We got an interesting application crash yesterday with a confusing message similar to this:
Fault bucket 42424242, type 1
Event Name: APPCRASH
Response: None
Cab Id: 0
Problem signature:
P1: MyApp.exe
P2: 1.42.42.42
P3: 598773cf
P4: StackHash_ac62
P5: 0.0.0.0
P6: 00000000
P7: c0000007
P8: 00000000
P9:
P10:
We spent some time wondering if our crypto libraries were the problem (we just made some changes recently), but concluded that was unlikely. So what the heck is the “StackHash” module? Did our trashed stack cause the kernel to think we were a different module? Nope.
The answer is that the Windows executive couldn’t identify the module we were in when the application crashed (it uses the instruction pointer to determine what code was executing). In this case, the kernel simply takes a hash of the stack so at least we might be able to identify if we’ve seen this exact crash before. Here’s the answer summarized by an engineer from Microsoft:
In the OS when I try to get a faulting module name it is possible that there is no module laoded (sic) at that address. For example in this case the EIP was zero. So in those cases where a module is not loaded and it is not also in the unloaded module list, I take a stack hash of the stack so that we can identify this crash from other crashes where also the module is not known.
Your answer, while informative, doesn’t tell anyone how to fix the issue. I would imagine most folks would like to know what IS the problem, not what MIGHT be.
The error is related to Data Execution Prevention, btw. I think your MS Engineer was blowing smoke up your butt because he didn’t know how to fix it.
Here’s how 99 percent of Vista users can fix a StackHash failure. I’ll walk you through it step by step:
Method A:
—————
1. Open your Start menu and click Control Panel
2. Browse to “System Maintenance” then “System”
3. In the left panel, select “Advanced System Settings” from the available links
4. You should now see the System Properties Window, which will have three sections. The top section is labeled “Performance” and has a “Settings” button. Click this button.
5. Select the “Data Execution Prevention” tab.
6. Select the option which reads “Turn on DEP for all programs and services except those I select”
7. Use the “Browse” button to locate the executable file for the application you were trying to start when you received the StackHash error, and click Open to add it to your exceptions list.
8. Click Apply or OK to commit your changes.
Method B:
————–
Remove Vista, and either downgrade to XP, or upgrade to Linux.
Reply
Tom reply on April 29th, 2009 2:56 pm:
Hey Chris, thanks for the comment.
I would agree we’d like to know what the problem IS, but DEP is not the answer. Disabling DEP for the application just works around the error message. The problem is NOT the error message (and by extension, DEP), but the error itself. Disabling the error message just hides the problem.
I strongly recommend leaving DEP on and finding out what is actually triggering it (if you’re the application developer). I’m in no why trying to solve an end-user problem.
While I am a Linux fan (currently Fedora 10 w/ enlighenment), DEP is NOT really an OS feature… it’s a CPU feature that the kernel can chose to support. Linux has supported this for awhile now, so calling this a Vista problem is misleading.
From an OS kernel perspective, I think Vista is definitely an improvement over XP and I don’t recommend downgrading. However, I will not “take a bullet” for the shell. Hopefully this continues to improve over successive versions.
Reply
Thanks for a useful explanation on the StackHash entry.
As to DEP:
Even if Chris was right, and I don’t agree that DEP is the issue, turning off DEP for an app. every time one crashes with a StackHash error in the report, is like trying to kill a fly with a sledgehammer. And, it can be argued, missing the fly and destroying the table. I have seen many of these reports and often the crash occurs when memory is low, whether that’s directly related to the cause or just a stressing factor. This is not surprising, since many crashes are caused by an illegal memory operation. This is often related to a driver trying to execute an operation which is unadvisable in Windows. However, these operations DON’T EVEN ALWAYS result in crashes.
The purpose of DEP exceptions is to allow you to run programs which simply will not run with DEP enabled. Enabling a DEP exception every time you get a single crash is like trying to stay heavily medicated to avoid an occassional minor pain. And it probably won’t work, anyway.
Reply
I should also clarify that I’m not saying some of these errors don’t trigger DEP. But I’m sure many of these same crashes occurred before DEP was available. So blaming DEP, as you say Tom, is not adressing the real error.
Reply
1st method does not work on x64 systems
Reply
I get a StackHash_7F04 crash on Windows 7 explorer sometimes when I right click on a file. I wasn’t trying to start any application.
I looked for a solution on the internet but found nothing, just a lot of bla bla bla and technobabble.
Reply
Toby reply on January 20th, 2010 9:59 pm:
Carlo, Seriously. Lets talk.
Technobabble?
Fortunately for you I like to explain things, I am a serious essay and technical writer. I lay things out for people in layman’s terms. (The best I can.)
Stack Hashes are basically data from programs that are in memory, that is unreserved for that program.
You see there is memory reserved for each program when it starts. The data from the program is extrapolated by the processor and sorted out in the processor cache if it overloads the processor cache it is feed into memory addresses that are reserved for that use, for the use of the processor to sort out the program, as it is loading.
