Memory errors all over the place...

J

jyi786

Supreme [H]ardness
Joined
Jun 13, 2002
Messages
5,760
I just did a brand new clean install of Windows XP after having the same install running for over 2 years. I didn't change any hardware, and am using all the same software I used in my previous install.

The only problem now is that I'm getting "memory could not be read" or "memory could not be written" errors ALL OVER the place. Any program is susceptible to crash. Everything would be working fine, one day, another day any app would crash with this error. Programs as simple as Winamp, IE, anything would crash. I've tried looking on forums and all over google, but to no avail.

Is there any way you can help me decode the error messages so that I can find out what's causing these frustrating error messages?
 
Download memtest86 and loop some tests to check your ram to be error free

oldmx
 
OldMX, I did that already. None of my hardware is bad. I even backed down from my OC to see if somehow my chip was dying.

Like I mentioned previously, all this is only happening after the new install of WinXP.
 
Both my HDDs came back fine. I also use Speedfan, which has an integrated SMART detection utility. There's no problem with the HDDs.

What next?
 
Phoenix86 said:
Test the HDD, tools on ultimate boot cd, link in sig.
Click to expand...
What's the hard drive got to do with it? These are application faults.

ajm786, I'd be happy to help you investigate the error messages. Please provide the complete error text. If you're getting a message box with this error, press CTRL+INS while the message box has focus. This will put the text of the box on the clipboard, and you can easily paste it into a message to be posted here.
 
Here are a few of the errors. Luckily, the Event Viewer catches everything.

Example 1:
Application popup: audacity.exe - Application Error : The instruction at "0x00419217" referenced memory at "0x00000000". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

Example 2:
Application popup: IEXPLORE.EXE - Application Error : The instruction at "0x772992ba" referenced memory at "0x03966da4". The memory could not be "written".

Click on OK to terminate the program
Click on CANCEL to debug the program

Example 3:
Application popup: SDMCP.exe - Application Error : The instruction at "0x00405303" referenced memory at "0x00001518". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

Example 4:
Application popup: SDMCP.exe - Application Error : The instruction at "0x00405303" referenced memory at "0x00001518". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

Again, these errors are purely random and I CANNOT reproduce them. What I don't see is any similarity between any of the errors, save the SDMCP error.

Thanks for all the help.
 
all the basics covered?....ie drivers updated (chipset, video, sound .blah blah ..) . ..updates for windows .. all that good stuff


[F]old|[H]
 
ThreeDee said:
all the basics covered?....ie drivers updated (chipset, video, sound .blah blah ..) . ..updates for windows .. all that good stuff


[F]old|[H]
Click to expand...

Yes, ALL the latest updates (video card, sound card, system drivers, etc). System is perfect in that respect.
 
Why you receive these errors, are you submitting the crash data to Microsoft?

Are you overclocked?

Can you do a driverquery /v and paste the output here, please?
 
I am not submitting the crash errors to Microsoft. Stopped doing that a long time ago, or it's just that I haven't been getting any errors for the past 3 years. :D

I am overclocked. I can run Prime95 72 hours straight, with 2 instances (hyperthreading), in conjunction with a continuous loop of 3dMark2001SE. I'm confident there is no problem with my hardware.

I'll do the driverquery and see what that shows me, but I'll have to do it later, as I'm working right now.

Did anyone get around to decoding the error codes that I pasted above?
 
ajm786 said:
I am not submitting the crash errors to Microsoft. Stopped doing that a long time ago, or it's just that I haven't been getting any errors for the past 3 years. :D

I am overclocked. I can run Prime95 72 hours straight, with 2 instances (hyperthreading), in conjunction with a continuous loop of 3dMark2001SE. I'm confident there is no problem with my hardware.

[...]

Did anyone get around to decoding the error codes that I pasted above?
Click to expand...
Without the crash dumps (or at least, the dump buckets), I won't be able to help.

While you think that there's nothing wrong with your hardware, I don't think you've found a series of special bugs in all of those programs. If you truly believe that your hardware isn't to blame, then you should start disabling software and see if the situation improves. I'd start with Stardock.

