Windows c++ service faulting on ucrtbase.dll when starting

TheEggSample picture TheEggSample · Oct 16, 2017 · Viewed 13.2k times · Source

So I've been developing this program for a while now... Its meant to act as an asset manager (and potentially more in the future) for our IT team. I have 2 services which we'll refer to as "Manager" and "IAM" for right now. The "Manager" does all things managerial for all services (currently only the inventory asset manager known as "IAM") such as automatic updates, etc., while the asset manager does its job.

Anyways, its been working great for a while now. Recently I implemented an automatic updating feature (actually still needing to be tested and likely debugged). While doing this, I needed to get my naming consistent (for example, renaming my service from "Updater" and "CppWindowsService" to the software's actual name).

Before this, it had been working great! Started, stopped, installed, and uninstalled with no hiccups. I change the name for everything, and make sure it all compiles ok. Looks good. Install works great for both "Manager" and "IAM" now, but as soon as I try to start it, I get:

StartService failed (1053)

Also, when I try to start it from services.msc, then I get the following error message:

Windows could not start the service on Local Computer.

Error 1053: The service did not respond to the start or control request in a timely fashion

The strange thing about this though is that it doesn't wait for any sort of timeout. It just instantly spits out the message. That message comes from the code called from my wmain() (windows entry point. main() otherwise.) function.

if (!StartService(
        schService,  // handle to service 
        0,           // number of arguments 
        NULL))      // no arguments 
    {
        printf("StartService failed (%d)\n", GetLastError());
        CloseServiceHandle(schService);
        CloseServiceHandle(schSCManager);
        return;
    }
    else printf("Service start pending...\n");

In Windows Event Log, I get an application error containing the following details after fault.

Faulting application name: InITManager.exe, version: 0.0.0.0, time stamp: 0x59e11e44

Faulting module name: ucrtbase.dll, version: 10.0.15063.674, time stamp: 0x8ac9f9d4

Exception code: 0xc0000409

Fault offset: 0x000000000007350e

Faulting process id: 0x3008

Faulting application start time: 0x01d346915918e17d

Faulting application path: C:\Users\collin.walker\Desktop\InITService\C++\x64\Release\Manager.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: 7fcbdcc4-be8e-476a-960f-4fa1fb21f892

Faulting package full name:

Faulting package-relative application ID:

Other info: ucrtbase.dll is used by Visual Studio and is associated with the Release build, where as ucrtbased.dll is associated with the debugger build. I am building in Release mode.

Now, I've already been told the issue isn't my code, but if anyone feels as though they need to see it, I will include it then. Its very straightforward c++ winapi stuff though.

If anyone has any further suggestions on how to troubleshoot this, please let me know, and thanks for all help in advance!

Answer

TheEggSample picture TheEggSample · Oct 25, 2017

Kind of forgot about this post during my troubleshooting... Anyways, I figured it out. Comments above were spot on!

For me the buffer overflow came from me changing my service names, which also changed the program directory names. The error was happening when I was initializing my logging object in my service's constructor. I only have like 2 lines of code in the constructor, so I totally forgot to look there. Changed the hardcoded directory location where the log was being created, and it all started working great! Thanks guys for the helpful info!