(SOLVED) MTP Device Problems: Windows Explorer Crashing

[Ambassador]

Solved, please see last two posts.

SPECS

Windows XP SP3

Windows Media Player 11

I am having problems browsing MTP devices with Windows Explorer. Opening MTP devices and browsing takes a long time' date=' to the point that freezing occurs and 100% CPU usage is recorded. Also while browsing, Windows Explorer will often crash. Here is part of a report of one such crash:

EXPLORER.EXE      6.00.2900.5512 (xpsp.080413-2105) caused exception C0000005 at address 7C928C0B (Base: 1000000)

Registers:
EAX=00001CEA   EBX=00000000   ECX=00001F62   EDX=00090608   ESI=01B968F8
EDI=00090000   EBP=01CDD478   ESP=01CDD3BC   EIP=7C928C0B FLAGS=00000203
CS=001B   DS=0023   SS=0023   ES=0023   FS=003B   GS=0000
FPU stack:
4005C000000000000000 403DB888DCA6E8DEC4F2 403DE8DEC4F2E0A6B8C8
FFFF00C0C0C000C0C0C0 FFFF000000BF00BF00BF FFFF000000BF00BF00BF
FFFF0000000000000000 FFFF00C0C0C000C0C0C0 SW=0000 CW=027F

I can PM the complete report to anyone.

I have used both a Creative ZEN and a Sony NWZ-B105F; both have the same results in Windows Explorer. Windows Media Player works, but I really don't like using WMP. I also don't want to use the bundled Creative Zen software because of all the crap it includes, and that wouldn't solve the problem with the Sony player.

I disabled services a while back, including Terminal Services and the Portable Media Serial Number Service, but not User Mode Driver Framework/Windows Driver Foundation or anything that I know of that interferes with MTP Device operation.

I tried to reinstall WMP 11 to the best of my abilities (unable to uninstall), but the problem remains. I also tried installing the MTP Porting Kit as suggested by other sources, but the freezing/crashing still occurs.

Any ideas? Thanks.[/quote']

Edited July 9, 2010 by Ambassador

[cluberti]

If you've got a .dmp of explorer.exe crashing, uploading it to a web hoster (after zipping it, of course) would be useful, yes.

[Ambassador]

I have a Inspector IIXII logfile, which I assume is identical to DMP.

crash20100706094029.7z

[cluberti]

No, actually, it's not, and it requires usage of their program to see the memory as well. Is there any way you can get a dump of explorer crashing using Microsoft's tools? I don't care what the page says for this tool, the dump files generated by adplus/cdb.exe are much easier to actually look at in a debugger, and they create actual memory files that can be analyzed and inspected rather than just static log files with callstack and module info (anyone can create those, and that's precisely why they're almost completely useless).

Of note, I did say they were *almost* completely useless - case in point, I did manage to get the file you uploaded to open, and while it really is almost useless data, I did see that explorer.exe is loading ieframe.dll (an IE binary) from C:\Program Files\Quicktime rather than C:\Program Files\Internet Explorer - seems kinda odd, no?

[Ambassador]

No, actually, it's not, and it requires usage of their program to see the memory as well. Is there any way you can get a dump of explorer crashing using Microsoft's tools? I don't care what the page says for this tool, the dump files generated by adplus/cdb.exe are much easier to actually look at in a debugger, and they create actual memory files that can be analyzed and inspected rather than just static log files with callstack and module info (anyone can create those, and that's precisely why they're almost completely useless).

Ah, fair enough. As soon as I get access to my home computer, I will take a dump (haha).

Of note, I did say they were *almost* completely useless - case in point, I did manage to get the file you uploaded to open, and while it really is almost useless data, I did see that explorer.exe is loading ieframe.dll (an IE binary) from C:\Program Files\Quicktime rather than C:\Program Files\Internet Explorer - seems kinda odd, no?

Nope, nothing unusual there.

J/K, that is strange, and I'll be sure to check that folder. BTW, would that be consistent with a virus?

[cluberti]

No, but it would be consistent with poor development practices (and I would bet redistribution of IE binaries is probably not legal). I expect nothing less from Apple, honestly.

[Ambassador]

No, but it would be consistent with poor development practices (and I would bet redistribution of IE binaries is probably not legal). I expect nothing less from Apple, honestly.

