Jump to content

(SOLVED) MTP Device Problems: Windows Explorer Crashing


Ambassador

Recommended Posts

Solved, please see last two posts.

SPECS

Windows XP SP3

Windows Media Player 11

I am having problems browsing MTP devices with Windows Explorer. Opening MTP devices and browsing takes a long time' date=' to the point that freezing occurs and 100% CPU usage is recorded. Also while browsing, Windows Explorer will often crash. Here is part of a report of one such crash:

EXPLORER.EXE      6.00.2900.5512 (xpsp.080413-2105) caused exception C0000005 at address 7C928C0B (Base: 1000000)

Registers:
EAX=00001CEA EBX=00000000 ECX=00001F62 EDX=00090608 ESI=01B968F8
EDI=00090000 EBP=01CDD478 ESP=01CDD3BC EIP=7C928C0B FLAGS=00000203
CS=001B DS=0023 SS=0023 ES=0023 FS=003B GS=0000
FPU stack:
4005C000000000000000 403DB888DCA6E8DEC4F2 403DE8DEC4F2E0A6B8C8
FFFF00C0C0C000C0C0C0 FFFF000000BF00BF00BF FFFF000000BF00BF00BF
FFFF0000000000000000 FFFF00C0C0C000C0C0C0 SW=0000 CW=027F

I can PM the complete report to anyone.

I have used both a Creative ZEN and a Sony NWZ-B105F; both have the same results in Windows Explorer. Windows Media Player works, but I really don't like using WMP. I also don't want to use the bundled Creative Zen software because of all the crap it includes, and that wouldn't solve the problem with the Sony player.

I disabled services a while back, including Terminal Services and the Portable Media Serial Number Service, but not User Mode Driver Framework/Windows Driver Foundation or anything that I know of that interferes with MTP Device operation.

I tried to reinstall WMP 11 to the best of my abilities (unable to uninstall), but the problem remains. I also tried installing the MTP Porting Kit as suggested by other sources, but the freezing/crashing still occurs.

Any ideas? Thanks.[/quote']

Edited by Ambassador
Link to comment
Share on other sites


No, actually, it's not, and it requires usage of their program to see the memory as well. Is there any way you can get a dump of explorer crashing using Microsoft's tools? I don't care what the page says for this tool, the dump files generated by adplus/cdb.exe are much easier to actually look at in a debugger, and they create actual memory files that can be analyzed and inspected rather than just static log files with callstack and module info (anyone can create those, and that's precisely why they're almost completely useless).

Of note, I did say they were *almost* completely useless - case in point, I did manage to get the file you uploaded to open, and while it really is almost useless data, I did see that explorer.exe is loading ieframe.dll (an IE binary) from C:\Program Files\Quicktime rather than C:\Program Files\Internet Explorer - seems kinda odd, no?

Link to comment
Share on other sites

No, actually, it's not, and it requires usage of their program to see the memory as well. Is there any way you can get a dump of explorer crashing using Microsoft's tools? I don't care what the page says for this tool, the dump files generated by adplus/cdb.exe are much easier to actually look at in a debugger, and they create actual memory files that can be analyzed and inspected rather than just static log files with callstack and module info (anyone can create those, and that's precisely why they're almost completely useless).

Ah, fair enough. As soon as I get access to my home computer, I will take a dump (haha).

Of note, I did say they were *almost* completely useless - case in point, I did manage to get the file you uploaded to open, and while it really is almost useless data, I did see that explorer.exe is loading ieframe.dll (an IE binary) from C:\Program Files\Quicktime rather than C:\Program Files\Internet Explorer - seems kinda odd, no?

Nope, nothing unusual there.

J/K, that is strange, and I'll be sure to check that folder. BTW, would that be consistent with a virus?

Link to comment
Share on other sites

No, but it would be consistent with poor development practices (and I would bet redistribution of IE binaries is probably not legal). I expect nothing less from Apple, honestly.

Link to comment
Share on other sites

No, but it would be consistent with poor development practices (and I would bet redistribution of IE binaries is probably not legal). I expect nothing less from Apple, honestly.

Well, you can't blame Apple this time; IEFrame.dll doesn't exist anywhere on my system. In fact, this may have to do with the HTTP Link phenomena that I mentioned not too long ago. This is an IE7 DLL, but I have IE6.

