Oops! Internal error 1203 in IDA

[roocoon]

Hello.
Has anybody come across this one?

I saw a reference in the v6.9 changelog that it was caused by very long export names and it was fixed.

For one thing, I have v6.8.
For another, I certainly don't have any such export names.

IDA used to work with that program a couple of months ago and I haven't added anything to IDA since then.
The only possibility is an upgrade I did for that program. Maybe something in it, has affected IDA though I can't imagine why.

The dmp shows nothing of interest other than a funky exception code e0424242.
The idalog.txt shows this strange output when it crashes:

Debugged application message: '
Debugged application message: 0:< bootstrap: switchable allocators configured 
Debugged application message:
Debugged application message: '
Debugged application message: 0:< bootstrap: special folders configured 
Debugged application message:
Debugged application message: '
Debugged application message: 0:< bootstrap: private profiles loaded 
Debugged application message:

Any ideas?

 

[Storm Shadow]

that is wierd.
Did you check all the debuggings log option to get more info?
also ida 6.8 is very bad for debugging , it gets all kind of wierd exeptions all the time.

Also if your using the old dayabse to debugg try removing the BP before apling them one by one to see where it goes wrong, thats what i normally do when having these wierd unexplained issues.

 

[roocoon]

There's not much coming out.
The debugged program is just starting up and the Ida log shows the program loading modules until it crashes. The module I'm breaking on, hasn't even been loaded yet and the Ida database is new.

There is a line in Ida log that could mean something:
GetUrlPageData2 (WinHttp) failed: 12002.

The firewall blocks the application from outside access (the blocks are shown in the firewall log) and maybe that's where the problem is.
Something in the program might try to reset/recover and that could throw Ida off (?).
I keep changing the firewall rules and this could be the reason why it used to work before.

I'll do a tcp trace in case something shows up.