BEX windows Error

davesnb
davesnb used Ask the Experts™
on
Recently one of our hosted citrix applications crashes with a BEX error on windows 2012 R2 . Recent steps include removing DEP on the hosted app SomeAppRES.exe , and disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel,  'DisableExceptionChainValidation ' .

Any further ideas on how to correct this . This is a vmware env running guest vm windows 2012 R2


Version=1
EventType=BEX
EventTime=131910025442330121
ReportType=2
Consent=1
ReportIdentifier=5e3c137a-0f6b-11e9-8106-005056a96fb6
IntegratorReportIdentifier=5e3c1379-0f6b-11e9-8106-005056a96fb6
WOW64=1
NsAppName=SomeAppRES.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=SomeAppRES.exe
Sig[1].Name=Application Version
Sig[1].Value=18.9.0.3
Sig[2].Name=Application Timestamp
Sig[2].Value=5bd0c37b
Sig[3].Name=Fault Module Name
Sig[3].Value=StackHash_e909
Sig[4].Name=Fault Module Version
Sig[4].Value=0.0.0.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=00000000
Sig[6].Name=Exception Offset
Sig[6].Value=PCH_E1_FROM_ntdll+0x0003C8AC
Sig[7].Name=Exception Code
Sig[7].Value=c0000005
Sig[8].Name=Exception Data
Sig[8].Value=00000008
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.3.9600.2.0.0.16.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=e909
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=e9093dd2e946cc03dadc0f0b7d968e3d
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=5233
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=5233c2f0a2e01bc157faae623d71c7fc
UI[2]=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
UI[3]=SomeAppRES has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\SYSTEM32\KERNEL32.DLL
LoadedModule[3]=C:\Windows\SYSTEM32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\SYSTEM32\tsappcmp.dll
LoadedModule[5]=C:\Windows\SYSTEM32\msvcrt.dll
LoadedModule[6]=C:\Windows\SYSTEM32\combase.dll
LoadedModule[7]=C:\Windows\SYSTEM32\RPCRT4.dll
LoadedModule[8]=C:\Windows\SYSTEM32\USER32.dll
LoadedModule[9]=C:\Windows\SYSTEM32\ADVAPI32.dll
LoadedModule[10]=C:\Windows\SYSTEM32\SspiCli.dll
LoadedModule[11]=C:\Windows\SYSTEM32\GDI32.dll
LoadedModule[12]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[13]=C:\Windows\SYSTEM32\CRYPTBASE.dll
LoadedModule[14]=C:\Windows\SYSTEM32\bcryptPrimitives.dll
LoadedModule[15]=C:\Windows\system32\IMM32.DLL
LoadedModule[16]=C:\Windows\SYSTEM32\MSCTF.dll
LoadedModule[17]=C:\Windows\SYSTEM32\MSVBVM60.DLL
LoadedModule[18]=C:\Windows\SYSTEM32\ole32.dll
LoadedModule[19]=C:\Windows\SYSTEM32\OLEAUT32.dll
LoadedModule[20]=C:\Program Files (x86)\Citrix\system32\MfApHook.dll
LoadedModule[21]=C:\Windows\system32\RTWORKQ.DLL
LoadedModule[22]=C:\Windows\SYSTEM32\AVRT.dll
LoadedModule[23]=C:\Program Files (x86)\Citrix\system32\CtxMFPlugin.dll
LoadedModule[24]=C:\Windows\SYSTEM32\MF.dll
LoadedModule[25]=C:\Windows\SYSTEM32\MFPlat.DLL
LoadedModule[26]=C:\Windows\SYSTEM32\cfgmgr32.dll
LoadedModule[27]=C:\Windows\SYSTEM32\MFCORE.DLL
LoadedModule[28]=C:\Windows\SYSTEM32\ksuser.dll
LoadedModule[29]=C:\Windows\SYSTEM32\kernel.appcore.dll
LoadedModule[30]=C:\Program Files (x86)\Citrix\system32\CtxGraphicsHelper.dll
LoadedModule[31]=C:\Windows\SYSTEM32\SETUPAPI.dll
LoadedModule[32]=C:\Program Files (x86)\Citrix\system32\mmhook.dll
LoadedModule[33]=C:\Program Files (x86)\Citrix\system32\Sfrhook.dll
LoadedModule[34]=C:\Windows\SYSTEM32\WTSAPI32.dll
LoadedModule[35]=C:\Program Files (x86)\Citrix\system32\ShellHook.dll
LoadedModule[36]=C:\Windows\SYSTEM32\SHELL32.dll
LoadedModule[37]=C:\Windows\SYSTEM32\SHLWAPI.dll
LoadedModule[38]=C:\Program Files (x86)\Citrix\system32\scardhook.dll
LoadedModule[39]=C:\Program Files (x86)\Citrix\system32\twnhook.dll
LoadedModule[40]=C:\Program Files (x86)\Citrix\system32\cxinjime.dll
LoadedModule[41]=C:\Windows\system32\uxtheme.dll
LoadedModule[42]=C:\Program Files (x86)\Citrix\System32\sehook20.dll
LoadedModule[43]=C:\Windows\SYSTEM32\MSVCR120.dll
LoadedModule[44]=C:\Program Files (x86)\Citrix\System32\CUtilDll.dll
LoadedModule[45]=C:\Program Files (x86)\Citrix\System32\CtxWsApi.dll
LoadedModule[46]=C:\Windows\SYSTEM32\ACTIVEDS.dll
LoadedModule[47]=C:\Windows\SYSTEM32\NETAPI32.dll
LoadedModule[48]=C:\Windows\SYSTEM32\Secur32.dll
LoadedModule[49]=C:\Windows\SYSTEM32\IPHLPAPI.DLL
