We encountered an iis crash issue. It is h

appened randomly in our customer site. It is hard to reproduce in our testing environment. While the issue is happening, the following application error is logged:

Faulting application name: w3wp.exe, version: 8.0.9200.16384, time stamp: 0x5010885f
Faulting module name: KERNELBASE.dll, version: 6.2.9200.16384, time stamp: 0x5010ac2f
Exception code: 0xe0434352
Fault offset: 0x00014b32
Faulting process id: 0x3fb4
Faulting application start time: 0x01d0dfd3e07f2c5e
Faulting application path: C:\Windows\SysWOW64\inetsrv\w3wp.exe
Faulting module path: C:\Windows\SYSTEM32\KERNELBASE.dll
Report Id: a73637e3-4bc9-11e5-9431-441ea13a85ce
Faulting package full name: 
Faulting package-relative application ID: 

We get the dump files and do analysis. What we get is like:

FAULTING_IP: 
 KERNELBASE!RaiseException+6c
 75954b32 8b4c2454        mov     ecx,dword ptr [esp+54h]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
 ExceptionAddress: 75954b32 (KERNELBASE!RaiseException+0x0000006c)
    ExceptionCode: e0434352 (CLR exception)
   ExceptionFlags: 00000001
 NumberParameters: 5
    Parameter[0]: 80131604
    Parameter[1]: 00000000
    Parameter[2]: 00000000
    Parameter[3]: 00000000
    Parameter[4]: 74cb0000

CONTEXT:  00000000 -- (.cxr 0x0;r)
 eax=00000000 ebx=2b7ce698 ecx=00000005 edx=00000000 esi=2b7ce608 edi=00000000
 eip=77e31318 esp=2b7ce4e0 ebp=2b7ce660 iopl=0         nv up ei pl nz ac po nc
 cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212
 ntdll!NtWaitForMultipleObjects+0xc:
 77e31318 c21400          ret     14h

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  w3wp.exe

ERROR_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_PARAMETER1:  80131604

EXCEPTION_PARAMETER2:  00000000

EXCEPTION_PARAMETER3:  00000000

EXCEPTION_PARAMETER4: 0

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  w3wp.exe

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) x86fre

MANAGED_STACK: 
    at IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN(SessionContext session, String operatorTag, String smartcardSerialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4, CommandResultData commandResult)
    at IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN(String operatorTag, UInt64 serialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4)
 EXCEPTION_OBJECT: !pe 12e55364
 Exception object: 12e55364
 Exception type:   System.Reflection.TargetInvocationException
 Message:          Exception has been thrown by the target of an invocation.
 InnerException:   System.AccessViolationException, Use !PrintException 12e59e40 to see more.
 StackTrace (generated):
 <none>
 StackTraceString: <none>
 HResult: 80131604

EXCEPTION_OBJECT: !pe 12e59e40
 Exception object: 12e59e40
 Exception type:   System.AccessViolationException
 Message:          Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
 InnerException:   <none>
 StackTrace (generated):
 <none>
 StackTraceString: <none>
 HResult: 80004003

MANAGED_OBJECT: !dumpobj 12e5be14
 Name:        System.String
 MethodTable: 7400afb0
 EEClass:     73c1486c
 Size:        1416(0x588) bytes
 File:        C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
 String:         at IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN(SessionContext session, String operatorTag, String smartcardSerialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4, CommandResultData commandResult)
    at IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN(String operatorTag, UInt64 serialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4)
 Fields:
       MT    Field   Offset                 Type VT     Attr    Value Name
 7400c770  40000aa        4         System.Int32  1 instance      701 m_stringLength
 7400b9a8  40000ab        8          System.Char  1 instance       20 m_firstChar
 7400afb0  40000ac        c        System.String  0   shared   static Empty
     >> Domain:Value  014e87a8:NotInit  02686060:NotInit  29bcc5f8:NotInit  29de3d60:NotInit  2ba235c0:NotInit  <<

EXCEPTION_MESSAGE:  Attempted to read or write protected memory. This is often an indication that other memory is corru

MANAGED_OBJECT_NAME:  SYSTEM.ACCESSVIOLATIONEXCEPTION

MANAGED_STACK_COMMAND:  ** Check field   _remoteStackTraceString **;!do 12e59e40;!do 12e5be14

LAST_CONTROL_TRANSFER:  from 74dd48c7 to 75954b32

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION

STACK_TEXT:  
 00000000 00000000 unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN+0x0
 00000000 00000000 unknown!IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN+0x0


 SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: unknown

IMAGE_NAME:  unknown

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  ** Check field   _remoteStackTraceString **;!do 12e59e40;!do 12e5be14 ; ** Pseudo Context ** ; kb

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_e0434352_unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN

BUCKET_ID:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:wrong_symbols_e0434352_unknown!irdetoaccess.pisys.commands.clientdevice.hgpc.clientdevicehgpccommands.activatenetworkhn

FAILURE_ID_HASH:  {08572cef-1715-466a-1a7b-4f80c3617a30}

Followup: MachineOwner

Hi there,

this could be any .Net-Exception in the code itself. To catch these ones try with the following;

Link

Hi David,

Thanks for your help.

Our problem is the issue is cannot steady reproduced and it is only happened in our customer system. In addition, our library including the wrapper logic for native C++ library which make the debug more difficult.

Cheers,

Daniel Wang

You might have more luck asking the IIS experts for tips on troubleshooting.  They can be found in the www.iis.net/forums area.

Wwkicq

The w3wp crash with exception code 0xe0434352 can cause by many reasons, some third party application also can trigger this error, and often need a dump for the further analysis,

Some folk meet this issue likely connection issues between servers and or default application pool recycle time, but this forum is mainly talk about the server roles technical issue but except the IIS role, there have a specific for IIS related issue support, therefore if you have further question about IIS please post to the IIS forum, there will have more IIS professionals to help you.

IIS support forum

http://forums.iis.net/

Thanks for your understanding and support