To help with your troubleshooting, these aren't "memory errors". They're caused by code referencing memory that it doesn't own. Instead of letting one process damage the memory owned by another process, or corrupt itself by touching memory that's not owned by anyone and therefore entirely uninitialized, Windows protects the address space of each running process.

Programs don't attempt to write to memory they don't own unless they have a bug, or unless some software they're dependent upon is giving the program bad data. Download accelerators, for example, insert themselves between IE and the network stack. A poorly written download accelerator might give an improper response to one of IE's network requests, and cause IE to fault with a message like one that you've provided. IE is shown as the faulting module, when the bug really exists in the network accelerator code.

Good luck!
 
mikeblas said:
While you think that there's nothing wrong with your hardware, I don't think you've found a series of special bugs in all of those programs. If you truly believe that your hardware isn't to blame, then you should start disabling software and see if the situation improves. I'd start with Stardock.
Click to expand...

I'll get you the crash dumps by tonight.

On top of that, any particular reason why you refer to Stardock first? I've seen a lot of people state this in many forums, but without background.

If it does happen to be Stardock, can you recommend a shortcut program that's as good as Stardock that I can use?

Thanks.
 
ajm786 said:
On top of that, any particular reason why you refer to Stardock first? I've seen a lot of people state this in many forums, but without background.
Click to expand...
Because it subclasses windows aggressively. Unfortunately, it wasn't tested very well and has some bugs that cause crashes by incorrectly handling some messages during the subclassing; as well as not cleanly attaching or detaching. (Maybe my opinion is out of date, as I haven't played with it in more than a year.)

ajm786 said:
If it does happen to be Stardock, can you recommend a shortcut program that's as good as Stardock that I can use?
Click to expand...
I'd suggest you start another thread with that question.

ajm786 said:
I'll get you the crash dumps by tonight.
Click to expand...
I'm busy all weekend and will have a tough week next week, so I don't know when I'll have the time to help. Did I miss your posting of the driverquery, by the way?
 
Thanks mike. You've been a lot of help to me, much more than all last week.

I'll run some more tests and post whatever I can, and wait for your response, whenever's convenient for ya.
 
Let me be more specific: a dump is a binary file that I can attach to with a debugger. It includes symbols and execution state for all the modules involved. (How did you create the file that you sent?) Using the dump, I can get accurate symbols for Windows and examine all the code and data in the faulting process without actually installing any of the software invovled.

Assuming the info in the file you've sent is correct, the problem is happening in SDMCP. You hard drives aren't involved, and I can't imagine any device drivers are, either:

Code: 
        00405300 56               push    esi
        00405301 8bf1             mov     esi,ecx
FAULT ->00405303 8b4604           mov     eax,[esi+0x4]     ds:0023:00001518=????????
        00405306 85c0             test    eax,eax
        00405308 7415             jz      SDMCP+0x531f (0040531f)
        0040530a 8b4608           mov     eax,[esi+0x8]
        0040530d 85c0             test    eax,eax
        0040530f 740e             jz      SDMCP+0x531f (0040531f)
        00405311 6a01             push    0x1
        00405313 c7460800000000   mov     dword ptr [esi+0x8],0x0
        0040531a e811ffffff       call    SDMCP+0x5230 (00405230)
        0040531f 8bce             mov     ecx,esi
        00405321 e83a020000       call    SDMCP+0x5560 (00405560)
        00405326 5e               pop     esi
        00405327 c3               ret

This assembly looks like a C++ function, which expects a valid "this" pointer to be passed in the ECX register. The function saves ESI on the stack, then moves ECX to ESI. It tries to get the fourth byte of member data from the object it expects to live at [ESI]; if ECX had a valid "this" pointer, [ESI+4] would be the fourth byte of the object's metadata. ESI isn't pointing at a valid address, so the program faults.