LoadedModule[50]=C:\Windows\SYSTEM32\adsldpc.dll
LoadedModule[51]=C:\Windows\SYSTEM32\netutils.dll
LoadedModule[52]=C:\Windows\SYSTEM32\srvcli.dll
LoadedModule[53]=C:\Windows\SYSTEM32\wkscli.dll
LoadedModule[54]=C:\Windows\SYSTEM32\NSI.dll
LoadedModule[55]=C:\Windows\SYSTEM32\WINNSI.DLL
LoadedModule[56]=C:\Windows\SYSTEM32\WLDAP32.dll
LoadedModule[57]=C:\Windows\SYSTEM32\LOGONCLI.DLL
LoadedModule[58]=C:\Windows\SYSTEM32\SAMCLI.DLL
LoadedModule[59]=C:\Windows\SYSTEM32\SXS.DLL
LoadedModule[60]=C:\Windows\system32\dwmapi.dll
LoadedModule[61]=C:\Windows\SYSTEM32\clbcatq.dll
LoadedModule[62]=C:\Windows\SYSTEM32\mscomctl.OCX
LoadedModule[63]=C:\Windows\SYSTEM32\comdlg32.dll
LoadedModule[64]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_7c5b6194aa0716f1\COMCTL32.dll
LoadedModule[65]=C:\Windows\SYSTEM32\SHCORE.DLL
LoadedModule[66]=C:\Program Files\Company\Common\MDIExtender.ocx
LoadedModule[67]=C:\Windows\SYSTEM32\VERSION.DLL
LoadedModule[68]=C:\Program Files (x86)\Common Files\System\ado\msado15.dll
LoadedModule[69]=C:\Windows\SYSTEM32\MSDART.DLL
LoadedModule[70]=C:\Windows\system32\asycfilt.dll
LoadedModule[71]=C:\Windows\SYSTEM32\CRYPTSP.dll
LoadedModule[72]=C:\Windows\system32\rsaenh.dll
LoadedModule[73]=C:\Windows\SYSTEM32\bcrypt.dll
LoadedModule[74]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee\comctl32.DLL
LoadedModule[75]=C:\Program Files\Company\Common\amgenutl.dll
LoadedModule[76]=C:\Windows\SYSTEM32\scrrun.dll
LoadedModule[77]=C:\Windows\SYSTEM32\msxml4.dll
LoadedModule[78]=C:\Windows\SYSTEM32\comsvcs.dll
LoadedModule[79]=C:\Windows\SYSTEM32\AUTHZ.dll
LoadedModule[80]=C:\Windows\SYSTEM32\WS2_32.dll
LoadedModule[81]=C:\Windows\system32\mswsock.dll
LoadedModule[82]=C:\Windows\SYSTEM32\DNSAPI.dll
LoadedModule[83]=C:\Windows\System32\rasadhlp.dll
LoadedModule[84]=C:\Windows\System32\fwpuclnt.dll
LoadedModule[85]=C:\Windows\SYSTEM32\Kerberos.DLL
LoadedModule[86]=C:\Windows\SYSTEM32\MSASN1.dll
LoadedModule[87]=C:\Windows\SYSTEM32\cryptdll.dll
LoadedModule[88]=C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll
LoadedModule[89]=C:\Windows\SYSTEM32\sqlncli10.dll
LoadedModule[90]=C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.8428_none_d08a11e2442dc25d\MSVCR80.dll
LoadedModule[91]=C:\Windows\SYSTEM32\CRYPT32.dll
LoadedModule[92]=C:\Windows\SYSTEM32\1033\SQLNCLIR10.RLL
LoadedModule[93]=C:\Windows\SYSTEM32\DPAPI.DLL
LoadedModule[94]=C:\Windows\SYSTEM32\netbios.dll
LoadedModule[95]=C:\Windows\SYSTEM32\msv1_0.DLL
LoadedModule[96]=C:\Windows\system32\ntdsapi.dll
LoadedModule[97]=C:\Windows\SYSTEM32\DSPARSE.DLL
LoadedModule[98]=C:\Windows\system32\security.dll
LoadedModule[99]=C:\Windows\SYSTEM32\schannel.dll
LoadedModule[100]=C:\Windows\SYSTEM32\ncrypt.dll
LoadedModule[101]=C:\Windows\SYSTEM32\NTASN1.dll
LoadedModule[102]=C:\Windows\system32\ncryptsslp.dll
LoadedModule[103]=C:\Program Files (x86)\Common Files\System\msadc\msadce.dll
LoadedModule[104]=C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll
LoadedModule[105]=C:\Windows\SYSTEM32\mscoree.dll
LoadedModule[106]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
LoadedModule[107]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
LoadedModule[108]=C:\Windows\SYSTEM32\MSVCR120_CLR0400.dll
LoadedModule[109]=C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
LoadedModule[110]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
LoadedModule[111]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System\60bb98fc0925ec2bdd609951e5c20dec\System.ni.dll
LoadedModule[112]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ebaeb5bdc370618c8955257023cc15e0\System.Core.ni.dll
LoadedModule[113]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8f60dd698047ca9b5c73acbd13b160ba\System.Configuration.ni.dll
LoadedModule[114]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\290bf464763caee761422717fa91ad07\System.Xml.ni.dll
LoadedModule[115]=C:\Windows\SYSTEM32\profapi.dll
LoadedModule[116]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\81c74ec9cc65d4b2abac2f9613c4db13\System.ServiceModel.ni.dll
LoadedModule[117]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\215ab049ebbb8f45e1815a1515e40ddf\System.Data.ni.dll
LoadedModule[118]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