Crash report on the way.

Link to comment
Share on other sites

The crash looks like heap corruption, but it's hard to say without pageheap enabled whether the free failure is caused by the Explorer breadcrumbs extension, or if it's just a victim of the WMP shell extension:

// Actual crashing thread:
0:004> kn
# ChildEBP RetAddr
00 00dfd478 774fd01c ntdll!RtlFreeHeap+0x44e
01 00dfd48c 774fd057 ole32!CRetailMalloc_Free+0x1c
02 00dfd49c 00f83afa ole32!CoTaskMemFree+0x13
WARNING: Stack unwind information not available. Following frames may be wrong.
03 00000000 00000000 BCToolbar!DllUnregisterServer+0xf4ba

// CPU registers at the time - looks like copying the (poi) contents at 00001f62 to 00001cea:
0:004> r
eax=00001cea ebx=00000000 ecx=00001f62 edx=00090608 esi=00116938 edi=00090000
eip=7c928c0b esp=00dfd3bc ebp=00dfd478 iopl=0 nv up ei pl nz na po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000203
ntdll!RtlFreeHeap+0x44e:
7c928c0b 8b11 mov edx,dword ptr [ecx] ds:0023:00001f62=????????

// Looks like both source and destination addresses are bogus:
0:013> dc 00001f62 L1
00001f62 ???????? ????

0:013> dc 00001cea L1
00001cea ???????? ????

// Exception record showing what actually failed:
0:004> .exr ffffffffffffffff
ExceptionAddress: 7c928c0b (ntdll!RtlFreeHeap+0x0000044e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00001f62
Attempt to read from address 00001f62

// Looking at the base to stack pointer, we can see the call to CoTaskMemFree:
0:004> dds 00dfd3bc 00dfd478
00dfd3bc 00ec4b20
00dfd3c0 00ec4b20
00dfd3c4 00000000
00dfd3c8 00000000
00dfd3cc 00000000
00dfd3d0 000fa630
00dfd3d4 00dfd3e4
00dfd3d8 774fd057 ole32!CoTaskMemFree+0x13
00dfd3dc 00000000
00dfd3e0 00df910a
00dfd3e4 00dffc28
00dfd3e8 1657ec8f WpdShext!DllUnregisterServer+0xed36
00dfd3ec 00000000
00dfd3f0 00000003
00dfd3f4 16525072 WpdShext+0x25072
00dfd3f8 1652507d WpdShext+0x2507d
00dfd3fc 00dfd520
00dfd400 00001f62
00dfd404 00dfd418
00dfd408 00001cea
00dfd40c 00116938
00dfd410 00000824
00dfd414 00125ff0
00dfd418 00016280
00dfd41c 00000000
00dfd420 00000000
00dfd424 00ec4b70
00dfd428 00dfd4f4
00dfd42c 7c910041 ntdll!RtlFreeHeap+0x1e9
00dfd430 00000018
00dfd434 00000003
00dfd438 00ec0000
00dfd43c 00dfd234
00dfd440 00090000
00dfd444 00116938
00dfd448 7c90e920 ntdll!_except_handler3
00dfd44c 7c9101e0 ntdll!CheckHeapFillPattern+0x54
00dfd450 00000000
00dfd454 00000000
00dfd458 010116b3 explorer!CMenuItemsCache::GetAppInfoFromSpecialPidl+0x43
00dfd45c 00ec0000
00dfd460 00dfd3bc
00dfd464 00dfcfe0
00dfd468 00dfd4c4
00dfd46c 7c90e920 ntdll!_except_handler3
00dfd470 7c910060 ntdll!CheckHeapFillPattern+0x64
00dfd474 00000001
00dfd478 00dfd48c

