenses/by-nc/4.0/).

After the trial period, paid license must be acquired at license.skylined.nl if you want to continue to use BugId.

Non-Commercial licenses are available for a very small fee; just enough to pay for my expenses. Commercial licenses for individual security researchers are available at a huge discount too.

If you have any questions about licensing, or want to discuss a bulk-discount, please contact [email protected].

BugId has a trial period to allow you to assess its usefulness. If you want to continue to use BugId after the trial period has ended, I ask that you contribute a small fee to pay for my work on BugId and handling of the license request. If you are using BugId commercially, I ask that you pay a regular license fee to share some of the profit you are making off of your use of BugId.

bugid's Issues

Missing process ids

I've seen cases where CDB reports a process terminating when BugId does not know the process existed in the first place. This happens very infrequently, but it should be analyzed and addressed to make sure results are reliable and prevent BugId from crashing because of an assert that detects this.

The crash is in the assert on line 26 of cCdbWrapper_fHandleCreateExitProcess.py:
assert uProcessId in oCdbWrapper.auProcessIds, "Missing process id: %d" % uProcessId;

- An internal exception has occured:

Got this error after updating everything to new version i.e.

BugId version 2017-07-04 16:31
cBugId version 2017-07-04 14:39
FileSystem version 2017-05-12 12:04
Kill version 2017-05-12 12:06

• An internal exception has occured:
  AssertionError('Status messages should not be output when output is redirected.',)
  Stack:
  3 __fOutputHelper (c:\Users\Windows10\Desktop\Edge-DBG-Using\BugId-master\oConsole.py/152)
  > "Status messages should not be output when output is redirected.";
  2 fStatus (c:\Users\Windows10\Desktop\Edge-DBG-Using\BugId-master\oConsole.py/208)
  > oConsole.__fOutputHelper(axCharsAndColors, True);
  1 fuMain (c:\Users\Windows10\Desktop\Edge-DBG-Using\BugId-master\BugId.py/717)
  > oConsole.fStatus("* The debugger is attaching to running processes and starting the application...");
  0 c:\Users\Windows10\Desktop\Edge-DBG-Using\BugId-master\BugId.py/815
  > uExitCode = fuMain(sys.argv[1:]);
  BugId version 2017-07-04 16:31
  cBugId version 2017-07-04 14:39
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06

---

Module information should be retreived directly, not through cdb.exe commands

- An internal exception has occured:
  AssertionError('Unexpected list module output:  All Rights Reserved.\r\nstart    end        module name\r\n70410000 704b7000   JP2KLib
  (export symbols)       C:\\Program Files (x86)\\Adobe\\Acrobat 11.0\\Acrobat\\JP2KLib.dll\r\n    Loaded symbol image file: C:\\Program Files (x86)\\Adobe\\Acrobat 11.0\\Acrobat\\JP2KLib.dll\r\n    Image path: C:\\Program Files (x86)\\Adobe\\Acrobat 11.0\\Acrobat\\JP2KLib.dll\r\n    Image name: JP2KLib.dll\r\n    Timestamp:        Sat Oct 28 00:09:54 2017 (59F3AEB2)\r\n    CheckSum:         000A7CC5\r\n    ImageSize:        000A7000\r\n    File version:     2.0.0.39493\r\n    Product version:  2.0.0.39493\r\n    File flags:       0 (Mask 3F)\r\n    File OS:          40004 NT Win32\r\n    File type:        2.0 Dll\r\n    File date:        00000000.00000000\r\n    Translations:
0409.04e4\r\n    CompanyName:      Adobe Systems Incorporated\r\n    ProductName:      JP2KLib 2017/10/28-03:08:34\r\n    InternalName:
  JP2KLib\r\n    OriginalFilename: JP2KLib.dll\r\n    ProductVersion:   80.268565\r\n    FileVersion:      2.0.0.39493\r\n    FileDescription:  Adobe JPEG2000 Core Library\r\n    LegalCopyright:   \xa9 2009 Adobe Systems Incorporated.\r\n All Rights Reserved.\r\n    LegalTrademarks:  Adobe \xae',)
  Stack:
   11 fProcess_lmov_Output (Z:\secprogs\bugidlatest\modules\cBugId\cModule.py/260)
      > "Unexpected list module output: %s\r\n%s" % (sLine, "\r\n".join(as_lmov_Output));
   10 __foGetOrCreateFrom_lmov (Z:\secprogs\bugidlatest\modules\cBugId\cModule.py/150)
      > oModule.fProcess_lmov_Output(as_lmov_Output);
    9 foCreateForCdbId (Z:\secprogs\bugidlatest\modules\cBugId\cModule.py/134)
      > return cModule.__foGetOrCreateFrom_lmov(oProcess, "m %s;" % sCdbId);
    8 foGetOrCreateModuleForCdbId (Z:\secprogs\bugidlatest\modules\cBugId\cProcess.py/105)
      > return cModule.foCreateForCdbId(oProcess, sCdbId);
    7 cProcess_ftxSplitSymbolOrAddress (Z:\secprogs\bugidlatest\modules\cBugId\cProcess_ftxSplitSymbolOrAddress.py/49)
      > oModule = oProcess.foGetOrCreateModuleForCdbId(sModuleCdbId);
    6 ftxSplitSymbolOrAddress (Z:\secprogs\bugidlatest\modules\cBugId\cProcess.py/133)
      > return cProcess_ftxSplitSymbolOrAddress(oProcess, sSymbolOrAddress);
    5 foCreateHelper (Z:\secprogs\bugidlatest\modules\cBugId\cException.py/145)
      > ) = oProcess.ftxSplitSymbolOrAddress(oException.sAddressSymbol);
    4 foCreate (Z:\secprogs\bugidlatest\modules\cBugId\cException.py/40)
      > bApplicationCannotHandleException = bApplicationCannotHandleException,
    3 foCreateForException (Z:\secprogs\bugidlatest\modules\cBugId\cBugReport.py/78)
      > oException = cException.foCreate(oProcess, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
    2 cCdbWrapper_fCdbStdInOutThread (Z:\secprogs\bugidlatest\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/600)
      > oBugReport = cBugReport.foCreateForException(oCdbWrapper.oCurrentProcess, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
    1 fCdbStdInOutThread (Z:\secprogs\bugidlatest\modules\cBugId\cCdbWrapper.py/439)
      > return cCdbWrapper_fCdbStdInOutThread(oCdbWrapper);
    0 __fThreadWrapper (Z:\secprogs\bugidlatest\modules\cBugId\cCdbWrapper.py/268)
      > fActivity(*asActivityArguments);

  Windows version: Windows 10 Pro release 1607, build 14393 x64
  BugId version: 2017-11-24 14:57
  cBugId version: 2017-11-24 14:47
  mFileSystem version: 2017-11-11 10:13
  mWindowsAPI version: 2017-11-24 14:05
  oConsole version: 2017-11-24 14:55

Prevent stack hash collitions when no symbols are available

I've had a report of stack frames with form module.dll!ExportSymbol+0xNNN getting the same stack hash id for different values of 0xNNN. I believe I may have done this by design to allow a bug triggered in two versions of an application to result in the same stack hash id, but if there are no symbols, many different functions will end up with the same export symbol, but a different offset.

I may have to try to detect if symbols are available and only ignore the offsets when calculating the stack hash if they are, but use the offset in the stack hash if not.

command line parsing without app @keyword

$ python BugId.py "--nExcessiveCPUUsageCheckInitialTimeout=null" "c:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReader.exe"
+ Changed config setting nExcessiveCPUUsageCheckInitialTimeout from 5 to None.
**You must specify an application command-line or its process ids**

BugId version 2016.09.08.2025, cBugId version 2016.09.08.1356
This version of BugId is provided free of charge for non-commercial use only.
If you find it useful and would like to make a donation, you can send bitcoin
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX. Please contact the author if you wish to
use BugId commercially. Contact and licensing information can be found at

works with the keyword, 

$ python BugId.py --nExcessiveCPUUsageCheckInitialTimeout=null @foxit
+ Changed config setting nExcessiveCPUUsageCheckInitialTimeout from 5 to None.
* Applying application specific settings:
  + Changed config setting nExcessiveCPUUsageCheckInitialTimeout from None to 10.0.
  + Changed config setting BugId.nExcessiveCPUUsagePercent from 90 to 75.
  + Changed config setting nApplicationMaxRunTime from None to 3.0.
  * The default value for config setting BugId.nExcessiveCPUUsageWormRunTime is 0.5.
  + Changed config setting BugId.nExcessiveCPUUsageCheckInterval from 10.0 to 5.0.
+ The debugger is starting the application...
  Command line: C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReader.exe repro.pdf
+ The application was started successfully and is running...
  * T+0.0 Exception code 0x80000003 (Break instruction exception) was detected and is being analyzed...
  * T+0.0 The application was resumed successfully and is running...
  * T+3.1 Exception code 0x80000003 (Break instruction exception) was detected and is being analyzed...
  * T+3.1 Terminating the application because it has been running for 3.0 seconds without crashing.
- The application has terminated without crashing.
  Run time:         3.072 seconds

NameError("global name 'oBugId' is not defined",)

Hi

Here is another bug in BugID when running it with 'BugID.bSaveDump=true'

T+94.9 The application was resumed successfully and is running...
Exception in thread Thread-1:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 810, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 763, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper.py", line 21
4, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper.py", line 20
8, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper_fCdbStdInOut
Thread.py", line 279, in cCdbWrapper_fCdbStdInOutThread
    oCdbWrapper.oBugReport.fPostProcess(oCdbWrapper);
  File "C:\Users\s\Desktop\BugID\modules\cBugId\cBugReport.py", line 281
, in fPostProcess
    sDesiredDumpFileName = "%s @ %s.dmp" % (oBugId.oBugReport.sId, oBugId.oBugRe
port.sBugLocation);
NameError: global name 'oBugId' is not defined

+ BugId run into an internal error:
  NameError("global name 'oBugId' is not defined",)

AssertionError: unexpected value result

Hi SkyLined

Found this bug today on the new version:

 * T+164.4 Exception code 0xC0000005 (Access violation) was detected and is being analyzed...
Exception in thread Thread-1:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 801, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 754, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cCdbWrapper.py", line 214, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cCdbWrapper.py", line 208, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py", line 276, in cCdbWrapper_fCdbStdInOutThread
    oCdbWrapper.oBugReport = cBugReport.foCreateForException(oCdbWrapper, uExceptionCode, sExceptionDescription);
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cBugReport.py", line 86, in foCreateForException
    oStack = cStack.foCreate(oCdbWrapper, uStackFramesCount);
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cStack.py", line 99, in foCreate
    uInstructionPointer = oCdbWrapper.fuGetValue("@$ip");
  File "C:\Users\s\Desktop\BugId-master\modules\cBugId\cCdbWrapper.py", line 350, in fuGetValue
    "Unexpected value result:\r\n%s" % "\r\n".join(asValueResult);
AssertionError: Unexpected value result:
Unable to read dynamic function table entry at 00000280`877ea0d0
00007ff87995501f

+ BugId run into an internal error:
  AssertionError('Unexpected value result:\r\nUnable to read dynamic function table entry at 00000280`877ea0d0\r\n00007ff87995501f',)

BugId version 2016.10.04.2152, cBugId version 2016.10.04.2123

AssertionError: Cannot dump a memory region with its end address x bytes beyond its start address

Another one:

`--------------------------------------------------------------------------------

• An internal exception has occured:
  AssertionError('Cannot dump a memory region with its end address 0x444A3FF2 1474 bytes beyond its start address 0x444A3A30',)
  Stack:
  3 fAddMemoryDump (.\modules\cBugId\cBugReport.py/69)
  > "Cannot dump a memory region with its end address 0x%X %d bytes beyond its start address 0x%X" % (uEndAddress, uSize, uStartAddress);
  2 foDetectAndCreateBugReportForVERIFIER_STOP (.\modules\cBugId\foDetectAndCreateBugReportForVERIFIER_STOP.py/280)
  > "Memory near heap block at 0x%X" % uMemoryDumpStartAddress,
  1 cCdbWrapper_fCdbStdInOutThread (.\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/545)
  > oBugReport = foDetectAndCreateBugReportForVERIFIER_STOP(oCdbWrapper, uExceptionCode, asUnprocessedCdbOutput);
  0 __fThreadWrapper (.\modules\cBugId\cCdbWrapper.py/266)
  > fActivity(oCdbWrapper);
  BugId version 2017-08-25 17:36
  cBugId version 2017-08-25 17:35
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06
  --------------------------------------------------------------------------------`

C++ Exception fails Win10 x64

+ StaticBufferOverrun10 Write 20 =x86=> FailFast2:StackCookie
@ Exception in C++ =x86=> C++:cException: need more than 1 value to unpack
Exception in thread Thread-242:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 810, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 763, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\BugId\src\cCdbWrapper.py", line 98, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "C:\BugId\src\cCdbWrapper.py", line 92, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\BugId\src\cCdbWrapper_fCdbStdInOutThread.py", line 169, in cCdbWrapper_fCdbStdInOutThread
    oCdbWrapper.oErrorReport = cErrorReport.foCreate(oCdbWrapper, uExceptionCode, sExceptionDescription);
  File "C:\BugId\src\cErrorReport.py", line 115, in foCreate
    oErrorReport = foSpecialErrorReport(oErrorReport, oCdbWrapper);
  File "C:\BugId\src\cErrorReport_foSpecialErrorReport_CppException.py", line 55, in cErrorReport_foSpecialErrorReport_CppException
    sModuleCdbId, sExceptionClassName = sExceptionObjectSymbol.split("!", 1);
ValueError: need more than 1 value to unpack

* Tests failed.

Unexpected Crash

Unexpected Crash

Exception in thread Thread-1:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 810, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 763, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\BugId\modules\cBugId\cCdbWrapper.py", line 224, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "C:\BugId\modules\cBugId\cCdbWrapper.py", line 218, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\BugId\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py", line 106, in
 cCdbWrapper_fCdbStdInOutThread
    oCdbWrapper.fApplicationRunningCallback and oCdbWrapper.fApplicationRunningC
allback();
  File "C:\BugId\BugId.py", line 244, in fApplicationRunningHandler
    oBugId.fSetCheckForExcessiveCPUUsageTimeout(dxConfig["nExcessiveCPUUsageChec
kInitialTimeout"]);
AttributeError: 'NoneType' object has no attribute 'fSetCheckForExcessiveCPUUsag
eTimeout'

+ BugId run into an internal error:
  AttributeError("'NoneType' object has no attribute 'fSetCheckForExcessiveCPUUs
ageTimeout'",)

BugId version 2016.11.08.1614, cBugId version 2016.11.04.1335

32-bit version of BugId uses 64-bit version of cmd.exe as utility process.

With the latest.... it needs 64 bit python now?

AssertionError('Accessing a virtual allocation in a 64-bit process from 32-bit Python process is not implemented',)
Stack:
3 foGetForProcessIdAndAddress (H:\secprogs\bugidlatest\modules\mWindowsAPI\cVirtualAllocation.py/29)
> "Accessing a virtual allocation in a 64-bit process from 32-bit Python process is not implemented";
2 foCreateVirtualAllocationInProcessForId (H:\secprogs\bugidlatest\modules\mWindowsAPI\foCreateVirtualAllocationInProcessForId.py/40)
> return cVirtualAllocation.foGetForProcessIdAndAddress(uProcessId, uBaseAddress);
1 cCdbWrapper_fCdbStdInOutThread (H:\secprogs\bugidlatest\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/255)
> uSize = dxConfig["uReservedMemory"],
0 __fThreadWrapper (H:\secprogs\bugidlatest\modules\cBugId\cCdbWrapper.py/261)
> fActivity(oCdbWrapper);

Windows version: Windows 10 Pro release 1607, build 14393
BugId version: 2017-11-22 22:57
cBugId version: 2017-11-22 22:56
mFileSystem version: 2017-11-11 10:13
mWindowsAPI version: 2017-11-21 12:32
oConsole version: 2017-11-21 15:58

AssertionError: Unexpected list module output

---

• An internal exception has occured:
  AssertionError('Unexpected list module output: Has CLR image header, track-debug-data flag not set\r\nstart end
  module name\r\n0000000000b90000 0000000000d84000 image00000000_00b90000 (deferred) \r\n Image path: image0000000000b90000\r\n Image name: image0000000000b90000\r\n Has CLR image header, track-debug-data flag not set\r\n ******
  Stack:
  7 fProcess_lmov_Output (\modules\cBugId\cModule.py/261)
  > "Unexpected list module output: %s\r\n%s" % (sLine, "\r\n".join(as_lmov_Output));
  6 __foGetOrCreateFrom_lmov (\modules\cBugId\cModule.py/150)
  > oModule.fProcess_lmov_Output(as_lmov_Output);
  5 foCreateForStartAddress (\modules\cBugId\cModule.py/131)
  > return cModule.__foGetOrCreateFrom_lmov(oProcess, "a 0x%X;" % uStartAddress);
  4 foGetOrCreateModuleForStartAddress (\modules\cBugId\cProcess.py/202)
  > return cModule.foCreateForStartAddress(oProcess, uStartAddress);
  3 oMainModule (\modules\cBugId\cProcess.py/195)
  > oProcess.__oMainModule = oProcess.foGetOrCreateModuleForStartAddress(oProcess.__uMainModuleImageBaseAddress);
  2 sBinaryName (\modules\cBugId\cProcess.py/52)
  > return oProcess.oMainModule.sBinaryName;
  1 cCdbWrapper_fCdbStdInOutThread (\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/439)
  > "Started process %d/0x%X (%s)." % (uProcessId, uProcessId, oCdbWrapper.oCurrentProcess.sBinaryName),
  0 __fThreadWrapper (\modules\cBugId\cCdbWrapper.py/266)
  > fActivity(oCdbWrapper);
  BugId version 2017-08-30 17:10
  cBugId version 2017-08-30 17:05
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06

---

Browser can't open

Used BugId to check out a bug that make the browser crash, rebooted my machine and now when I try to run ./BugId.py "Edge path" the browser doesn't open because it fetch the last page opened (the bug one) so the browser never open just says "application is running...."

Runned with -v flag and can confirm that it prints out the info regarding the old bug yet
triggering a stack buffer overrun, how can i fix that ?
any way to make it forget about previous tests or?

why is pids argument pids= error...

• Terminating any running instances of Microsoft Edge...
• Activating Microsoft Edge and opening http://www.naver.com...
• MicrosoftEdge.exe process id = 6096
• MicrosoftEdgeCP.exe process id = 4540
• RuntimeBroker.exe process id = 4424
• browser_broker.exe process id = 5892
• Starting C:\Python27\python.exe C:\CrashInfo\ci.py --pids=4424,58926096,4540,
  ['4424', '58926096', '4540', '']

Weird cBugId Crash - Heap Corruption Related

Hi! I'm super new to reverse engineering / exploit development, so I'm really not sure if this is important. I'm still digging through it and trying to understand, but thought I would post a report here. If you don't think this is a bug, please feel free to close this issue.

Below is the source code of a simple heap corruption PoC I am playing with:

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main(int argc, char *argv[])
{
  long* hHeap = HeapCreate(0x00040000, 0 , 0);
  char *buff1, *buff2, *buff3;
  
  buff1 = HeapAlloc(hHeap, 0, 0x10);
  buff2 = HeapAlloc(hHeap, 0, 0x10);
  HeapFree(hHeap, 0, buff2);
  
  strcpy(buff1, argv[1]);
  buff2 = HeapAlloc(hHeap, 0, 0x10);
  
  HeapFree(hHeap, 0, buff2); // could seg fault
  HeapFree(hHeap, 0, buff1);
  
  return 0;
}

I was experimenting with triaging using BugId I saw this. Notice the first two crashes behave as expected, and the final crash seems to crash cBugId itself?

C:\win7x64-vm\exploitdev_exp\BugId>C:\Python27\python.exe BugId.py "C:\heap-exploitable-1.exe" AAAAAAA
+ The debugger is starting the application...
  Command line: C:\heap-exploitable-1.exe AAAAAAA
+ The application was started successfully and is running...
  * T+0.0 The application is suspended...
    * And resumed...
  * T+0.0 The application is suspended...
  * T+0.0 One of the main processes has terminated, stopping...

  === BugId report (https://github.com/SkyLined/BugId) =========================
  Id:               None
  Description:      The application terminated before a bug was detected.
  Application time: 0.004 seconds
  BugId overhead:   0.037 seconds

BugId version 2017.01.31.1531, cBugId version 2017.01.31.1525
This version of BugId is provided free of charge for non-commercial use only.
If you find it useful and would like to make a donation, you can send bitcoin
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX. Please contact the author if you wish to
use BugId commercially. Contact and licensing information can be found at
https://github.com/SkyLined/BugId#license.

C:\win7x64-vm\exploitdev_exp\BugId>C:\Python27\python.exe BugId.py "C:\heap-exploitable-1.exe" AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ The debugger is starting the application...
  Command line: C:\heap-exploitable-1.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ The application was started successfully and is running...
  * T+0.0 The application is suspended...
    * And resumed...
  * T+0.0 The application is suspended...

  === BugId report (https://github.com/SkyLined/BugId) =========================
  Id:               Breakpoint aca.501
  Location:         image00000000`00400000!ntdll32.dll!RtlpBreakPointHeap
  Description:      WOW64 breakpoint (code 0x4000001F)
  Version:          image00000000`00400000 Sun Dec 14 19:03:00 2014 (548E3344) (x86)
                    ntdll32.dll 6.1.7601.17514 (x86)
  Security impact:  Denial of Service
  Application time: 0.0 seconds
  BugId overhead:   1.099 seconds
  Bug report:       Breakpoint aca.501 @ image00000000`00400000!ntdll32.dll!RtlpBreakPointHeap.html
(33739 bytes)

BugId version 2017.01.31.1531, cBugId version 2017.01.31.1525
This version of BugId is provided free of charge for non-commercial use only.
If you find it useful and would like to make a donation, you can send bitcoin
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX. Please contact the author if you wish to
use BugId commercially. Contact and licensing information can be found at
https://github.com/SkyLined/BugId#license.

