title: Debug BEX (0xc0000417) Exception using windbg on Windows 7
body: <p>I'm debugging an application crash on 32Bit windows 7. (I don't have access to source code).</p>
  
  <p>The application crashing with BEX exception. </p>
  
  <pre><code>Problem signature:
    Problem Event Name:   BEX
    Application Name: xxxxx.EXE
    Application Version:  xx.xx.xxx.xxx
    Application Timestamp:    xxxxx
    Fault Module Name:    xxxxx.dll
    Fault Module Version: x.x.xx.xx
    Fault Module Timestamp:   xxxxx
    Exception Offset: xxxxxxxx
    Exception Code:   c0000417
    Exception Data:   00000000
    OS Version:   x.x.xx.x.x.x.xxx.xx
    Locale ID:    xxxx
  
  Additional information about the problem:
    LCID: xxxx
    skulcid:  xxxx
  </code></pre>
  
  <p><a href="https://technet.microsoft.com/en-us/library/cc738483(v=ws.10).aspx" rel="nofollow">https://technet.microsoft.com/en-us/library/cc738483(v=ws.10).aspx</a></p>
  
  <p>Above link says, BEX (<strong>c0000417 ==> STATUS_INVALID_CRUNTIME_PARAMETER</strong>)exception occurs due to buffer overflow / DEP violation(when its trying to execute page which is not executable ). Which I think is a security issue in the app.</p>
  
  <p><strong>Reference:</strong></p>
  
  <p><a href="https://social.msdn.microsoft.com/Forums/vstudio/en-US/04f1c082-79db-4f41-82fc-3d41b14c8713/regarding-error-statusinvalidcruntimeparameter-c0000417?forum=vcgeneral" rel="nofollow">https://social.msdn.microsoft.com/Forums/vstudio/en-US/04f1c082-79db-4f41-82fc-3d41b14c8713/regarding-error-statusinvalidcruntimeparameter-c0000417?forum=vcgeneral</a></p>
  
  <blockquote>
    <p>This looks like a continuation of the work done on the secure CRT in
    VS2008.  The exception is thrown by _invoke_watson(), hard to track
    where it may be called, lots of macros.  It is clearly meant to
    prevent a CRT function from continuing with an invalid argument, a
    major security loophole.  Debug it by running IE in the debugger with
    Debug + Exceptions, Thrown checkbox turned on.  You ought to get a
    call stack that shows the problem function call.</p>
  </blockquote>
  
  <p>The problem is when I'm attaching the application with windbg, instead of stopping the debugger in faulting point , the application is getting terminated. And I get this in windbg screen</p>
  
  <pre><code>eax=000000c0 ebx=00000000 ecx=00000000 edx=2f9a1265 esi=00000198 edi=00000000
  eip=778970d4 esp=01adfaa4 ebp=01adfb10 iopl=0         nv up ei pl zr na pe nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
  ntdll!KiFastSystemCallRet:
  778970d4 c3              ret
  0:001&gt; g
         ^ No runnable debuggees error in 'g'
  </code></pre>
  
  <p>So my question is, if I have to break the debugger at the exact faulting point (Instead of exiting is completely) what changes I have to made in OS / Debugger Settings ? </p>