LoadedModule[119]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\c22d300d596ce7549b818413c137fb34\System.Runtime.Serialization.ni.dll
LoadedModule[120]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\ee81fa2e7f333ee787a423c2e39ee3a3\System.Numerics.ni.dll
LoadedModule[121]=C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\ceee9d260702131765b5dc11c1bab9ba\SMDiagnostics.ni.dll
LoadedModule[122]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\9f260193b8fc10fcaf77bb839757095d\System.ServiceModel.Internals.ni.dll
LoadedModule[123]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\f27daedbe2f0131a4a3b943ae5c4d80d\System.IdentityModel.ni.dll
LoadedModule[124]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\a564d382226dff2ee688ce04215cc0ae\System.Web.ni.dll
LoadedModule[125]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll
LoadedModule[126]=C:\Windows\SYSTEM32\USERENV.dll
LoadedModule[127]=C:\Windows\SYSTEM32\PSAPI.DLL
LoadedModule[128]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#\35004cca95674cbc841db6e6d5db136d\System.Data.DataSetExtensions.ni.dll
LoadedModule[129]=C:\Windows\SYSTEM32\WINSTA.dll
LoadedModule[130]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\df4bf4ce7eea9f51ed81ca36694ea21e\System.Security.ni.dll
LoadedModule[131]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\a3c0663e986ac64ef6a0248bfd3fc127\System.Data.SqlXml.ni.dll
LoadedModule[132]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\7980913823dee8722be18ac64ae00f0e\System.Transactions.ni.dll
LoadedModule[133]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll
LoadedModule[134]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\ab5ddef019e12fa6db6ef48993bf7f9e\System.EnterpriseServices.ni.dll
LoadedModule[135]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\c03989c64aad9e4a1d8e728ad525a9a6\System.Xaml.ni.dll
LoadedModule[136]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\019a4b5f0c9c45271a48f55a3c5906e4\System.Net.Http.ni.dll
LoadedModule[137]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979#\3665acdd67acdf28ab024ddba3068f4c\System.Runtime.DurableInstancing.ni.dll
LoadedModule[138]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\860a6fb9e37f2b12d136583d13471281\System.Web.Services.ni.dll
LoadedModule[139]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\1bb733a41f850f06a94b8f3550b135f5\System.Drawing.ni.dll
LoadedModule[140]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\0aeaeef4947879fc52e5b53ae6bf1a84\System.ComponentModel.DataAnnotations.ni.dll
LoadedModule[141]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\ec4c990673a61d631d80f3664a777d99\System.Web.ApplicationServices.ni.dll
LoadedModule[142]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595#\b6b16352366edee2efe6f8cc73957b34\System.Runtime.Caching.ni.dll
LoadedModule[143]=C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b#\11a73667baeaa944d54ee71ff7783d73\Microsoft.Build.Framework.ni.dll
LoadedModule[144]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\ab5ddef019e12fa6db6ef48993bf7f9e\System.EnterpriseServices.Wrapper.dll
LoadedModule[145]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
LoadedModule[146]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\4eb9560e7a36228f6a9979d6aae62f69\System.Xml.Linq.ni.dll
LoadedModule[147]=C:\Windows\SYSTEM32\gpapi.dll
LoadedModule[148]=C:\Windows\SYSTEM32\cryptnet.dll
LoadedModule[149]=C:\Windows\SYSTEM32\msstdfmt.dll
LoadedModule[150]=C:\Program Files\Company\Common\IntAdvGrd.ocx
LoadedModule[151]=C:\Program Files\Company\Common\IntSbcls.dll
LoadedModule[152]=C:\Windows\SYSTEM32\OLEPRO32.DLL
LoadedModule[153]=C:\Windows\SYSTEM32\mscomct2.ocx
LoadedModule[154]=C:\Windows\SYSTEM32\ComDlg32.OCX
LoadedModule[155]=C:\Program Files\Company\Common\IntAdvIL.ocx
LoadedModule[156]=C:\Program Files\Company\Common\SomeAppText.dll
LoadedModule[157]=C:\Program Files\Company\Common\Int_FSFWJL.dll
LoadedModule[158]=C:\Windows\SYSTEM32\TabCtl32.Ocx
LoadedModule[159]=C:\Program Files\Company\Common\intpax.dll
FriendlyEventName=Stopped working
ConsentKey=BEX
AppName=SomeAppRES
AppPath=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=0555BC59540DD73E4646C80815240DAD
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Information Technology Consultant
Commented:
Does the application use .NET?

