how to examine just cause 2 crash dumps

[Chris Solomon]

I have a new PC and to my surprise JC2 was working wonderfully on it, better than it did on my old system...... well.... that lasted all of about 15 minutes till the game suddenly dumped me back to the desktop. no error message or anything. I check the windows event viewer, and it said justcause2.exe caused a access denied error in module justcause2.exe. I checked the games directory, and the game appears to hve made a crash dump. I want to examine it just to see why the game crashed, but i have no idea what to open the file with. I tried notpad, but that did not work as well as i had hoped.

Is there anything that will let me examine the crashdumps for jc2? it is a MDMP file it is helps

[Chris Solomon]

turns out it was easier than i had thought it was going to be.... windows 10 store has windbg (preview) availible. installed that and opened the dump file. unfortunetly it wasn't as helpful as i had hoped... all i got out of it, was that JC2 tried recieved an instruction to access a memory location that the program was using, but got an access denied error


Microsoft (R) Windows Debugger Version 10.0.18972.1001 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Program Files (x86)\steam\steamapps\common\Just Cause 2\justcause2_3_crash_2019_10_6T6_22_40C0.mdmp]
Comment: 'Appversion: Just Cause 2 1.0.0.2
OSVersion: Windows 7 (or later) 6.2.9200
CPU: Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz ~2.21GHz
PhysicalMemory: 2047MB (74% used)
VideoCard: NVIDIA GeForce GTX 1060
GpuDedicatedVideoMem: 3072MB
GpuDedicatedSysMem: 0MB
GpuSharedSysMem: 1023MB
GpuDeviceID: 1C20
GpuVendorID: 10DE
GpuCount: 1
GpuDriverVersion: 26.21.14.3648
GpuVendorDriverVersion: 43648
DisplayMode: 1920x1080, 4, 1, 1
Settings: 1,3,1,6,2,1,3,1,3,1,1,1
'
User Mini Dump File: Only registers, stack and portions of memory are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 18363 MP (12 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Debug session time: Sat Oct 5 23:22:41.000 2019 (UTC - 7:00)
System Uptime: not available
Process Uptime: 0 days 0:28:34.000
................................................................
................................................................
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2368.28cc): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
eax=00000000 ebx=20ccb0c0 ecx=00000018 edx=1d20c000 esi=20ccb070 edi=20ccb080
eip=77772c4c esp=24112a60 ebp=24112a6c iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216
ntdll!NtGetContextThread+0xc:
77772c4c c20800 ret 8
0:035> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************


KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.Sec
Value: 14

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on MSI

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 24

Key : Analysis.Memory.CommitPeak.Mb
Value: 223

Key : Analysis.System
Value: CreateObject

Key : Timeline.Process.Start.DeltaSec
Value: 1714


COMMENT: Appversion: Just Cause 2 1.0.0.2
OSVersion: Windows 7 (or later) 6.2.9200
CPU: Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz ~2.21GHz
PhysicalMemory: 2047MB (74% used)
VideoCard: NVIDIA GeForce GTX 1060
GpuDedicatedVideoMem: 3072MB
GpuDedicatedSysMem: 0MB
GpuSharedSysMem: 1023MB
GpuDeviceID: 1C20
GpuVendorID: 10DE
GpuCount: 1
GpuDriverVersion: 26.21.14.3648
GpuVendorDriverVersion: 43648
DisplayMode: 1920x1080, 4, 1, 1
Settings: 1,3,1,6,2,1,3,1,3,1,1,1


CONTEXT: (.ecxr)
eax=0014a7b0 ebx=0650da90 ecx=00000018 edx=1d20c000 esi=00000000 edi=24115780
eip=00946728 esp=2411571c ebp=24115764 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
JustCause2+0x546728:
00946728 f30f103410 movss xmm6,dword ptr [eax+edx] ds:002b:1d3567b0=????????
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00946728 (JustCause2+0x00546728)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 1d3567b0
Attempt to read from address 1d3567b0

PROCESS_NAME: JustCause2.exe

READ_ADDRESS: 1d3567b0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 1d3567b0

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
24115764 00940abf 0000b5f5 064dcc90 0650da90 JustCause2+0x546728
241177bc 0063dc73 0650da90 064dccf0 064dcc90 JustCause2+0x540abf
2411fe04 00841ade 064dcc90 2411fe28 00923785 JustCause2+0x23dc73
2411fe10 00923785 064dcd70 01260e90 05ef9628 JustCause2+0x441ade
2411fe28 004d354f 064d71f0 01260e90 05ef9628 JustCause2+0x523785
2411fe44 004db78b 01260e90 00a3e6a0 00a3e6a0 JustCause2+0xd354f
2411ff64 00a3e6c4 05ef9628 2411ff80 77166359 JustCause2+0xdb78b
2411ff70 77166359 05ecdc30 77166340 2411ffdc JustCause2+0x63e6c4
2411ff80 77767b74 05ecdc30 3ce17a1b 00000000 kernel32!BaseThreadInitThunk+0x19
2411ffdc 77767b44 ffffffff 77788ef1 00000000 ntdll!__RtlUserThreadStart+0x2f
2411ffec 00000000 00a3e6a0 05ecdc30 00000000 ntdll!_RtlUserThreadStart+0x1b


SYMBOL_NAME: JustCause2+546728

MODULE_NAME: JustCause2

IMAGE_NAME: JustCause2.exe

STACK_COMMAND: ~35s ; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_JustCause2.exe!Unknown

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x86

OSNAME: Windows 10

FAILURE_ID_HASH: {e2f4c107-fa59-dd25-2a1e-1ced431b55bf}

Followup: MachineOwner
---------

[Jack Schitt]

Key : AV.Fault

Make sure whatever Anti-Virus software you have has an exception for the game so it allows whatever the game tries to do instead of interrupting and blocking it.

[Chris Solomon]

AH! thanks, bunches!. I was wondering what that meant.

at the moment i am letting the free 90-day subscriiption to norton internet security that came with my system run it's course. I will have too look up how to add an exception for jc2. I intend on switching over to ESET Smart Security Premium after the 'trial' period is up.

[Chris Solomon]

do you think i should add an exception forjust justcause2.exe or the whole directory, or both?

[Chris Solomon]

adding an exemption doesn't seem to fix the issue.

Key : Analysis.CPU.Sec
Value: 14


i wonder if this is refering to cpu security as a more specific cause of the problem, which would mean that windows defender's security or the built in security of the CPU is too blame.

Key : AV.Fault
Value: Read

av.fault might also mean audio/video insteadof anti-virus. in whichcase it would mean that nvidia still hasn't fixed their sh*t, which is what i was afraid of. guess i will be keeping my old system around for a bit longer. It doesn't run JC2 as well, but at least it runs with out crashing.

[Jack Schitt]

Oh gawd, Norton.
Get rid of that garbage!!!!! Read the reviews on that crapware if you don't believe me.
Uninstall Norton = problem solved
Maybe....

DON'T get:
Kaspersky: It's even worse
Avast: It's...not any better. Still false reports and blocks stuff it shouldn't.


My suggestion, what I have run since 1997: AVG Free
22 year of super easy installations on probably thousands of machines that have no issues with it? AVG FREE is for me!!!!

Norton has never been good.
Kaspersky has had complaints since it came out
Avast hasn't had many complaints but it has had millions of reported false reports and reports of blocking things it shouldn't.

AVG...eh...I've heard complaints about it's cost for the paid version. Don't need the paid version.

[Modaflanker]

From other threads: Disable Motion Blur, Bokeh Filter, and Decals in Graphics (or Advanced Graphics) options. Seems to have fixed the random crash to desktops for me.

[Jack Schitt]

Is it actually crashing? On win7 for me when I would drag the (invisible) cursor off the screen it would minimize. I ended up getting a task bar tweaking tool to stop it from doing that.

[Chris Solomon]

believe me, i know norton is crap. i have an eset license all lined up.

[Chris Solomon]

Originally posted by Jack Schitt:

Is it actually crashing? On win7 for me when I would drag the (invisible) cursor off the screen it would minimize. I ended up getting a task bar tweaking tool to stop it from doing that.

yes, it is actually crashing. it stops running and jc2 creates a crash dump.

it is a shame. the game was just on sale too.... why steam would still sell a game that no longer works properly, is beyond me. the game doesn't even run on my old system anymore unless i use a really old video driver version. the issues stems from a fix the nvidia made to the drivers for one of the tomb raider games and one or two others. when they fixed the issue for those, the fix ended up breaking jc2, and who knows what else. the fixes made to the drivers of course made it into all the drivers released for the later nvidia cards. i wish there were some sort of wrapper or something that would bypass those 'fixes' nvidia made.

speaking of which..... there used to be this video card emulator program, that was mostly meant one to allow one to run games using older video hardware, but there should be no reason it won't wok in reverse...... i will give it a shot..... but the sticking point may be that i am still using the same video drivers underneath.

[Chris Solomon]

oooh..... was trying to dig deeper into the crash dumps, and found the following info.... maybe helpful, maybe not.i can' tell on my own.

[0x0] ntdll!NtGetContextThread + 0xc

wheni clicked on that item....

LocalVariables The parameter is incorrect. (0x80070057)
Parameters The parameter is incorrect. (0x80070057)
Attributes 0x77772c4c 0x777393ea 0x24112a60 0x24112a60 0x7c7f960 1 0x0

the memory address contents read as a bunch of ?? marks, probably an indicator of the denied access

[Jack Schitt]

I have a GTX1050 in this system and a GTX1080 in another that are up to date with the latest drivers and win10 updates as of 10/1/19. Game runs fine for me. So it's not what you think with the driver updates. The dump file says it's the anti-virus that's blocking it. You didn't mention whether you got rid of the crap Norton and tried it. And too each their own but I don't get why someone would purchase almost $200 of AV software when there's plenty of free software out there that does the job very well.

[Jack Schitt]

The things that would be denying access:
- antivirus software
- a firewall
- windows permissions

The game nor anything to do with the video card isn't doing that.

[Chris Solomon]

i got an 8th gen i7 and a nvidia 1060 6gb.on my old system there was clearly a crash caused by the nvidia drivers, but not so on my new system, even if the crash seems similar. on my system i also have Device Guard, Credential Guard, and HVCI security (core isolation) enabled.I suppose i could try disabling it too see if it helps, but i would prefer it be enabled since it is a security measure built into windows.

[Chris Solomon]

why would someone pay for AV software? for the program support when things go wrong. I chose eset, becuase when you pay for a license, you are paying for support, and for the latest udate definitions. they don't make me pay for a new version every time on comes out. unlike some other AV programs i have encountered in the past..... the version of eset i have covers firewall, and HIPS, and some other stuffthat has kept my PC virus and intruder free.