Re: What do you use to read your Windows crash logs?

malxau wrote:
>> Since this is my first crash debug attempt, I am wondering what others on
>> this newsgroup use to debug crash logs found in %LOCALAPPDATA%\CrashDumps
> 
> I still use WinDbg classic, not WinDbgX.  But for a first attempt, that
> was a great analysis.  I think to be "strictly correct" you'd want to
> check the exception record/context record (.exr/.cxr) to see which
> address was accessed, but it's 99%+ likely that it's unloaded code.
> 
> In the spirit of "IRC is for people with mutual interests", this is my
> intro to WinDbg: http://www.malsmith.net/blog/patching-closed-software/

Thanks for that interesting patching closed software web block to force
Microsoft's linker to spoof its version where you apparently launched
link.exe inside WinDbg classic to look around the wmain entry point.

You told the CPU to pause at the address where the version string was
stored to analyze the conditional assembly code (CMP, TEST) that dictated
whether the linker threw an error or proceeded normally. 

Once you found the pair of validation checks, you hex edited link.exe to
force the jump-if-greater-than-or-equal into an unconditional JMP.

By changing the conditional JGE to an unconditional JMP, you forced the
Microsoft linker to execute the version-success path every time.

I need something like that because the Aloha.exe browser is checking its
version code and even though the version is displayed in the binary 3
times, I haven't figured out yet why changing it still fails version
checks.

I think the version checks are happening on the server, so I need to spoof
that the check returns 4.19.0.0 when update.alohabrowser.com is asked.

Thanks for that wonderful tutorial, which everyone should read who has the
need to patch code that is failing a simple go-no-go version check path.