Well, you can't blame Apple this time; IEFrame.dll doesn't exist anywhere on my system. In fact, this may have to do with the HTTP Link phenomena that I mentioned not too long ago. This is an IE7 DLL, but I have IE6.

Crash report on the way.

[Ambassador]

Ok cluberti, please check your PM.

[cluberti]

The crash looks like heap corruption, but it's hard to say without pageheap enabled whether the free failure is caused by the Explorer breadcrumbs extension, or if it's just a victim of the WMP shell extension:

// Actual crashing thread:
0:004> kn
 # ChildEBP RetAddr  
00 00dfd478 774fd01c ntdll!RtlFreeHeap+0x44e
01 00dfd48c 774fd057 ole32!CRetailMalloc_Free+0x1c
02 00dfd49c 00f83afa ole32!CoTaskMemFree+0x13
WARNING: Stack unwind information not available. Following frames may be wrong.
03 00000000 00000000 BCToolbar!DllUnregisterServer+0xf4ba

// CPU registers at the time - looks like copying the (poi) contents at 00001f62 to 00001cea:
0:004> r
eax=00001cea ebx=00000000 ecx=00001f62 edx=00090608 esi=00116938 edi=00090000
eip=7c928c0b esp=00dfd3bc ebp=00dfd478 iopl=0         nv up ei pl nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000203
ntdll!RtlFreeHeap+0x44e:
7c928c0b 8b11            mov     edx,dword ptr [ecx]  ds:0023:00001f62=????????

// Looks like both source and destination addresses are bogus:
0:013> dc 00001f62 L1
00001f62  ????????                             ????

0:013> dc 00001cea L1
00001cea  ????????                             ????

// Exception record showing what actually failed:
0:004> .exr ffffffffffffffff
ExceptionAddress: 7c928c0b (ntdll!RtlFreeHeap+0x0000044e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00001f62
Attempt to read from address 00001f62

// Looking at the base to stack pointer, we can see the call to CoTaskMemFree:
0:004> dds 00dfd3bc 00dfd478 
00dfd3bc  00ec4b20
00dfd3c0  00ec4b20
00dfd3c4  00000000
00dfd3c8  00000000
00dfd3cc  00000000
00dfd3d0  000fa630
00dfd3d4  00dfd3e4
00dfd3d8  774fd057 ole32!CoTaskMemFree+0x13
00dfd3dc  00000000
00dfd3e0  00df910a
00dfd3e4  00dffc28
00dfd3e8  1657ec8f WpdShext!DllUnregisterServer+0xed36
00dfd3ec  00000000
00dfd3f0  00000003
00dfd3f4  16525072 WpdShext+0x25072
00dfd3f8  1652507d WpdShext+0x2507d
00dfd3fc  00dfd520
00dfd400  00001f62
00dfd404  00dfd418
00dfd408  00001cea
00dfd40c  00116938
00dfd410  00000824
00dfd414  00125ff0
00dfd418  00016280
00dfd41c  00000000
00dfd420  00000000
00dfd424  00ec4b70
00dfd428  00dfd4f4
00dfd42c  7c910041 ntdll!RtlFreeHeap+0x1e9
00dfd430  00000018
00dfd434  00000003
00dfd438  00ec0000
00dfd43c  00dfd234
00dfd440  00090000
00dfd444  00116938
00dfd448  7c90e920 ntdll!_except_handler3
00dfd44c  7c9101e0 ntdll!CheckHeapFillPattern+0x54
00dfd450  00000000
00dfd454  00000000
00dfd458  010116b3 explorer!CMenuItemsCache::GetAppInfoFromSpecialPidl+0x43
00dfd45c  00ec0000
00dfd460  00dfd3bc
00dfd464  00dfcfe0
00dfd468  00dfd4c4
00dfd46c  7c90e920 ntdll!_except_handler3
00dfd470  7c910060 ntdll!CheckHeapFillPattern+0x64
00dfd474  00000001
00dfd478  00dfd48c