I don't see anything listed for "Fault Module" but I've seen this with legacy type applications where it was actually related to Terminal Services in that having Citrix or not was not relevant.  This "could" be a function of RDS compatibility and where for this application it is calling a DLL function prior to establishing a link.

It looks like it is making calls to .NET v4.0.30319.  From 3.5 SP1 on the TSAWARE flag is set to On by default and I believe this would only apply if the application was built with C#/VB.Net.  Worth checking.  

On 2008 R2 having this flag set the application may work fine but moving to 2012 R2 (one example) might require setting this flag back to No.

Given the steps you have already completed, I would suggest this as next step:

Your going to need editbin.exe
https://www.experts-exchange.com/questions/26812582/From-where-I-can-download-EditBin.html

And a "Test" environment as I cannot recommend doing this directly in production environment.

Once editbin.exe is available, run this command:
editbin.exe /TSAWARE:NO  C:\Company\SomeAppRES\Pasco\SomeAppRES.exe

Once you have your test environment configured and were to install Visual Studio Express you could verify the flag setting using dumpbin.exe.

The true test however would be having users access the application once changing the flag.  This will either resolve or not but has worked for me where applicationA worked in one OS but not the other type scenario.

Hope this helps.

Author

Commented:
OK thank you
Brian MurphySenior Information Technology Consultant

Commented:
My pleasure.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial