Window Services

Posted on 2007-10-17
Last Modified: 2010-04-13
My window application service is not running normally. Sometime it quits during the run. Is there
way to log its status so that I can find where the service quits. The program is written in Visual C++, running under Window server 2003, eventhough I use catch(...) in the exception handler , but I stil don't receive any messages.
Question by:xtran888
    1 Comment
    LVL 86

    Accepted Solution

    Check out ("Debugging a Windows NT Service"), this should help you locate the error. An altrenative method is to use a map file and an exception filter to locate the faulting function. Consider e.g.

    #include <windows.h>
    #include <stddef.h>
    #include <stdio.h>

    ExceptionHandler(LPEXCEPTION_POINTERS pe) {

        char acModule[MAX_PATH];

        HMODULE hMod;

        VirtualQuery (pe->ExceptionRecord->ExceptionAddress,&mbi,sizeof(mbi));

        ptrdiff_t RVA = (char*)pe->ExceptionRecord->ExceptionAddress - (char*)mbi.AllocationBase;

        hMod = (HMODULE) mbi.AllocationBase;

        GetModuleFileName(hMod,acModule,sizeof (acModule));

        printf( "Detected Exception in %s at RVA 0x%08X\n", acModule, RVA);


    void FaultingFunction () {

        LONG* p = NULL;
        *p = 42;

    void main(){

        SetUnhandledExceptionFilter (ExceptionHandler);
        FaultingFunction ();

    (compiled with "cl rvaxcept.cpp /link /map")

    which prints

    Detected Exception in C:\tmp\cc\rvaxcept.exe at RVA 0x00001088

    The map file is


    Timestamp is 44660958 (Sat May 13 18:29:12 2006)

    Preferred load address is 00400000

    Start         Length     Name                   Class
    0001:00000000 00004938H .text                   CODE

     Address         Publics by Value              Rva+Base     Lib:Object

    0001:00000000       _ExceptionHandler@4        00401000 f   rvaxcept.obj
    0001:0000007a       _FaultingFunction          0040107a f   rvaxcept.obj
    0001:00000092       _main                      00401092 f   rvaxcept.obj
    0001:000000a7       _printf                    004010a7 f   LIBC:printf.obj
    0001:000000d8       _mainCRTStartup            004010d8 f   LIBC:crt0.obj
    0001:000001b7       __amsg_exit                004011b7 f   LIBC:crt0.obj

    You can see the 'Rva+Base' column, base is given as 'Preferred load address is 00400000'

    Add that to the faulting module RVA of 0x00001088 and you get 0x00401088, then look that up in the above (i.e. the 'nearest symbol' and you can see that it is 'FaultingFunction'

    0001:0000007a       _FaultingFunction          0040107a f   rvaxcept.obj
    0001:00000092       _main                      00401092 f   rvaxcept.obj

    The address is between main and FaultingFunction, which starts before 0x00401088, the next function is main and starts later.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    These days socially coordinated efforts have turned into a critical requirement for enterprises.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now