Exception Module is an obvious pattern we add for pattern language completeness. It is a module or component where the actual exception happened, for example, ModuleA from this Exception Stack Trace (Volume 5, page 93):
9 Id: 1df4.a08 Suspend: -1 Teb: 7fff4000 Unfrozen ChildEBP RetAddr 1022f5a8 7c90df4a ntdll!KiFastSystemCallRet 1022f5ac 7c8648a2 ntdll!ZwWaitForMultipleObjects+0xc 1022f900 7c83ab50 kernel32!UnhandledExceptionFilter+0×8b9 1022f908 7c839b39 kernel32!BaseThreadStart+0×4d 1022f930 7c9032a8 kernel32!_except_handler3+0×61 1022f954 7c90327a ntdll!ExecuteHandler2+0×26 1022fa04 7c90e48a ntdll!ExecuteHandler+0×24 1022fa04 7c812afb ntdll!KiUserExceptionDispatcher+0xe 1022fd5c 0b82e680 kernel32!RaiseException+0×53 WARNING: Stack unwind information not available. Following frames may be wrong. 1022fd94 0b82d2f2 ModuleA+0×21e640 1022fde8 7753004f ModuleA+0×21d4f2 1022fdfc 7753032f ole32!CClassCache::CDllPathEntry::CanUnload_rl+0×3b 1022ff3c 7753028b ole32!CClassCache::FreeUnused+0×70 1022ff4c 775300b5 ole32!CoFreeUnusedLibrariesEx+0×36 1022ff58 77596af5 ole32!CoFreeUnusedLibraries+0×9 1022ff6c 77566ff9 ole32!CDllHost::MTAWorkerLoop+0×25 1022ff8c 7752687c ole32!CDllHost::WorkerThread+0xc1 1022ff94 774fe3ee ole32!DLLHostThreadEntry+0xd 1022ffa8 774fe456 ole32!CRpcThread::WorkerLoop+0×1e 1022ffb4 7c80b729 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0×1b 1022ffec 00000000 kernel32!BaseThreadStart+0×37
Because we have a software exception, we can use backwards disassembly (ub WinDbg command) to check stack trace correctness in case of stack unwind warnings (like in Coincidental Symbolic Information pattern, Volume 1, page 390). Here's another example, for recent MS Paint crash we observed, with msvcrt exception module. However, if we skip it as a Well-Tested Module (Volume 6, page 48), the next exception module candidate is mspaint.
0:000> kc Call Site ntdll!NtWaitForMultipleObjects KERNELBASE!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjectsExImplementation kernel32!WerpReportFaultInternal kernel32!WerpReportFault kernel32!BasepReportFault kernel32!UnhandledExceptionFilter ntdll! ?? ::FNODOBFM::`string' ntdll!_C_specific_handler ntdll!RtlpExecuteHandlerForException ntdll!RtlDispatchException ntdll!KiUserExceptionDispatch msvcrt!memcpy mspaint!CImgWnd::CmdCrop mspaint!CPBView::OnImageCrop mfc42u!_AfxDispatchCmdMsg mfc42u!CCmdTarget::OnCmdMsg mfc42u!CView::OnCmdMsg mspaint!CPBView::OnCmdMsg mfc42u!CFrameWnd::OnCmdMsg mspaint!CGenericCommandSite::XGenericCommandSiteCommandHandler::Execute UIRibbon!CControlUser::_ExecuteOnHandler UIRibbon!CGenericControlUser::SetValueImpl UIRibbon!CGenericDataSource::SetValue UIRibbon!OfficeSpace::DataSource::SetValue UIRibbon!OfficeSpace::FSControl::SetValue UIRibbon!NetUI::DeferCycle::ProcessDataBindingPropertyChangeRecords UIRibbon!NetUI::DeferCycle::HrAddDataBindingPropertyChangeRecord UIRibbon!NetUI::Binding::SetDataSourceValue UIRibbon!NetUI::Bindings::OnBindingPropertyChanged UIRibbon!NetUI::Node::OnPropertyChanged UIRibbon!FlexUI::Concept::OnPropertyChanged UIRibbon!NetUI::Node::FExecuteCommand UIRibbon!FlexUI::ExecuteAction::OnCommand UIRibbon!NetUI::Node::FExecuteCommand UIRibbon!NetUI::SimpleButton::OnEvent UIRibbon!NetUI::Element::_DisplayNodeCallback UIRibbon!GPCB::xwInvokeDirect UIRibbon!GPCB::xwInvokeFull UIRibbon!DUserSendEvent UIRibbon!NetUI::Element::FireEvent UIRibbon!NetUI::_FireClickEvent UIRibbon!NetUI::SimpleButton::OnInput UIRibbon!NetUI::Element::_DisplayNodeCallback UIRibbon!GPCB::xwInvokeDirect UIRibbon!GPCB::xwInvokeFull UIRibbon!BaseMsgQ::xwProcessNL UIRibbon!DelayedMsgQ::xwProcessDelayedNL UIRibbon!ContextLock::~ContextLock UIRibbon!HWndContainer::xdHandleMessage UIRibbon!ExtraInfoWndProc user32!UserCallWinProcCheckWow user32!DispatchMessageWorker mfc42u!CWinThread::PumpMessage mfc42u!CWinThread::Run mfc42u!AfxWinMain mspaint!LDunscale kernel32!BaseThreadInitThunk ntdll!RtlUserThreadStart
3.138.37.174