The C++ source would look like this:

Code: 
INT SDMCP::Function5300()
{
   if (Word4 != 0 && word8 != 0)
   {
      word8 = 1;
      Function5230(1);
   }
   return Function5560();
}

so this function is just checking some state, conditionally calling something based on that state, resetting the state if so; and then unconditionally calling something else before it returns. But that doesn't tell us about your problem.

It's very strange that a function expecting a this pointer would be called from outside the application. Windows doesn't use the C++ calling convention for any callback it makes, so it will never pass a valid "this" pointer to any function it calls.

The stack trace leading to the fault looks curious:

Code: 
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll - 
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr  Args to Child              
00bcfea8 77d48816 00402190 00070114 00000113 SDMCP+0x5303
00bcff10 77d489cd 00000000 00402190 00070114 USER32!GetDC+0x14f
00bcff70 77d496c7 00bcff9c 00000001 77d51211 USER32!GetWindowLongW+0x127
00bcff80 00403209 00bcff9c 7c910000 00bcffec USER32!DispatchMessageA+0xf
77d51211 ff336aec 86e80875 5dffff72 330004c2 SDMCP+0x3209
8b55ff8b 00000000 00000000 00000000 00000000 0xff336aec

SDMCP is calling into Windows; while you don't have symbols installed, I think we can figure that your dump utility is correct in suggesting that SDMCP is calling DispatchMessage(). DispatchMessage() wants to know what message proc to call, so it calls GetWindowLong(), and GetWindowLong() is giving it an address back in SDMCP, and that's how we land where we do.

DispatchMessage() has an obvious reason to call GetWindowLong(), but I can't imagine that GetWindowLong() would call GetDC(), or that GetDC() would call back into the application.

Again, without a dump I can't give a definitive diagnosis. (And even then it would be quite an effort, since I won't have symbols or sources from SDMCP or Ultramon.) From what you've sent, I'd say the problem is either in SDCMP or UltraMon -- or some interaction between the two. I'd disable one or the other or both, and see if the problem gets better; this is the same advice I gave three or four posts ago.

Perhaps a better approach is to get in touch with the StarDock people and ask them for help.
 
I myself was looking at the error message details, which I was able to capture with DrWatson32, looking at the exact same thing you were looking at. What I wasn't understanding was how SDMCP was affecting all other windows that were open causing the crashes, but like you explained earlier, it's possible.

Anyhow, I'll take this up with Stardock and see what they say. Thanks for all your help Mike, and everyone else.
 
Edit:

Think I got my problem licked.

I found out that SDMCP is only required if you are using it to REPLACE the windows system tray. Since I am only using it for shortcut access, obviously, this SDMCP process has no use for me. Nevertheless, it automatically started at every startup. I simply deleted it and all it's corresponding DLLs, which was not easy, because it was locked, by what process, I don't know. I did get the files deleted eventually, which was found in *root*/Program Files/Common Files/Stardock. There were 3 files that I deleted.

Once I did this, SDMCP did not startup, obviously because it was deleted, and for once, I was error free.

So as of right now, I'm still testing to see if this has indeed solved my problem. I hope my explanation can help anyone else who's in need of a solution.
 
ajm786 said:
I simply deleted it and all it's corresponding DLLs, which was not easy, because it was locked, by what process, I don't know.
Click to expand...

By itself, since it's a program that's loaded and running. In the future, you can use WHOLOCKME to see who's holding a lock on a file.

Doesn't this program have an uninstall routine? I'm still at a loss as to why you didn't contact the StarDock folks for support.
 
mikeblas said:
By itself, since it's a program that's loaded and running. In the future, you can use WHOLOCKME to see who's holding a lock on a file.

Doesn't this program have an uninstall routine? I'm still at a loss as to why you didn't contact the StarDock folks for support.
Click to expand...

This program itself does not have an uninstall routine, because I think it's part of the whole Objecdock program package.

I didn't contact Stardock directly because I went on their (Stardock's) forums and people were having almost the same issues with this SDMCP.exe. Some admins of the forums over there suggested disabling SDMCP. I just went ahead and followed their advice. I'm sure, from the sound of it, Stardock already is aware of the situation.
 
You must log in or register to reply here.
Back
Top