KernelBase.dll Access is denied.

Question

_{Friday, June 1, 2018 6:54 PM}

i am getting the below problem while trying to debug the project in visual studio 2017

Exception thrown at 0x75A6C54F (KernelBase.dll) in fanuc_0id.exe: 0x00000005: Access is denied.

Any ideas?

All replies (3)

_{Friday, June 1, 2018 9:05 PM}

Great, so you've debugged your program and hit a problem. Keep debugging it.

Here is some documentation on the debugger.

-- pa

_{Sunday, June 3, 2018 1:56 AM}

First, just because it is saying that an exception was thrown in kernelbase.dll, this doesn't mean that kernelbase.dll was the origin. You see, RaiseException's implementation is in kernelbase.dll, and this is how exceptions are thrown, but this function is also always seen as the starting point.

So:

#include <Windows.h>
#include <cstdio>

void b()
{
    RaiseException(ERROR_ACCESS_DENIED, 0, 0, nullptr);
}

void a()
{
    b();
}

int main()
{
    HMODULE hm = nullptr;
    GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, L"kernelbase.dll", &hm);
    FARPROC fp = GetProcAddress(hm, "RaiseException");
    wprintf(L"%x\n", fp);
    a();
    
    return 0;
}

will output:

Exception thrown at 0x7746D722 (KernelBase.dll) in meh.exe: 0x00000005: Access is denied.

even though the function b was what called RaiseException. By the way, C++'s throw will also output something similar:

Exception thrown at 0x7746D722 in meh.exe: Microsoft C++ exception: long at memory location 0x00B3F614.

So even though the exception is raised in your own code, RaiseException in kernelbase.dll is always given as the source.

The other thing is, do you just get:

Exception thrown at 0x7746D722 (KernelBase.dll) in meh.exe: 0x00000005: Access is denied.

or do you get:

Exception thrown at 0x7746D722 (KernelBase.dll) in meh.exe: 0x00000005: Access is denied.
Unhandled exception at 0x7746D722 (KernelBase.dll) in meh.exe: 0x00000005: Access is denied.

If it is the second one then the debugger should automatically break at the line in your code nearest to where the exception is thrown.

If it is the first then you can ignore it. You see, if an exception is thrown but handled, the debugger will still indicate that an exception has been thrown. For example:

#include <Windows.h>

int main()
{
    __try
    {
        RaiseException(ERROR_ACCESS_DENIED, 0, 0, nullptr);
    }
    __except (GetExceptionCode() == 5 ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH)
    {

    }
    
    return 0;
}

will run successfully since the exception has been handled, and:

Exception thrown at 0x7746D722 (KernelBase.dll) in meh.exe: 0x00000005: Access is denied.

is outputted in the output window. A similar thing will happen with:

int main()
{
    try
    {
        throw 5;
    }
    catch (int &e)
    {

    }
    
    return 0;
}

again it will run successfully since the exception is handled, but the exception is still noted in the output window.

So it would be useful to indicate if you are just being told than an exception was thrown, or if an exception was thrown but not handled.

Also, as a side note, it is not expected that we will have the same address that the exception is thrown at. We may be using different versions of Windows, and implementation changes could move where code is in kernelbase.dll, and ASLR will also have an effect moving the base address of the dynamic library around.

This is a signature. Any samples given are not meant to have error checking or show best practices. They are meant to just illustrate a point. I may also give inefficient code or introduce some problems to discourage copy/paste coding. This is because the major point of my posts is to aid in the learning process.

_{Sunday, June 3, 2018 12:21 PM | 1 vote}

Hmm, seems that the debugger quick starts & tutorials docum does not have a recipe for this. It is a frequent situation. I've asked to add a tutorial for proceeding from exceptions here. 

You are welcome to add/comment.

Regards,

-- pa