// Looks like this thread is actually the one doing the driving:
0:013> kn
 # ChildEBP RetAddr  
00 01dbe8a0 7c90daea ntdll!KiFastSystemCallRet
01 01dbe8a4 77e7cac1 ntdll!ZwRequestWaitReplyPort+0xc
02 01dbe8f0 77e7a33e rpcrt4!LRPC_CCALL::SendReceive+0x228
03 01dbe8fc 77e7a36f rpcrt4!I_RpcSendReceive+0x24
04 01dbe910 77ef4675 rpcrt4!NdrSendReceive+0x2b
05 01dbecec 7751620d rpcrt4!NdrClientCall2+0x222
06 01dbed00 775161c5 ole32!ServerAllocateOXIDAndOIDs+0x1b
07 01dbed54 77516117 ole32!CRpcResolver::ServerRegisterOXID+0x7d
08 01dbedac 7752c706 ole32!OXIDEntry::RegisterOXIDAndOIDs+0x38
09 01dbedc4 7752c6ac ole32!OXIDEntry::AllocOIDs+0x40
0a 01dbef34 77515e4a ole32!CComApartment::CallTheResolver+0x6b
0b 01dbef6c 77564d66 ole32!CComApartment::InitRemoting+0x1b7
0c 01dbef78 7750ba25 ole32!CComApartment::GetOXIDEntry+0x14
0d 01dbef8c 7750d83a ole32!GetLocalOXIDEntry+0x25
0e 01dbefa4 7750d97f ole32!ChkIfLocalOID+0x1e
0f 01dbefec 7752d8d4 ole32!FindStdMarshal+0x3e
10 01dbf02c 77525f55 ole32!UnmarshalObjRef+0x25
11 01dbf074 1654885b ole32!CGIPTable::GetInterfaceFromGlobal+0x115
WARNING: Stack unwind information not available. Following frames may be wrong.
12 01dbf1d8 1654b34c WpdShext+0x4885b
13 01dbf52c 1650dba4 WpdShext+0x4b34c
14 01dbf548 1650dba4 WpdShext+0xdba4
15 01dbf564 1650dba4 WpdShext+0xdba4
16 01dbf580 1650f516 WpdShext+0xdba4
17 01dbf6f8 1652325f WpdShext+0xf516
18 01dbff50 77f76f82 WpdShext+0x2325f
19 01dbffb4 7c80b729 shlwapi!WrapperThreadProc+0x94
1a 01dbffec 00000000 kernel32!BaseThreadStart+0x37

// BCToolbar is old, but the WMP Extension is the latest I can find:
0:004> lmvm BCToolbar
start    end        module name
00f70000 00f95000   BCToolbar C (export symbols)       BCToolbar.dll
    Loaded symbol image file: BCToolbar.dll
    Image path: C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
    Image name: BCToolbar.dll
    Timestamp:        Wed Apr 04 11:59:39 2007 (4613CB6B)
    CheckSum:         00000000
    ImageSize:        00025000
    File version:     1.3.0.1
    Product version:  1.3.0.1
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04e3
    CompanyName:      Minimalist
    ProductName:      Minimalist Explorer Breadcrumbs
    InternalName:     BCToolbar.dll
    OriginalFilename: BCToolbar.dll
    ProductVersion:   1.3.0.1
    FileVersion:      1.3.0.1
    FileDescription:  Minimalist Explorer Breadcrumbs
    LegalCopyright:   (c) 2006 Minimalist.  All rights reserved.

0:004> lmvm WpdShext
start    end        module name
16500000 1677e000   WpdShext   (export symbols)       WpdShext.dll
    Loaded symbol image file: WpdShext.dll
    Image path: C:\WINDOWS\system32\WpdShext.dll
    Image name: WpdShext.dll
    Timestamp:        Fri Jan 30 23:37:12 2009 (4983D578)
    CheckSum:         0027C971
    ImageSize:        0027E000
    File version:     5.2.5721.5262
    Product version:  5.2.5721.5262
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     wpdshext
    OriginalFilename: wpdshext.dll
    ProductVersion:   5.2.5721.5262
    FileVersion:      5.2.5721.5262 (WMP_11.090130-1421)
    FileDescription:  Portable Devices Shell Extension
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Again, given what we have it's really hard to say who caused the addresses to be busted (it is heap corruption, so we didn't catch the problem, we just catch the crash some time later when we go back to access the heap that's been corrupted). I'd say it's more likely it's the Minimalist shell extension, but without removing it it'll be hard to prove anything without enabling pageheap via gflags. I am going to suggest removal of the Minimalist shell extension as a troubleshooting step, and see if these issues don't go away.

[Ambassador]

You are correct. Explorer Breadcrumbs was the focal point. The obvious answers are always the overlooked ones.

Thank you so much for your help.

Edited July 9, 2010 by Ambassador

[cluberti]

Always glad to hear a problem is solved, whether I had input or not .