C:\win7x64-vm\exploitdev_exp\BugId>C:\Python27\python.exe BugId.py "C:\heap-exploitable-1.exe" AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ The debugger is starting the application...
  Command line: C:\heap-exploitable-1.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ The application was started successfully and is running...
  * T+0.0 The application is suspended...
    * And resumed...
  * T+0.0 The application is suspended...
--------------------------------------------------------------------------------
- An error has occured in cBugId, which cannot be handled:
  AssertionError('Unexpected TEB info header:Wow64 TEB32 at 000000007efdd000\r\nWow64 TEB32 at 00000
0007efdd000\r\n*************************************************************************\r\n***
                                                              ***\r\n***
                                       ***\r\n***    Your debugger is not using the correct symbols
                ***\r\n***                                                                   ***\r\n
***    In order for this command to work properly, your symbol path   ***\r\n***    must point to .p
db files that have full type information.      ***\r\n***
                        ***\r\n***    Certain .pdb files (such as the public OS symbols) do not
 ***\r\n***    contain the required information.  Contact the group that      ***\r\n***    provided
 you with these symbols if you need this command to    ***\r\n***    work.
                                ***\r\n***
         ***\r\n***    Type referenced: wow64!_TEB32                                  ***\r\n***
                                                               ***\r\n******************************
*******************************************\r\nerror InitTypeRead( wow64!_TEB32 )...\r\n\r\n\r\nWow6
4 TEB at 000000007efdb000\r\n    ExceptionList:        000000007efdd000\r\n    StackBase:
 000000000008fd20\r\n    StackLimit:           000000000008c000\r\n    SubSystemTib:         0000000
000000000\r\n    FiberData:            0000000000001e00\r\n    ArbitraryUserPointer: 000000000000000
0\r\n    Self:                 000000007efdb000\r\n    EnvironmentPointer:   0000000000000000\r\n
 ClientId:             000000000000079c . 000000000000090c\r\n    RpcHandle:            000000000000
0000\r\n    Tls Storage:          0000000000000000\r\n    PEB Address:          000000007efdf000\r\n
    LastErrorValue:       2\r\n    LastStatusValue:      0\r\n    Count Owned Locks:    0\r\n    Har
dErrorMode:        0',)
  BugId version 2017.01.31.1531, cBugId version 2017.01.31.1525
--------------------------------------------------------------------------------

  Please report this issue at the below web-page so it can be addressed:
      https://github.com/SkyLined/BugId/issues/new
  If you do not have a github account, or you want to report this issue
  privately, you can also send an email to:
      [email protected]

  In your report, please copy all the information about the error reported
  above, as well as the version information. This makes it easier to determine
  the cause of this issue. I will try to address the issues as soon as
  possible. Thank you in advance for helping to improve BugId!

BugId version 2017.01.31.1531, cBugId version 2017.01.31.1525
This version of BugId is provided free of charge for non-commercial use only.
If you find it useful and would like to make a donation, you can send bitcoin
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX. Please contact the author if you wish to
use BugId commercially. Contact and licensing information can be found at
https://github.com/SkyLined/BugId#license.

Hope this helps. Anyway, as stated before:

Cheers!

AssertionError: Cannot modify virtual allocation protection

This happens rarely, randomly, and it can't be reproduced with a specific file.

`--------------------------------------------------------------------------------

• An internal exception has occured:
  AssertionError('Cannot modify virtual allocation protection',)
  Stack:
  6 fauGetBytesAtOffset (\modules\cBugId\cVirtualAllocation.py/179)
  > "Cannot modify virtual allocation protection";
  5 fuGetValueAtOffset (\modules\cBugId\cVirtualAllocation.py/197)
  > auBytes = oVirtualAllocation.fauGetBytesAtOffset(uOffset, uSize);
  4 foGetForAddress (\modules\cBugId\cPageHeapAllocation.py/164)
  > uStartStamp = oVirtualAllocation.fuGetValueAtOffset(uStartStampOffset, 4);
  3 cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION (\modules\cBugId\cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION.py/210)
  > oPageHeapAllocation = cPageHeapAllocation.foGetForAddress(oProcess, uAccessViolationAddress);
  2 foCreateForException (\modules\cBugId\cBugReport.py/93)
  > oBugReport = dfoAnalyzeException_by_uExceptionCode[oException.uCode](oBugReport, oProcess, oException);
  1 cCdbWrapper_fCdbStdInOutThread (\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/559)
  > oBugReport = cBugReport.foCreateForException(oCdbWrapper.oCurrentProcess, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
  0 __fThreadWrapper (***\modules\cBugId\cCdbWrapper.py/266)
  > fActivity(oCdbWrapper);
  BugId version 2017-08-30 17:10
  cBugId version 2017-08-30 17:05
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06
  --------------------------------------------------------------------------------`

TypeError("unsupported operand type(s) for +: 'NoneType' and 'NoneType'",

Good day,

I was using BugID and came across an internal TypeError:

* T+49.6 The application was resumed successfully and is running...
ception in thread Thread-1:
aceback (most recent call last):
File "C:\Python27\lib\threading.py", line 810, in __bootstrap_inner
  self.run()
File "C:\Python27\lib\threading.py", line 763, in run
  self.__target(*self.__args, **self.__kwargs)
File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper.py", line 2
 in _fThreadWrapper
  oCdbWrapper.fInternalExceptionCallback(oException);
File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper.py", line 2
 in _fThreadWrapper
  fActivity(oCdbWrapper);
File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper_fCdbStdInOu
read.py", line 256, in cCdbWrapper_fCdbStdInOutThread
  cCdbWrapper_fbDetectAndReportVerifierErrors(oCdbWrapper, asCdbOutput):
File "C:\Users\s\Desktop\BugID\modules\cBugId\cCdbWrapper_fbDetectAnd
ortVerifierErrors.py", line 49, in cCdbWrapper_fbDetectAndReportVerifierError

  uHeapBlockEndAddress = uHeapBlockAddress + uHeapBlockSize;
peError: unsupported operand type(s) for +: 'NoneType' and 'NoneType'

BugId run into an internal error:
TypeError("unsupported operand type(s) for +: 'NoneType' and 'NoneType'",)

Please report this issue at the below web-page so it can be addressed:
https://github.com/SkyLined/BugId/issues/new

Pytnon 3 syntax change on except

This line (line 55):
except ImportError, oError

Should be changed to:
except ImportError as oError

To make it work on Python 3

Move everything application specific into external config files

There's a lot of application specific stuff in the code, mainly for the browsers I fuzz. This should be moved to separate configuration files. Reasons:

• Declutter code
• Centralize settings per app.
• Prevent settings intended for one app affecting debugging of another.
• Make project more accessible to people who want to use it with other apps

It would be nice if a n00b wanting to use it for a new application could get started quickly by look at the configuration settings for other applications and create appropriate configuration settings based on that. e.g. maybe there could be dxConfig.json-style files.

AssertionError('sBugDescription should have been set',)

I get an AssertionError when pageheap is enabled for the application I am testing. When I disable pageheap the bug is reported as a Breakpoint DoS. If I run the application manually under cdb with pageheap enabled I see that the input is causing a double free.

I'm attaching console output as a text file for more details so that it doesn't get markdown mangled.
bugid-details.txt

Warn when debugging a process in which Page Heap is not enabled

BugId works best when Page Heap is enabled with specific flags for a process. The code should check if this is true and warn the user if it is not.

Do not detect crash correctly sometimes

Hello, I test BugId with some pocs, but it do not report crash sometimes.
However, when I use windbg or cdb directly, I can see the crash everytime.

I test it with Edge 20.10240.16384.0 and other Edge versions, both have same problem.

Below is my test sample:

<!DOCTYPE html>
<html>

<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=Edge">
    <title>BugId Test</title>
</head>

<body>
    <script type="text/javascript">
let f = new Function("console.log(arguments[300]);");
let a = [1,2,3];
let b = [];
b.length = 1000;
b.fill(2);

let p = new Proxy([], {
   get: function (oTarget, sKey) {
    console.log("get");
    a.length = 4; // Make a hole
    return oTarget[sKey] || 0 || undefined;
  },
});
b.__proto__ = p;

let proto = [];
Object.defineProperty(proto, 3, {get: function() {
  console.log("hi")
  b.length = 1;
  return 4;
}});
a.__proto__ = proto;

f(1, ...a, ...b);

    </script>
</body>
</html>

x86 Stack Exhaustion test fails on Win10 x64

c:\bugid>python tests.py
* Starting tests...
+ AccessViolation READ 1 =x86=> AVR:NULL+ODD
+ AccessViolation READ 2 =x86=> AVR:NULL+EVEN
+ AccessViolation READ FFFFFFFF =x86=> AVR:NULL-ODD
+ AccessViolation READ FFFFFFFE =x86=> AVR:NULL-EVEN
+ PrivilegedInstruction =AMD64=> PrivilegedInstruction
+ IntegerDivideByZero =AMD64=> IntegerDivideByZero
+ IllegalInstruction =AMD64=> IllegalInstruction
+ Breakpoint =AMD64=> Breakpoint
+ AccessViolation READ FFFFFFFFFFFFFFFE =AMD64=> AVR:NULL-EVEN
+ StackExhaustion =AMD64=> StackExhaustion
+ Breakpoint =x86=> Breakpoint
+ StaticBufferOverrun10 Write 20 =x86=> FailFast2:StackCookie
+ AccessViolation READ 1 =AMD64=> AVR:NULL+ODD
+ AccessViolation READ FFFFFFFFFFFFFFFF =AMD64=> AVR:NULL-ODD
+ PrivilegedInstruction =x86=> PrivilegedInstruction
+ AccessViolation READ 2 =AMD64=> AVR:NULL+EVEN
+ Numbered 41414141 42424242 =x86=> 0x41414141
+ Numbered 41414141 42424242 =AMD64=> 0x41414141
+ IntegerDivideByZero =x86=> IntegerDivideByZero
+ StackExhaustion =x86=> StackExhaustion
- RecursiveCall =x86=> RecursiveCall
    => 5E81 StackExhaustion Tests_x86.exe!wow64.dll!Wow64NotifyDebugger (The process exhausted available stack memory)cdb:stderr>R6025
cdb:stderr>- pure virtual function call

I wonder if it might be easier to try to find the x86 cdb.exe instead of juggling WOW64?

As a side note, it's probably worth noting in the docs that you need VS C++ runtimes for x64 AND x86. Or just merge my README PR and I'll send a new one. :)

cosmetic Error

In the line 328 of cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION there is a "," that get a error.

Original line :

      sSecurityImpact =,  "Potentially exploitable security issue";

This cause

_foAnalyzeException_STATUS_ACCESS_VIOLATION;
File "C:\Users\test\Downloads\BugId-master\BugId-master\src\cBugReport_foAnaly
zeException_STATUS_ACCESS_VIOLATION.py", line 328
sSecurityImpact =, "Potentially exploitable security issue";
^
SyntaxError: invalid syntax

Fix :

Remove ","

fix line:
sSecurityImpact = "Potentially exploitable security issue";

internal exception: TypeError("unsupported operand type(s) for -: 'NoneType...

Hi, i get this:

- An internal exception has occured:
  TypeError("unsupported operand type(s) for -: 'NoneType' and 'NoneType'",)
  Stack:
    5 uMemoryDumpSize (H:\secprogs\bugidnew\modules\cBugId\cPageHeapManagerData.py/384)
      > return oSelf.__uMemoryDumpEndAddress - oSelf.__uMemoryDumpStartAddress;
    4 fSetBugReportPropertiesForAccessViolationUsingHeapManagerData (H:\secprogs\bugidnew\modules\cBugId\fSetBugReportPropertiesForAccessViolationUsingHeapManagerData.py/13)
      > uMemoryDumpSize = oHeapManagerData.uMemoryDumpSize;
    3 cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION (H:\secprogs\bugidnew\modules\cBugId\cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION.py/216)
      > oProcess.oCdbWrapper.bGenerateReportHTML,
    2 foCreateForException (H:\secprogs\bugidnew\modules\cBugId\cBugReport.py/93)
      > oBugReport = dfoAnalyzeException_by_uExceptionCode[oException.uCode](oBugReport, oProcess, oException);
    1 cCdbWrapper_fCdbStdInOutThread (H:\secprogs\bugidnew\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/552)
      > oBugReport = cBugReport.foCreateForException(oCdbWrapper.oCurrentProcess, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
    0 __fThreadWrapper (H:\secprogs\bugidnew\modules\cBugId\cCdbWrapper.py/261)
      > fActivity(oCdbWrapper);

  Windows version: Windows 10 Pro release 1607, build 14393
  BugId version: 2017-10-25 10:01
  cBugId version: 2017-11-01 16:21
  mFileSystem version: 2017-11-01 16:16
  mWindowsAPI version: 2017-11-01 16:15

Tests fail on Win10x64 / python 2.7?

Hi!

I don't usually work with python so it's entirely possible I'm doing something foolish. I did a fairly basic Win10 install, python 27 and then got the zip for BugId master. Is this expected?

c:\BugId-master>%cdb% -version
cdb version 10.0.10240.9

c:\BugId-master>c:\Python27\python.exe Tests.py
* Starting tests...
cdb:stderr>R6025
cdb:stderr>- pure virtual function call
- UseAfterFree Read 20 0 =AMD64=> AVR:Free
    => got no error

c:\BugId-master>ver

Microsoft Windows [Version 10.0.10240]

AssertionError: End-of-command-output marker missing:

Hi!

I get this error:

- An internal exception has occured:
  AssertionError("End-of-command-output marker missing:\r\n                                   ^ Range error in ' db /c20 0x41732000 l0x963000; '",)
  Stack:
   13 cCdbWrapper_fasExecuteCdbCommand (**\modules\cBugId\cCdbWrapper_fasExecuteCdbCommand.py/77)
      > "End-of-command-output marker missing:\r\n%s" % "\r\n".join(oEndOfCommandOutputMarkerMissingException.asCommandOutput);
   12 fasExecuteCdbCommand (**\modules\cBugId\cCdbWrapper.py/412)
      > return cCdbWrapper_fasExecuteCdbCommand(oCdbWrapper, *axArguments, **dxArguments);
   11 fasExecuteCdbCommand (**\modules\cBugId\cProcess.py/254)
      > return oProcess.oCdbWrapper.fasExecuteCdbCommand(sCommand, sComment, **dxArguments);
   10 cProcess_fauGetBytes (**\modules\cBugId\cProcess_fauGetBytes.py/9)
      > sComment = sComment,
    9 fauGetBytes (**\modules\cBugId\cProcess.py/269)
      > return cProcess_fauGetBytes(oCdbWrapper, uAddress, uSize, sComment);
    8 fauGetBytesAtOffset (**\modules\cBugId\cVirtualAllocation.py/178)
      > oVirtualAllocation.uBaseAddress, oVirtualAllocation.uSize, "Get virtual allocation content",
    7 fbDetectCorruption (**\modules\cBugId\cCorruptionDetector.py/25)
      > auBytes = oVirtualAllocation.fauGetBytesAtOffset(uStartOffset, len(axExpectedBytes));
    6 fCheckForCorruption (**\modules\cBugId\cPageHeapAllocation.py/251)
      > oCorruptionDetector.fbDetectCorruption(oPageHeapAllocation.uStartStampAddress, axStartStamp);
    5 foCreateForPageHeapAllocation (**\modules\cBugId\cCorruptionDetector.py/18)
      > oPageHeapAllocation.fCheckForCorruption(oCorruptionDetector);
    4 fSetBugReportPropertiesForAccessViolationUsingPageHeapAllocation (**\modules\cBugId\fSetBugReportPropertiesForAccessViolationUsingPageHeapAllocation.py/80)
      > oCorruptionDetector = cCorruptionDetector.foCreateForPageHeapAllocation(oPageHeapAllocation);
    3 cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION (**\modules\cBugId\cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION.py/217)
      > oProcess.uPointerSize, oProcess.oCdbWrapper.bGenerateReportHTML,
    2 foCreateForException (**\modules\cBugId\cBugReport.py/93)
      > oBugReport = dfoAnalyzeException_by_uExceptionCode[oException.uCode](oBugReport, oProcess, oException);
    1 cCdbWrapper_fCdbStdInOutThread (**\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/559)
      > oBugReport = cBugReport.foCreateForException(oCdbWrapper.oCurrentProcess, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
    0 __fThreadWrapper (**\modules\cBugId\cCdbWrapper.py/266)
      > fActivity(oCdbWrapper);
  BugId version 2017-08-22 17:49
  cBugId version 2017-08-18 22:16
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06

ImportError: No module named FileSystem

C:\BugId-master\modules\cBugId>Tests.cmd
Traceback (most recent call last):
File "Tests\Tests.py", line 11, in
from cBugId import cBugId;
File "C:\BugId-master\modules\cBugId\cBugId.py", line 2, in
from cCdbWrapper import cCdbWrapper;
File "C:\BugId-master\modules\cBugId\cCdbWrapper.py", line 4, in
from cCdbWrapper_fasReadOutput import cCdbWrapper_fasReadOutput;
File "C:\BugId-master\modules\cBugId\cCdbWrapper_fasReadOutput.py", line 3, in

from FileSystem import FileSystem;
ImportError: No module named FileSystem

BugId should be able to report first chance OOM exceptions.

- An internal exception has occured:
  AssertionError(u'Expected to see exception 0x80000003 in software_reporter_tool.exe process, but got 0xC0000005!?',)
  Stack:
    2 cCdbWrapper_fCdbStdInOutThread (C:\Users\jitwei\Desktop\BugId\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/527)
      > (auIgnoreNextExceptionCodes[0], oCdbWrapper.oCurrentProcess.sBinaryName, uExceptionCode);
    1 fCdbStdInOutThread (C:\Users\jitwei\Desktop\BugId\modules\cBugId\cCdbWrapper.py/439)
      > return cCdbWrapper_fCdbStdInOutThread(oCdbWrapper);
    0 __fThreadWrapper (C:\Users\jitwei\Desktop\BugId\modules\cBugId\cCdbWrapper.py/268)
      > fActivity(*asActivityArguments);

  Windows version: Windows 10 Home release 1607, build 14393 x64
  BugId version: 2017-11-24 14:57
  cBugId version: 2017-11-24 14:47
  mFileSystem version: 2017-11-11 10:13
  mWindowsAPI version: 2017-11-24 14:05
  oConsole version: 2017-11-24 14:55
--------------------------------------------------------------------------------

Allow clean shutdown of applications

It should be possible for BugId to cleanly terminate an application by sending WM_CLOSE message to all windows associated with the processes it is debugging. A user should be able to trigger this by calling a method of BugId when a test is finished and the user wants to make sure the application can be closed without triggering any bugs during shutdown.

Crash of BugID when debugging a process

C:\temp\BugId>BugID --pids=12736

• New process 12736/0x31C0: Simple Web Server.exe

---

• An internal exception has occured:
  AssertionError('Unexpected TEB info header:Wow64 TEB32 at 0000000000fe3000\r\nWow64 TEB32 at 0000000000fe3000\r\n ExceptionList: 00000000010fdf28\r\n StackBase: 0000000001100000\r\n StackLimit: 00000000010f4000\r\n SubSystemTib: 0000000000000000\r\n FiberData: 0000000000001e00\r\n ArbitraryUserPointer: 0000000000000000\r\n Self: 0000000000fe3000\r\n EnvironmentPointer: 0000000000000000\r\n ClientId: 00000000000031c0 . 0000000000002ea0\r\n RpcHandle: 0000000000000000\r\n Tls Storage: 0000000005a5efd8\r\n PEB Address: 0000000000fe0000\r\n LastErrorValue: 0\r\n LastStatusValue: 0\r\n Count Owned Locks: 0\r\n HardErrorMode: 0\r\nWow64 TEB at 0000000000fe1000\r\n ExceptionList: 0000000000fe3000\r\n StackBase: 0000000000d8fd20\r\n StackLimit: 0000000000d88000\r\n SubSystemTib: 0000000000000000\r\n FiberData: 0000000000001e00\r\n ArbitraryUserPointer: 0000000000000000\r\n Self: 0000000000fe1000\r\n EnvironmentPointer: 0000000000000000\r\n ClientId: 00000000000031c0 . 0000000000002ea0\r\n RpcHandle: 0000000000000000\r\n Tls Storage: 0000000000000000\r\n PEB Address: 0000000000fdf000\r\n LastErrorValue: 0\r\n LastStatusValue: c0000008\r\n Count Owned Locks: 0\r\n HardErrorMode: 0',)
  Stack:
  4 foCreateForCurrentThread (C:\temp\BugId\modules\cBugId\cThreadEnvironmentBlock.py/28)
  > assert oHeaderMatch, "Unexpected TEB info header:%s\r\n%s" % (asPageHeapOutput[0], "\r\n".join(asPageHeapOutput));
  3 cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION (C:\temp\BugId\modules\cBugId\cBugReport_foAnalyzeException_STATUS_ACCESS_VIOLATION.py/193)
  > oThreadEnvironmentBlock = cThreadEnvironmentBlock.foCreateForCurrentThread(oCdbWrapper, oCdbWrapper.oCurrentProcess);
  2 foCreateForException (C:\temp\BugId\modules\cBugId\cBugReport.py/95)
  > oBugReport = dfoAnalyzeException_by_uExceptionCode[oException.uCode](oBugReport, oCdbWrapper, oException);
  1 cCdbWrapper_fCdbStdInOutThread (C:\temp\BugId\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py/452)
  > oBugReport = cBugReport.foCreateForException(oCdbWrapper, uExceptionCode, sExceptionDescription, bApplicationCannotHandleException);
  0 _fThreadWrapper (C:\temp\BugId\modules\cBugId\cCdbWrapper.py/217)
  > fActivity(oCdbWrapper);
  BugId version 2017-05-31 17:22
  cBugId version 2017-05-31 17:20
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06

---

WindowsError(5, 'Access is denied')

Hi

While running BugId with foxit I encountered an error which persisted with different inputs and even in fresh VM installations.

Here I have attached the --verbose output from a dummy input.

• Applying application specific configuration for foxit:

  • Changed config setting bApplicationTerminatesWithMainProcess from False to True.
  • Changed config setting cBugId.nExcessiveCPUUsageWormRunTime from 1 to 0.5.
  • Changed config setting nExcessiveCPUUsageCheckInitialTimeout from 5 to 10.0.
  • Changed config setting nApplicationMaxRunTime from None to 10.0.
  • Changed config setting cBugId.nExcessiveCPUUsagePercent from 90 to 75.
  • Changed config setting cBugId.nExcessiveCPUUsageCheckInterval from 10.0 to 5.0.

• Command line: C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe C:\Users\IEUser\Desktop\alp99.pdf

stdout>
stdout>Microsoft (R) Windows Debugger Version 10.0.15063.468 X86
stdout>Copyright (c) Microsoft Corporation. All rights reserved.
stdout>
stdout>CommandLine: "C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe" C:\Users\IEUser\Desktop\alp99.pdf
stdout>
stdout>************* Symbol Path validation summary **************
stdout>Response Time (ms) Location
stdout>Deferred cache*
stdout>Deferred srvhttp://msdl.microsoft.com/download/symbols
stdout>Symbol search path is: cache;srv*http://msdl.microsoft.com/download/symbols
stdout>Executable search path is:
stdout>ModLoad: 01290000 047e0000 FoxitReader_Lib_Full.exe
stdout>ModLoad: 76f50000 7708c000 ntdll.dll
stdout>ModLoad: 69c40000 69ca0000 C:\Windows\system32\verifier.dll
stdout>Page heap: pid 0xD3C: page heap enabled with flags 0x3.
stdout>ModLoad: 75a50000 75b24000 C:\Windows\system32\kernel32.dll
stdout>ModLoad: 750f0000 7513b000 C:\Windows\system32\KERNELBASE.dll
stdout>ModLoad: 754d0000 75599000 C:\Windows\system32\USER32.dll
stdout>ModLoad: 76140000 7618e000 C:\Windows\system32\GDI32.dll
stdout>ModLoad: 77170000 7717a000 C:\Windows\system32\LPK.dll
stdout>ModLoad: 75c70000 75d0d000 C:\Windows\system32\USP10.dll
stdout>ModLoad: 759a0000 75a4c000 C:\Windows\system32\msvcrt.dll
stdout>ModLoad: 73570000 73575000 C:\Windows\system32\MSIMG32.dll
stdout>ModLoad: 76ed0000 76f4b000 C:\Windows\system32\COMDLG32.dll
stdout>ModLoad: 770c0000 77117000 C:\Windows\system32\SHLWAPI.dll
stdout>ModLoad: 73e00000 73f9e000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
stdout>ModLoad: 76220000 76e6a000 C:\Windows\system32\SHELL32.dll
stdout>ModLoad: 70430000 70481000 C:\Windows\system32\WINSPOOL.DRV
stdout>ModLoad: 757a0000 75840000 C:\Windows\system32\ADVAPI32.dll
stdout>ModLoad: 75c50000 75c69000 C:\Windows\SYSTEM32\sechost.dll
stdout>ModLoad: 75420000 754c2000 C:\Windows\system32\RPCRT4.dll
stdout>ModLoad: 75840000 7599c000 C:\Windows\system32\ole32.dll
stdout>ModLoad: 76190000 7621f000 C:\Windows\system32\OLEAUT32.dll
stdout>ModLoad: 6ab80000 6ab9c000 C:\Windows\system32\oledlg.dll
stdout>ModLoad: 755c0000 7570a000 C:\Windows\system32\urlmon.dll
stdout>ModLoad: 75230000 75234000 C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
stdout>ModLoad: 74f70000 74f74000 C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
stdout>ModLoad: 74fc0000 74fc5000 C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
stdout>ModLoad: 751e0000 751e4000 C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
stdout>ModLoad: 74f80000 74f84000 C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
stdout>ModLoad: 744f0000 744f9000 C:\Windows\system32\version.DLL
stdout>ModLoad: 75140000 75143000 C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
stdout>ModLoad: 75270000 75273000 C:\Windows\system32\normaliz.DLL
stdout>ModLoad: 75d20000 75f52000 C:\Windows\system32\iertutil.dll
stdout>ModLoad: 75f60000 76136000 C:\Windows\system32\WININET.dll
stdout>ModLoad: 75210000 75227000 C:\Windows\system32\USERENV.dll
stdout>ModLoad: 74f60000 74f6b000 C:\Windows\system32\profapi.dll
stdout>ModLoad: 74f90000 74fbe000 C:\Windows\system32\WINTRUST.dll
stdout>ModLoad: 74fd0000 750f0000 C:\Windows\system32\CRYPT32.dll
stdout>ModLoad: 74f50000 74f5c000 C:\Windows\system32\MSASN1.dll
stdout>ModLoad: 72120000 72127000 C:\Windows\system32\WSOCK32.dll
stdout>ModLoad: 75b40000 75b75000 C:\Windows\system32\WS2_32.dll
stdout>ModLoad: 75d10000 75d16000 C:\Windows\system32\NSI.dll
stdout>ModLoad: 69bc0000 69bfc000 C:\Windows\system32\OLEACC.dll
stdout>ModLoad: 6f390000 6f3c2000 C:\Windows\system32\WINMM.dll
stdout>ModLoad: 73af0000 73c80000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18455_none_72d576ad8665e853\gdiplus.dll
stdout>ModLoad: 744d0000 744ec000 C:\Windows\system32\iphlpapi.dll
stdout>ModLoad: 744c0000 744c7000 C:\Windows\system32\WINNSI.DLL
stdout>ModLoad: 71450000 714a8000 C:\Windows\system32\WINHTTP.dll
stdout>ModLoad: 71400000 7144f000 C:\Windows\system32\webio.dll
stdout>ModLoad: 755a0000 755bf000 C:\Windows\system32\IMM32.dll
stdout>ModLoad: 75b80000 75c4c000 C:\Windows\system32\MSCTF.dll
stdout>ModLoad: 70300000 70312000 C:\Windows\system32\MPR.dll
stdout>ModLoad: 6e980000 6ebc5000 C:\Windows\system32\msi.dll
stdout>ModLoad: 75b30000 75b35000 C:\Windows\system32\PSAPI.DLL
stdout>ModLoad: 736e0000 736f1000 C:\Windows\system32\NETAPI32.dll
stdout>ModLoad: 736d0000 736d9000 C:\Windows\system32\netutils.dll
stdout>ModLoad: 74d40000 74d59000 C:\Windows\system32\srvcli.dll
stdout>ModLoad: 736c0000 736cf000 C:\Windows\system32\wkscli.dll
stdout>ModLoad: 67f60000 67fec000 C:\Windows\system32\ODBC32.dll
stdout>ModLoad: 6a8c0000 6a8e1000 C:\Windows\system32\MSVFW32.dll
stdout>(d3c.dbc): Break instruction exception - code 80000003 (first chance)
stdout>eax=00000000 ebx=00000000 ecx=002efa58 edx=76f970f4 esi=fffffffe edi=00000000
stdout>eip=76ff05a6 esp=002efa74 ebp=002efaa0 iopl=0 nv up ei pl zr na pe nc
stdout>cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
stdout>ntdll!LdrpDoDebuggerBreak+0x2c:
stdout>76ff05a6 cc int 3
stdout>0:000>
<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .prompt_allow -dis -ea -reg -src -sym; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Display only the prompt
stdout><�[�{
stdout>Allow the following information to be displayed at the prompt:
stdout>(Other settings can affect whether the information is actually displayed)
stdout> None
stdout>Do not allow the following information to be displayed at the prompt:
stdout> sym - Symbol for current instruction
stdout> dis - Disassembly of current instruction
stdout> ea - Effective address for current instruction
stdout> reg - Register state
stdout> src - Source info for current instruction
stdout>}�]�>
stdout>0:000>
<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .pcmd -s ".echo;"; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Output a CRLF after running the application
stdout><�[�{
stdout>Set prompt command
stdout>Per-prompt command is '.echo;'
stdout>}�]�>
stdout>0:000>
<stdin<
stdout>0:000>
<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .lastevent; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get information about last event
stdout><�[�{
stdout>Last event: d3c.dbc: Break instruction exception - code 80000003 (first chance)
stdout> debugger time: Fri Sep 22 04:34:35.523 2017 (UTC - 7:00)
stdout>}�]�>
stdout>0:000>
<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ !peb; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get current proces environment block
stdout><�[�{
stdout>PEB at 7ffdc000
stdout> InheritedAddressSpace: No
stdout> ReadImageFileExecOptions: No
stdout> BeingDebugged: Yes
stdout> ImageBaseAddress: 01290000
stdout> Ldr 77027880
stdout> Ldr.Initialized: Yes
stdout> Ldr.InInitializationOrderModuleList: 00071f98 . 0066cf98
stdout> Ldr.InLoadOrderModuleList: 0006ff88 . 0066cf88
stdout> Ldr.InMemoryOrderModuleList: 0006ff90 . 0066cf90
stdout> Base TimeStamp Module
stdout> 1290000 599fd9c5 Aug 25 01:03:17 2017 C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe
stdout> 76f50000 521ea91c Aug 28 18:51:24 2013 C:\Windows\SYSTEM32\ntdll.dll
stdout> 69c40000 4a5bdb2a Jul 13 18:11:06 2009 C:\Windows\system32\verifier.dll
stdout> 75a50000 531599f5 Mar 04 01:16:37 2014 C:\Windows\system32\kernel32.dll
stdout> 750f0000 531599f6 Mar 04 01:16:38 2014 C:\Windows\system32\KERNELBASE.dll
stdout> 754d0000 4ce7ba26 Nov 20 04:08:06 2010 C:\Windows\system32\USER32.dll
stdout> 76140000 53f7f199 Aug 22 18:42:49 2014 C:\Windows\system32\GDI32.dll
stdout> 77170000 51b0158a Jun 05 21:52:26 2013 C:\Windows\system32\LPK.dll
stdout> 75c70000 5359c2c9 Apr 24 19:04:57 2014 C:\Windows\system32\USP10.dll
stdout> 759a0000 4eeaf722 Dec 15 23:45:38 2011 C:\Windows\system32\msvcrt.dll
stdout> 73570000 4a5bdaa0 Jul 13 18:08:48 2009 C:\Windows\system32\MSIMG32.dll
stdout> 76ed0000 4ce7b82d Nov 20 03:59:41 2010 C:\Windows\system32\COMDLG32.dll
stdout> 770c0000 4ce7b9e2 Nov 20 04:06:58 2010 C:\Windows\system32\SHLWAPI.dll
stdout> 73e00000 4ce7b71c Nov 20 03:55:08 2010 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
stdout> 76220000 5330e506 Mar 24 19:08:06 2014 C:\Windows\system32\SHELL32.dll
stdout> 70430000 4ce7ba4b Nov 20 04:08:43 2010 C:\Windows\system32\WINSPOOL.DRV
stdout> 757a0000 521ea86a Aug 28 18:48:26 2013 C:\Windows\system32\ADVAPI32.dll
stdout> 75c50000 4a5bdb04 Jul 13 18:10:28 2009 C:\Windows\SYSTEM32\sechost.dll
stdout> 75420000 53c334f3 Jul 13 18:40:03 2014 C:\Windows\system32\RPCRT4.dll
stdout> 75840000 4ce7b96f Nov 20 04:05:03 2010 C:\Windows\system32\ole32.dll
stdout> 76190000 5441c30c Oct 17 18:31:56 2014 C:\Windows\system32\OLEAUT32.dll
stdout> 6ab80000 4a5bdace Jul 13 18:09:34 2009 C:\Windows\system32\oledlg.dll
stdout> 755c0000 545ad36d Nov 05 17:48:29 2014 C:\Windows\system32\urlmon.dll
stdout> 75230000 50f322ec Jan 13 13:11:08 2013 C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
stdout> 74f70000 50f3244f Jan 13 13:17:03 2013 C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
stdout> 74fc0000 50f3243a Jan 13 13:16:42 2013 C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
stdout> 751e0000 50f322f9 Jan 13 13:11:21 2013 C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
stdout> 74f80000 50f322eb Jan 13 13:11:07 2013 C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
stdout> 744f0000 4a5bdb2b Jul 13 18:11:07 2009 C:\Windows\system32\version.DLL
stdout> 75140000 50f3244e Jan 13 13:17:02 2013 C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
stdout> 75270000 4a5bdad4 Jul 13 18:09:40 2009 C:\Windows\system32\normaliz.DLL
stdout> 75d20000 545ae56b Nov 05 19:05:15 2014 C:\Windows\system32\iertutil.dll
stdout> 75f60000 545ad456 Nov 05 17:52:22 2014 C:\Windows\system32\WININET.dll
stdout> 75210000 4ce7ba28 Nov 20 04:08:08 2010 C:\Windows\system32\USERENV.dll
stdout> 74f60000 4a5bbf41 Jul 13 16:12:01 2009 C:\Windows\system32\profapi.dll
stdout> 74f90000 51db9720 Jul 08 21:52:48 2013 C:\Windows\system32\WINTRUST.dll
stdout> 74fd0000 52506fc6 Oct 05 13:00:06 2013 C:\Windows\system32\CRYPT32.dll
stdout> 74f50000 4ce7b8c9 Nov 20 04:02:17 2010 C:\Windows\system32\MSASN1.dll
stdout> 72120000 4a5bdb63 Jul 13 18:12:03 2009 C:\Windows\system32\WSOCK32.dll
stdout> 75b40000 4ce7ba68 Nov 20 04:09:12 2010 C:\Windows\system32\WS2_32.dll
stdout> 75d10000 4a5bdad9 Jul 13 18:09:45 2009 C:\Windows\system32\NSI.dll
stdout> 69bc0000 4e587028 Aug 26 21:18:48 2011 C:\Windows\system32\OLEACC.dll
stdout> 6f390000 4ce7ba42 Nov 20 04:08:34 2010 C:\Windows\system32\WINMM.dll
stdout> 73af0000 535b14fb Apr 25 19:07:55 2014 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18455_none_72d576ad8665e853\gdiplus.dll
stdout> 744d0000 4ce7b859 Nov 20 04:00:25 2010 C:\Windows\system32\iphlpapi.dll
stdout> 744c0000 4a5bdb43 Jul 13 18:11:31 2009 C:\Windows\system32\WINNSI.DLL
stdout> 71450000 4ce7ba3e Nov 20 04:08:30 2010 C:\Windows\system32\WINHTTP.dll
stdout> 71400000 4ec49b76 Nov 16 21:28:22 2011 C:\Windows\system32\webio.dll
stdout> 755a0000 4ce7b845 Nov 20 04:00:05 2010 C:\Windows\system32\IMM32.dll
stdout> 75b80000 4a5bda69 Jul 13 18:07:53 2009 C:\Windows\system32\MSCTF.dll
stdout> 70300000 4a5bda36 Jul 13 18:07:02 2009 C:\Windows\system32\MPR.dll
stdout> 6e980000 538d9534 Jun 03 02:28:20 2014 C:\Windows\system32\msi.dll
stdout> 75b30000 4a5bdace Jul 13 18:09:34 2009 C:\Windows\system32\PSAPI.DLL
stdout> 736e0000 4ff4b0f6 Jul 04 14:09:10 2012 C:\Windows\system32\NETAPI32.dll
stdout> 736d0000 4ce795a6 Nov 20 01:32:22 2010 C:\Windows\system32\netutils.dll
stdout> 74d40000 4ce7ba1f Nov 20 04:07:59 2010 C:\Windows\system32\srvcli.dll
stdout> 736c0000 4ce795a7 Nov 20 01:32:23 2010 C:\Windows\system32\wkscli.dll
stdout> 67f60000 4ce7b964 Nov 20 04:04:52 2010 C:\Windows\system32\ODBC32.dll
stdout> 6a8c0000 4ce7b8e3 Nov 20 04:02:43 2010 C:\Windows\system32\MSVFW32.dll
stdout> SubSystemData: 00000000
stdout> ProcessHeap: 00060000
stdout> ProcessParameters: 00069780
stdout> CurrentDirectory: 'C:\Users\IEUser\Desktop\BugId'
stdout> WindowTitle: 'C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe'
stdout> ImageFile: 'C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe'
stdout> CommandLine: '"C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe" C:\Users\IEUser\Desktop\alp99.pdf'
stdout> DllPath: 'C:\Program Files\Foxit Software\Foxit Reader;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files\Windows Kits\10\Debuggers\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Python27'
stdout> Environment: 00067490
stdout> =::=::
stdout> =C:=C:\Users\IEUser\Desktop\BugId
stdout> ALLUSERSPROFILE=C:\ProgramData
stdout> APPDATA=C:\Users\IEUser\AppData\Roaming
stdout> CommonProgramFiles=C:\Program Files\Common Files
stdout> COMPUTERNAME=IE11WIN7
stdout> ComSpec=C:\Windows\system32\cmd.exe
stdout> FP_NO_HOST_CHECK=NO
stdout> HOMEDRIVE=C:
stdout> HOMEPATH=\Users\IEUser
stdout> LOCALAPPDATA=C:\Users\IEUser\AppData\Local
stdout> LOGONSERVER=\IE11WIN7
stdout> MpConfig_ProductAppDataPath=C:\ProgramData\Microsoft\Windows Defender
stdout> MpConfig_ProductCodeName=AntiSpyware
stdout> MpConfig_ProductPath=C:\Program Files\Windows Defender
stdout> MpConfig_ProductUserAppDataPath=C:\Users\IEUser\AppData\Local\Microsoft\Windows Defender
stdout> MpConfig_ReportingGUID=89687C42-ABBB-F007-BE98-6B4119C36E93
stdout> NUMBER_OF_PROCESSORS=1
stdout> OS=Windows_NT
stdout> Path=C:\Program Files\Windows Kits\10\Debuggers\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Python27
stdout> PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
stdout> PROCESSOR_ARCHITECTURE=x86
stdout> PROCESSOR_IDENTIFIER=x86 Family 6 Model 37 Stepping 2, GenuineIntel
stdout> PROCESSOR_LEVEL=6
stdout> PROCESSOR_REVISION=2502
stdout> ProgramData=C:\ProgramData
stdout> ProgramFiles=C:\Program Files
stdout> PROMPT=$P$G
stdout> PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules
stdout> PUBLIC=C:\Users\Public
stdout> PYTHON="C:\Python27\python.exe"
stdout> SESSIONNAME=Console
stdout> SystemDrive=C:
stdout> SystemRoot=C:\Windows
stdout> TEMP=C:\Users\IEUser\AppData\Local\Temp
stdout> TMP=C:\Users\IEUser\AppData\Local\Temp
stdout> USERDOMAIN=IE11WIN7
stdout> USERNAME=IEUser
stdout> USERPROFILE=C:\Users\IEUser
stdout> windir=C:\Windows
stdout>}�]�>
stdout>0:000>
<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ lmov a 0x1290000; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get module information
stdout><�[�{
stdout>start end module name
stdout>01290000 047e0000 FoxitReader_Lib_Full (deferred)
stdout> Image path: FoxitReader_Lib_Full.exe
stdout> Image name: FoxitReader_Lib_Full.exe
stdout> Timestamp: Fri Aug 25 01:03:17 2017 (599FD9C5)
stdout> CheckSum: 034D9FB0
stdout> ImageSize: 03550000
stdout> File version: 8.3.2.25013
stdout> Product version: 8.3.2.25013
stdout> File flags: 0 (Mask 3F)
stdout> File OS: 4 Unknown Win32
stdout> File type: 1.0 App
stdout> File date: 00000000.00000000
stdout> Translations: 0000.04b0
stdout> CompanyName: Foxit Software Inc.
stdout> ProductName: Foxit Reader
stdout> InternalName: Foxit Reader.exe
stdout> OriginalFilename: Foxit Reader.EXE
stdout> ProductVersion: 8.3.2.25013
stdout> FileVersion: 8.3.2.25013
stdout> PrivateBuild: 8.3.2.25013
stdout> SpecialBuild: 8.3.2.25013
stdout> FileDescription: Foxit Reader 8.3
stdout> LegalCopyright: Copyright © 2004-2017 Foxit Software Inc. All Rights Reserved.
stdout> LegalTrademarks: Copyright © 2004-2017 Foxit Software Inc. All Rights Reserved.
stdout> Comments: Copyright © 2004-2017 Foxit Software Inc. All Rights Reserved.
stdout>}�]�>
stdout>0:000>

• New process 3388/0xD3C: foxitreader_lib_full.exe
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .childdbg 1; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Debug child processes
  stdout><�[�{
  stdout>Processes created by the current process will be debugged
  stdout>}�]�>
  stdout>0:000>
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ sxd *;sxi ld;sxi ud;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC0000008;sxd 0xC0000235;sxd 0x80000004;sxd 0x4000001E;sxd 0xE06D7363;sxd 0x40080201;sxd 0x40080202;sxe cpr;sxe ibp;sxe epr;sxe aph;sxe 0xC0000005;sxe 0xC0000420;sxe 0x80000003;sxe 0xC000008C;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0xC0000409;sxe 0xC00000FD;sxe 0x4000001F;sxe 0x80000007; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Setup exception handling
  stdout><�[�{
  stdout>}�]�>
  stdout>0:000>
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .time; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get debugger time
  stdout><�[�{
  stdout>Debug session time: Fri Sep 22 04:34:35.794 2017 (UTC - 7:00)
  stdout>System Uptime: 0 days 1:00:01.858
  stdout>Process Uptime: 0 days 0:00:00.360
  stdout> Kernel time: 0 days 0:00:00.040
  stdout> User time: 0 days 0:00:00.010
  stdout>}�]�>
  stdout>0:000>
  <stdin<gn;
  stdout>(d3c.22c): C++ EH exception - code e06d7363 (first chance)
  stdout>(d3c.22c): C++ EH exception - code e06d7363 (first chance)
  stdout>(d3c.22c): C++ EH exception - code e06d7363 (first chance)
  stdout>StopRequest(d3c.904): Break instruction exception - code 80000003 (first chance)
  stdout>
  stdout>0:007>
  <stdin<
  stdout>0:007>
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .lastevent; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get information about last event
  stdout><�[�{
  stdout>Last event: d3c.904: Break instruction exception - code 80000003 (first chance)
  stdout> debugger time: Fri Sep 22 04:34:45.808 2017 (UTC - 7:00)
  stdout>}�]�>
  stdout>0:007>
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .exr -1; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get exception record
  stdout><�[�{
  stdout>ExceptionAddress: 76f84108 (ntdll!DbgBreakPoint)
  stdout> ExceptionCode: 80000003 (Break instruction exception)
  stdout> ExceptionFlags: 00000000
  stdout>NumberParameters: 3
  stdout> Parameter[0]: 00000000
  stdout> Parameter[1]: 8501d968
  stdout> Parameter[2]: 76fef1d3
  stdout>}�]�>
  stdout>0:007>
  <stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ lmov m ntdll; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get module information
  stdout><�[�{
  stdout>start end module name
  stdout>76f50000 7708c000 ntdll (pdb symbols) C:\Program Files\Windows Kits\10\Debuggers\x86\sym\ntdll.pdb\CD4062A231154A17A18DAE7D1A0FBACC2\ntdll.pdb
  stdout> Loaded symbol image file: C:\Windows\SYSTEM32\ntdll.dll
  stdout> Image path: ntdll.dll
  stdout> Image name: ntdll.dll
  stdout> Timestamp: Wed Aug 28 18:51:24 2013 (521EA91C)
  stdout> CheckSum: 00141148
  stdout> ImageSize: 0013C000
  stdout> File version: 6.1.7601.18247
  stdout> Product version: 6.1.7601.18247
  stdout> File flags: 0 (Mask 3F)
  stdout> File OS: 40004 NT Win32
  stdout> File type: 2.0 Dll
  stdout> File date: 00000000.00000000
  stdout> Translations: 0409.04b0
  stdout> CompanyName: Microsoft Corporation
  stdout> ProductName: Microsoft® Windows® Operating System
  stdout> InternalName: ntdll.dll
  stdout> OriginalFilename: ntdll.dll
  stdout> ProductVersion: 6.1.7601.18247
  stdout> FileVersion: 6.1.7601.18247 (win7sp1_gdr.130828-1532)
  stdout> FileDescription: NT Layer DLL
  stdout> LegalCopyright: © Microsoft Corporation. All rights reserved.
  stdout>}�]�>
  stdout>0:007>

• T+10.0 The application has been running for 10.0 seconds without crashing.

<stdin<.printf "%c%c%c%c%c\r\n", 0x3C, 0x1, 0x5B, 0x2, 0x7B; .block{ .time; }; .printf "%c%c%c%c%c\r\n", 0x7D, 0x2, 0x5D, 0x1, 0x3E; $$ Get debugger time

• An internal exception has occured:
  WindowsError(5, 'Access is denied')
  Stack:
  4 _execute_child (C:\Python27\lib\subprocess.py/640)
  > startupinfo)
  3 init (C:\Python27\lib\subprocess.py/390)
  > errread, errwrite)
  2 fKillProcessesUntilTheyAreDead (c:\users\ieuser\desktop\bugid\modules\Kill\fKillProcessesUntilTheyAreDead.py/15)
  > oKillProcess = subprocess.Popen(asKillCommand, stdout=subprocess.PIPE, stderr=subprocess.PIPE);
  1 cCdbWrapper_fCdbCleanupThread (c:\users\ieuser\desktop\bugid\modules\cBugId\cCdbWrapper_fCdbCleanupThread.py/38)
  > Kill.fKillProcessesUntilTheyAreDead(oCdbWrapper.doProcess_by_uId.keys());
  0 __fThreadWrapper (c:\users\ieuser\desktop\bugid\modules\cBugId\cCdbWrapper.py/262)
  > fActivity(oCdbWrapper);
  BugId version 2017-09-18 16:24
  cBugId version 2017-09-18 14:28
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06

---

Please report the above details at the below web-page so it can be addressed:
https://github.com/SkyLined/BugId/issues/new
If you do not have a github account, or you want to report this issue
privately, you can also send an email to:
[email protected]

In your report, please copy the information about the exception reported
above, as well as the stack trace and BugId version information. This makes
it easier to determine the cause of this issue and makes for faster fixes.

If you can reproduce the issue, it would help a lot if you can run BugId in
verbose mode by adding the --verbose command-line argument.
as in:BugId -v --verbose foxit -- C:\Users\IEUser\Desktop\alp99.pdf

Thank you in advance for helping to improve BugId!

Unrecognized module basic information output

It's for a VLC player x64 dll:

- An internal exception has occured:
  AssertionError('Unrecognized module basic information output: 00000000`75920000 00000000`75941000   liba52tofloat32_plugin T
(export symbols)       z:\\sharedinvm\\vlctest\\vlc-2.2.7\\plugins\\audio_filter\\liba52tofloat32_plugin.dll',)
  Stack:
   11 ftxParse_lm_OutputAddresssesCdbIdAndSymbolStatus (Z:\secprogs\bugidlatest\modules\cBugId\cModule.py/196)
      > "Unrecognized module basic information output: %s" % s_lm_OutputLine;
   10 __foGetOrCreateFrom_lmov (Z:\secprogs\bugidlatest\modules\cBugId\cModule.py/148)
      > (uStartAddress, uEndAddress, sCdbId, sSymbolStatus) = cModule.ftxParse_lm_OutputAddresssesCdbIdAndSymbolStatus(as_lmov_
Output[1]);
....
  Windows version: Windows 10 Pro release 1607, build 14393 x64
  BugId version: 2017-11-24 14:57
  cBugId version: 2017-11-24 14:47
  mFileSystem version: 2017-11-11 10:13
  mWindowsAPI version: 2017-11-24 14:05
  oConsole version: 2017-11-24 14:55

access denied -> python hanging forever, report never written

foxit reader (well anything really),

 * T+19.1 Exception code 0xC0000005 (Access violation) was detected and is being analyzed...
Exception in thread Thread-4:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 552, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 505, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\BugId-master\modules\cBugId\cCdbWrapper.py", line 213, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "C:\BugId-master\modules\cBugId\cCdbWrapper.py", line 207, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\BugId-master\modules\cBugId\cCdbWrapper_fCdbCleanupThread.py", line 1
6, in cCdbWrapper_fCdbCleanupThread
    oCdbWrapper.oCdbProcess.terminate();
  File "C:\Python27\lib\subprocess.py", line 1016, in terminate
    _subprocess.TerminateProcess(self._handle, 1)
WindowsError: [Error 5] Access is denied

normal win7x64, no special setup

@application? broken

C:\Users\kkuehl\Downloads\BugId>python ./BugId.py @application?
* Command line: @application?
--------------------------------------------------------------------------------

- Failed to debug the application:
This version of BugId is provided free of charge for non-commercial use only.
  The executable "@application?" was not found.
If you find it useful and would like to make a donation, you can send bitcoin
--------------------------------------------------------------------------------
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX.

If you wish to use BugId commercially, please contact the author to request a
quote. Contact and licensing information can be found at:
    https://github.com/SkyLined/BugId#license.

Timezone re.match issue

File "\BugId\modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py", line 19, in fnGetDebuggerTime
assert oTimeMatch, "Cannot parse debugger time: %s" % repr(sDebuggerTime);
AssertionError: Cannot parse debugger time: 'Sun Oct 9 01:26:16.841 2016 (UTC - 7:00)'

r"(\w+ + \d+:\d+)", # Timezone (don't care).
==>
r"((\w+) (-|+) (\d+:\d+))"

Exception 'cErrorReport_foSpecialErrorReport_STATUS_STACK_OVERFLOW'

Hi!

Here is my output from Win7 x32 when playing with a toy program:

C:\class\cdf>python C:\BugId\BugId.py C:\class\cdf\cdf_reader.exe C:\crashes\cdf_reader_241406974\crash1.cdf
* The debugger is starting the application...
  Command line: C:\class\cdf\cdf_reader.exe C:\crashes\cdf_reader_241406974\crash1.cdf
* New process 1616.
* The application was started successfully and is running...
* Exception code 0xC0000005 (Access violation) was detected and is being analyzed...
Exception in thread Thread-1:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 810, in __bootstrap_inner
    self.run()
  File "C:\Python27\lib\threading.py", line 763, in run
    self.__target(*self.__args, **self.__kwargs)
  File "C:\BugId\cCdbWrapper.py", line 92, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "C:\BugId\cCdbWrapper_fCdbDebuggerThread.py", line 153, in cCdbWrapper_fCdbDebuggerThread
    oCdbWrapper.oErrorReport = cErrorReport.foCreate(oCdbWrapper, uExceptionCode, sExceptionDescription);
  File "C:\BugId\cErrorReport.py", line 95, in foCreate
    oErrorReport = foSpecialErrorReport(oErrorReport, oCdbWrapper);
  File "C:\BugId\cErrorReport_foSpecialErrorReport_STATUS_ACCESS_VIOLATION.py", line 204, in cErrorReport_foSpecialErrorReport_STATUS_ACCESS_VIOLATION
    return cErrorReport_foSpecialErrorReport_STATUS_STACK_OVERFLOW(oErrorReport, oCdbWrapper);
NameError: global name 'cErrorReport_foSpecialErrorReport_STATUS_STACK_OVERFLOW' is not defined

Some info: It turns out that indeed this is a stack overflow (my stack is completely smashed) and I managed to reproduce this issue on Windows XP as well.

If you need more info on how to reproduce it, please let me know.
Thanks for sharing this project, it works really great with identifying the rest of my bugs.

Cheers.

UnboundLocalError

UnboundLocalError("local variable 'uMaxCPUProcessId' referenced before assignment",) ..
This was triggered on closing the tested application (IE) with out closing it on the terminal.

Document `--collateral` switch

It would be nice if BugId could try to allow the application to continue to run after issues such as use-after-frees or out of bounds reads by temporarily making the inaccessible memory accessible and filling it with a specific marker value. After the instruction that originally cause the AV has been executed without causing an AV this time, the memory should be restored to its original state and the application can continue.

This would allow you to get an idea of what you might be able to do when you can control the memory the application is incorrectly accessing.

bugid.py --version not working

`
h:\bugidnew>BugId.py --version

• An internal exception has occured:
  AttributeError("'cConsole' object has no attribute 'oVersionInformation'",)
  Stack:
  2 fVersionCheck (H:\bugidnew\fVersionCheck.py/15)
  > ("oConsole", "oConsole", oConsole.oVersionInformation),
  1 fuMain (H:\secprogs\bugidnew\BugId.py/589)
  > fVersionCheck();
  0 H:\secprogs\bugidnew\BugId.py/881
  > uExitCode = fuMain(sys.argv[1:]);

  Windows version: Windows 10 Pro release 1607, build 14393
  BugId version: 2017-10-25 10:01
  cBugId version: 2017-11-01 16:21
  mFileSystem version: 2017-11-01 16:16
  mWindowsAPI version: 2017-11-01 16:15
  Traceback (most recent call last):
  File "H:\bugidnew\BugId.py", line 895, in
  fDumpExceptionAndExit(oException, oTraceBack);
  File "H:\bugidnew\fDumpExceptionAndExit.py", line 33, in fDumpExceptionAndExit
  oConsole.fPrint(ERROR," ", sModule, " version: ", xModule.oVersionInformation.sCurrentVersion);
  AttributeError: 'cConsole' object has no attribute 'oVersionInformation'

H:\bugidnew>`

Irrelevant Stack Trace Analyzed in Edge

I realised this would be of no use.

Make binaries statically compiled

The binaries currently rely on VSCRT being installed, which people may not be aware of. They should probably be statically compiled to remove the dependencies and make it work without having to install VSCRT.

Create dev branch

Development of new features should happen in a separate dev branch, so regular users do not experience wildly unreliable code.

Add support for Type Confusion Detection

Hi @SkyLined

I have an idea of detecting Heap Based Type Confusion vulnerabilities.

Suppose: Heap Chunk UserAddress = 0x41414141 and size is 10 and the crash occurred while dereferencing [eax + 20] where eax = 0x41414141.

So, the question is why the OOB Read occurred as there were no arithmetic done on the pointer. Basically it means that EAX was supposed to be Object A but got Object B.

Thanks.

adobe reader support

Hi,

Trying to spawn adobe reader under BugId I end up with this:

$ python BugId.py "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
+ The debugger is starting the application...
  Command line: c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
+ The application was started successfully and is running...
  * T+0.0 Exception code 0x80000003 (Break instruction exception) was detected and is being analyzed...
  * T+0.0 The application was resumed successfully and is running...
  * T+3.5 Exception code 0xC0000235 (Unknown exception) was detected and is being analyzed...
+ BugId run into an internal error:
  AssertionError('The exception address 0x7786bb47 was not found on the stack\r\n00 0065f35c 7569c585 ntdll!ZwClose+0x12\r\n01 0065f36c 75df1418 KERNELBASE!CloseHandle+0x2d\r\n02 0065f37c 5f73de16 kernel32!CloseHandleImplementation+0x3f\r\nWARNING: Stack unwind information not available. Following frames may be wrong.\r\n03 0065f390 6036f2a1 libcef+0xdde16\r\n04 0065f398 60810032 libcef!cef_time_to_timet+0x1a338\r\n05 0065f400 616a28dc libcef!cef_time_to_timet+0x4bb0c9\r\n06 0065f418 616a2771 libcef!TerminateProcessWithoutDump+0xa808f1\r\n07 0065f434 616a2393 libcef!TerminateProcessWithoutDump+0xa80786\r\n08 0065f5f0 60ebfc28 libcef!TerminateProcessWithoutDump+0xa803a8\r\n09 0065f604 60ebfb86 libcef!TerminateProcessWithoutDump+0x29dc3d\r\n0a 0065f650 60ebf52e libcef!TerminateProcessWithoutDump+0x29db9b\r\n0b 0065f660 60333de9 libcef!TerminateProcessWithoutDump+0x29d543\r\n0c 0065f730 60311e53 libcef!cef_string_list_value+0x7094\r\n0d 0065f754 0029fb59 libcef!cef_execute_process+0x3b\r\n0e 0065f770 0027357c RdrCEF!IsSandboxedProcess+0x2bab0\r\n0f 0065f950 002fdfef RdrCEF!GetHandleVerifier+0x952c\r\n10 0065f99c 75df338a RdrCEF!IsSandboxedProcess+0x89f46\r\n11 0065f9a8 77a39902 kernel32!BaseThreadInitThunk+0xe\r\n12 0065f9e8 77a398d5 ntdll!__RtlUserThreadStart+0x70\r\n13 0065fa00 00000000 ntdll!_RtlUserThreadStart+0x1b',)

  Please report this issue at the below web-page so it can be addressed:
  https://github.com/SkyLined/BugId/issues/new

BugId version 2016.09.08.1416, cBugId version 2016.09.08.1356
This version of BugId is provided free of charge for non-commercial use only.
If you find it useful and would like to make a donation, you can send bitcoin
to 183yyxa9s1s1f7JBpPHPmzQ346y91Rx5DX. Please contact the author if you wish to
use BugId commercially. Contact and licensing information can be found at
https://github.com/SkyLined/BugId#license.
Exception in thread Thread-1:
Traceback (most recent call last):
  File "C:\python27\lib\threading.py", line 552, in __bootstrap_inner
    self.run()
  File "C:\python27\lib\threading.py", line 505, in run
    self.__target(*self.__args, **self.__kwargs)
  File "modules\cBugId\cCdbWrapper.py", line 213, in _fThreadWrapper
    oCdbWrapper.fInternalExceptionCallback(oException);
  File "modules\cBugId\cCdbWrapper.py", line 207, in _fThreadWrapper
    fActivity(oCdbWrapper);
  File "modules\cBugId\cCdbWrapper_fCdbStdInOutThread.py", line 274, in cCdbWrapper_fCdbStdInOutThread
    oCdbWrapper.oBugReport = cBugReport.foCreateForException(oCdbWrapper, uExceptionCode, sExceptionDescription);
  File "modules\cBugId\cBugReport.py", line 87, in foCreateForException
    oException = cException.foCreate(oCdbWrapper, uExceptionCode, sExceptionDescription, oStack);
  File "modules\cBugId\cException.py", line 187, in foCreate
    (sCdbLine, "\r\n".join(oStack.asCdbLines)));
AssertionError: The exception address 0x7786bb47 was not found on the stack
00 0065f35c 7569c585 ntdll!ZwClose+0x12
01 0065f36c 75df1418 KERNELBASE!CloseHandle+0x2d
02 0065f37c 5f73de16 kernel32!CloseHandleImplementation+0x3f
WARNING: Stack unwind information not available. Following frames may be wrong.
03 0065f390 6036f2a1 libcef+0xdde16
04 0065f398 60810032 libcef!cef_time_to_timet+0x1a338
05 0065f400 616a28dc libcef!cef_time_to_timet+0x4bb0c9
06 0065f418 616a2771 libcef!TerminateProcessWithoutDump+0xa808f1
07 0065f434 616a2393 libcef!TerminateProcessWithoutDump+0xa80786
08 0065f5f0 60ebfc28 libcef!TerminateProcessWithoutDump+0xa803a8
09 0065f604 60ebfb86 libcef!TerminateProcessWithoutDump+0x29dc3d
0a 0065f650 60ebf52e libcef!TerminateProcessWithoutDump+0x29db9b
0b 0065f660 60333de9 libcef!TerminateProcessWithoutDump+0x29d543
0c 0065f730 60311e53 libcef!cef_string_list_value+0x7094
0d 0065f754 0029fb59 libcef!cef_execute_process+0x3b
0e 0065f770 0027357c RdrCEF!IsSandboxedProcess+0x2bab0
0f 0065f950 002fdfef RdrCEF!GetHandleVerifier+0x952c
10 0065f99c 75df338a RdrCEF!IsSandboxedProcess+0x89f46
11 0065f9a8 77a39902 kernel32!BaseThreadInitThunk+0xe
12 0065f9e8 77a398d5 ntdll!__RtlUserThreadStart+0x70
13 0065fa00 00000000 ntdll!_RtlUserThreadStart+0x1b

BugId can no longer start a process from a binary path containing space.

When attempting to add support to pass --sDefaultBrowserTestURL from the command line with the following small patch:

C:\Users\kkuehl\Downloads\BugId>git diff
diff --git a/BugId.py b/BugId.py
index 7ebe72a..c94ddb9 100644
--- a/BugId.py
+++ b/BugId.py
@@ -632,6 +632,8 @@ def fuMain(asArguments):
           oConsole.fPrint(ERROR, "- You must specify \"true\" or \"false\" for ", ERROR_INFO, "--", sSettingName);
       elif sSettingName in ["test-internal-error", "internal-error-test"]:
         raise Exception("Testing internal error");
+      elif sSettingName in ["sDefaultBrowserTestURL"]:
+        asApplicationOptionalArguments = [sValue]
       else:
         try:
           xValue = json.loads(sValue);

I received the following error:
C:\Users\kkuehl\Downloads\BugId>python ./BugId.py "C:\Program Files\Internet Explorer\iexplore.exe" --nApplicationMaxRunTime=10 --sDefaultBrowserTestURL=http://www.google.com

• Command line: C:\Program Files\Internet Explorer\iexplore.exe http://www.google.com

---

• An internal exception has occured:
  AssertionError('End-of-command-output marker missing:\r\nCommandLine: C:\Program Files\Internet Explorer\iexplore.exe\r\nCreate will proceed with next execution\r\n ^ Extra character error in ' .create "C:\Program Files\Internet Explorer\iexplore.exe'',)
  Stack:
  3 cCdbWrapper_fasExecuteCdbCommand (C:\Users\kkuehl\Downloads\cBugId\cCdbWrapper_fasExecuteCdbCommand.py/84)
  > "End-of-command-output marker missing:\r\n%s" % "\r\n".join(oEndOfCommandOutputMarkerMissingException.asCommandOutput);
  2 fasExecuteCdbCommand (C:\Users\kkuehl\Downloads\cBugId\cCdbWrapper.py/411)
  > return cCdbWrapper_fasExecuteCdbCommand(oCdbWrapper, *axArguments, **dxArguments);
  1 cCdbWrapper_fCdbStdInOutThread (C:\Users\kkuehl\Downloads\cBugId\cCdbWrapper_fCdbStdInOutThread.py/191)
  > sComment = "Start application command",
  0 __fThreadWrapper (C:\Users\kkuehl\Downloads\cBugId\cCdbWrapper.py/261)
  > fActivity(oCdbWrapper);

  Windows version: Windows 10 Pro release 1703, build 15063
  BugId version: 2017-11-21 16:04
  cBugId version: 2017-11-21 16:02
  mFileSystem version: 2017-11-11 10:13
  mWindowsAPI version: 2017-11-21 12:32
  oConsole version: 2017-11-21 15:58

---

Please report the above details at the below web-page so it can be addressed:

This diff also fails with the same backtrace:

C:\Users\kkuehl\Downloads\BugId>git diff
diff --git a/BugId.py b/BugId.py
index 7ebe72a..d48d3f1 100644
--- a/BugId.py
+++ b/BugId.py
@@ -516,7 +516,7 @@ def fNewProcessHandler(oBugId, uProcessId, sBinaryName, sCommandLine):
   if gasAttachToProcessesForExecutableNames:
     oBugId.fAttachToProcessesForExecutableNames(*gasAttachToProcessesForExecutableNames);

-def fuMain(asArguments):
+def fuMain(asArguments, url):
   global gbVerbose, gbQuiet, gasAttachToProcessesForExecutableNames;
   if len(asArguments) == 0:
     fPrintLogo();
@@ -528,7 +528,7 @@ def fuMain(asArguments):
   auApplicationProcessIds = [];
   sUWPApplicationPackageName = None;
   sUWPApplicationId = None;
-  asApplicationOptionalArguments = None;
+  asApplicationOptionalArguments = url;
   sApplicationISA = None;
   bRepeat = False;
   bCheckForUpdates = False;
@@ -896,7 +896,8 @@ def fuMain(asArguments):

 if __name__ == "__main__":
   try:
-    uExitCode = fuMain(sys.argv[1:]);
+    # My personal project passes a url as a single item list here.
+    uExitCode = fuMain(sys.argv[1:], ['http://www.google.com']);

     if not gbQuiet and dxConfig["bShowLicenseAndDonationInfo"]:
       oConsole.fPrint();

....
asApplicationOptionalArguments = url

In the previous release of BugId/cBugId this worked, now it seems broken.
Let me know if there is any additional information I can provide.

Add easy way to ignore specific exceptions.

• easy way to ignore/pass certain / custom exceptions
• easy way of ignoring cpu usage bugs (my fuzzer is shitty :D)

Crash on Windows 7 environment

Hi,

I am not sure if its related to Windows 7, but this is a crash I am getting on such a system:

C:\Users\Noam\Downloads\BugId>bugid
--------------------------------------------------------------------------------
- An internal exception has occured:
  NameError("global name 'asBugIdLogoPrintArguments' is not defined",)
  Stack:
    2 fPrintLogo (C:\Users\Noam\Downloads\BugId\fPrintLogo.py/56)
      > oConsole.fPrint(*asBugIdLogoPrintArguments);
    1 fuMain (C:\Users\Noam\Downloads\BugId\BugId.py/496)
      > fPrintLogo();
    0 C:\Users\Noam\Downloads\BugId\BugId.py/810
      > uExitCode = fuMain(sys.argv[1:]);
  BugId version 2017-06-22 01:28
  cBugId version 2017-06-23 09:47
  FileSystem version 2017-05-12 12:04
  Kill version 2017-05-12 12:06
--------------------------------------------------------------------------------

assertion error

when i start bugid for IE11 64 i get the following assertion:

C:\Users\xxx\Downloads\BugId-master (1)\BugId-master>python BugId.py @msie64
Traceback (most recent call last):
File "BugId.py", line 119, in
"-profile", mFileSystem.fs83Path(sFirefoxProfilePath),
File "C:\Users\xxx\Downloads\BugId-master (1)\BugId-master\modules\mFileSystem\FileSystem.py", line 87, in fs83Path
"GetShortPathNameW('...', NULL, 0) => Error 0x%08X" % KERNEL32.GetLastError();
AssertionError: GetShortPathNameW('...', NULL, 0) => Error 0x00000002

Add stack buffer overflow testability

I did it like this:

  else if (_tcsicmp(asArguments[1], _T("StackOverflow")) == 0) {
      fStackOverflow();

and

VOID fStackOverflow() {
    char buf[16];
    memset(buf, 0x00, 32);
}

But you might want to do something fancier?