// Looks like this thread is actually the one doing the driving:
0:013> kn
# ChildEBP RetAddr
00 01dbe8a0 7c90daea ntdll!KiFastSystemCallRet
01 01dbe8a4 77e7cac1 ntdll!ZwRequestWaitReplyPort+0xc
02 01dbe8f0 77e7a33e rpcrt4!LRPC_CCALL::SendReceive+0x228
03 01dbe8fc 77e7a36f rpcrt4!I_RpcSendReceive+0x24
04 01dbe910 77ef4675 rpcrt4!NdrSendReceive+0x2b
05 01dbecec 7751620d rpcrt4!NdrClientCall2+0x222
06 01dbed00 775161c5 ole32!ServerAllocateOXIDAndOIDs+0x1b
07 01dbed54 77516117 ole32!CRpcResolver::ServerRegisterOXID+0x7d
08 01dbedac 7752c706 ole32!OXIDEntry::RegisterOXIDAndOIDs+0x38
09 01dbedc4 7752c6ac ole32!OXIDEntry::AllocOIDs+0x40
0a 01dbef34 77515e4a ole32!CComApartment::CallTheResolver+0x6b
0b 01dbef6c 77564d66 ole32!CComApartment::InitRemoting+0x1b7
0c 01dbef78 7750ba25 ole32!CComApartment::GetOXIDEntry+0x14
0d 01dbef8c 7750d83a ole32!GetLocalOXIDEntry+0x25
0e 01dbefa4 7750d97f ole32!ChkIfLocalOID+0x1e
0f 01dbefec 7752d8d4 ole32!FindStdMarshal+0x3e
10 01dbf02c 77525f55 ole32!UnmarshalObjRef+0x25
11 01dbf074 1654885b ole32!CGIPTable::GetInterfaceFromGlobal+0x115
WARNING: Stack unwind information not available. Following frames may be wrong.
12 01dbf1d8 1654b34c WpdShext+0x4885b
13 01dbf52c 1650dba4 WpdShext+0x4b34c
14 01dbf548 1650dba4 WpdShext+0xdba4
15 01dbf564 1650dba4 WpdShext+0xdba4
16 01dbf580 1650f516 WpdShext+0xdba4
17 01dbf6f8 1652325f WpdShext+0xf516
18 01dbff50 77f76f82 WpdShext+0x2325f
19 01dbffb4 7c80b729 shlwapi!WrapperThreadProc+0x94
1a 01dbffec 00000000 kernel32!BaseThreadStart+0x37

// BCToolbar is old, but the WMP Extension is the latest I can find:
0:004> lmvm BCToolbar
start end module name
00f70000 00f95000 BCToolbar C (export symbols) BCToolbar.dll
Loaded symbol image file: BCToolbar.dll
Image path: C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
Image name: BCToolbar.dll
Timestamp: Wed Apr 04 11:59:39 2007 (4613CB6B)
CheckSum: 00000000
ImageSize: 00025000
File version: 1.3.0.1
Product version: 1.3.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e3
CompanyName: Minimalist
ProductName: Minimalist Explorer Breadcrumbs
InternalName: BCToolbar.dll
OriginalFilename: BCToolbar.dll
ProductVersion: 1.3.0.1
FileVersion: 1.3.0.1
FileDescription: Minimalist Explorer Breadcrumbs
LegalCopyright: (c) 2006 Minimalist. All rights reserved.

0:004> lmvm WpdShext
start end module name
16500000 1677e000 WpdShext (export symbols) WpdShext.dll
Loaded symbol image file: WpdShext.dll
Image path: C:\WINDOWS\system32\WpdShext.dll
Image name: WpdShext.dll
Timestamp: Fri Jan 30 23:37:12 2009 (4983D578)
CheckSum: 0027C971
ImageSize: 0027E000
File version: 5.2.5721.5262
Product version: 5.2.5721.5262
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: wpdshext
OriginalFilename: wpdshext.dll
ProductVersion: 5.2.5721.5262
FileVersion: 5.2.5721.5262 (WMP_11.090130-1421)
FileDescription: Portable Devices Shell Extension
LegalCopyright: © Microsoft Corporation. All rights reserved.

Again, given what we have it's really hard to say who caused the addresses to be busted (it is heap corruption, so we didn't catch the problem, we just catch the crash some time later when we go back to access the heap that's been corrupted). I'd say it's more likely it's the Minimalist shell extension, but without removing it it'll be hard to prove anything without enabling pageheap via gflags. I am going to suggest removal of the Minimalist shell extension as a troubleshooting step, and see if these issues don't go away.

Link to comment
Share on other sites

You are correct. Explorer Breadcrumbs was the focal point. The obvious answers are always the overlooked ones. :P

Thank you so much for your help.

Edited by Ambassador
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...