A application will fail, or crash when that code is copied into memory and it loses some data. Data loss happens because the memory still has static built up in it that was not cleared properly or it simply ran out of room and over wrote the memory that was previously there, stringing the data together confusing the processor when it tries to load the program.
This would explain why it happens when you right click on a program, or open it. It can also happen if you are playing video or music.
Video and music data does not look different but, if a block of data overwrites another, even if the memory has been cleared by the processor, static electricity is very volatile. The science of using static electricity is really young.
Electrostatic discharge from your body can cause serious damage to your memory and has to be refreshed constantly. Electrostatic discharge from your body can burn out everything on your motherboard.
They have that hexadecimal code such as 7f04 or ac62, because that is the address in memory of the faulty code.
It can also happen if it pushes the data into memory blocks and can’t remember it did. This is called buffer overrun. It has too much Data to process at the time and it overruns the buffer and is pushed into those reserved blocks of memory I referred to. Buffer overrun is not a myth, it is common and most occasions when it happens, the memory holds it, the processor knows where it is and what it is, but, a certain small percentage is not.
The answer to the problem is to make sure you have enough memory. Other than that, well it is a bug. A hardware/software interaction type of bug. A bug that cannot be solved by any fix besides that. Watch your memory usage levels when you do it, if you can. How much memory are you using? You can simply right click on an item and all the sudden crash, the application fails.
It is a clash of data. Don’t let it bother you, when it happens shut down your computer for like 30 seconds so that the static memory is cleared naturally and watch your memory usage.
Its a way for your computer to say I can’t take it anymore, I need a bit of a break.
Or if it happens frequently like a couple of times an hour, a few times a day, you need new memory or more memory. Depending on whether you are redlining during normal usage or not. Because if it is then your computer needs new memory, if it happens constantly at the same hexadecimal address, you are going to have to buy new memory anyway because it is Farked.
Answer buy some good memory. Or go easy on the memory you have it’s not fool proof you know, Nothing is fool proof.
As for you other idiots, do any of you have a computer science degree? People at Microsoft are fools, the rate of Windows crashes are the result of not paying attention to hardware load. (They were only recently shown the error of their ways.)
The best way to run windows is to use a virtual machine on top of Ubuntu. Like they call Windows M.E., Many errors, they should call Ubuntu no errors. But software companies do not write software for people with understanding of computer hardware.
Don’t get excited, we could still be using punch cards and light bulb processing. *Snicker*
15 minutes of my life were wasted here. But, that’s life, a big waste of time.
By the way your captcha is wonky.
Reply
Donna Chick reply on June 9th, 2010 5:41 pm:
I am running Windows 7 and I have a “Microsoft Register Server has stopped working” error every time my new (2 mos old) ASUS computer starts. This began about 3 weeks ago. The accompanying info also states: PROBLEM EVENT NAME: Appcrash; APPLICATION NAME: regsvr32.exe; FAULT MODULE NAME: StackHash_8864.
Is there anything here that looks familiar to you? I’d really appreciate any help you can give me I have noticed that despite 4 gb of memory, my computer is running slowly.
Thanks so much!
~Donna
Reply
RIM_Mel reply on September 15th, 2010 1:24 pm:
Toby thanks for explaining what is going on – really appreciated!
Reply
Tim reply on December 23rd, 2011 10:57 pm:
I get this error when I try to open Mass Effects, but my machine is fast (I have 8 gigs of RAM) and I don’t have a problem opening/playing games that use the same amount of resource (Portal and Portal 2, for example), so the problem isn’t that that I don’t have enough memory. Any recommendations?
Reply
Have no idea what I am talking about, that’s great.
Reply
Hi,
I am using Windows7. Whenever I try to configure my proxy under Internet Options -> Connections -> LAN settings, the “StackHash_e3fe” error comes. Tried running the sfc scannow command, no use… I do not think that the hardware is the problem here though…
Reply
I am using Win7 64 bit on a quad 3.2ghz with 8GB ram. So its a good quick machine but I have the same problem. I am running AutoCad 2010 LT. This has crashed a few times when i have tried to save. The file did not save. This error has happened quiet a few times & I have left posts on Autodesk forums thinking it was an AutoCad problem. They think it is a problem with windows. The main problem is that i have another computer with the exact same hardware and software, That PC has not been affected.I have tried DEP but that doesn’t work with 64bit software. I would love to hear any other suggestions.
Reply
If i may add to this.. since i just recently developed this issue (yesterday 8/23/10 just after my game crashed and i tried to restart it)
___error__
Problem Event Name: APPCRASH
Application Name: BFBC2Game.exe
Application Version: 1.0.1.0
Application Timestamp: 4c222e91
Fault Module Name: StackHash_4c0d
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Code: c0000005
Exception Offset: 00000010
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 1033
Additional Information 1: 4c0d
Additional Information 2: 4c0d4d78887f76d971d5d00f1f20a433
Additional Information 3: 4c0d
Additional Information 4: 4c0d4d78887f76d971d5d00f1f20a433
__end error__
this appears every time i try to start the game now.
I BELIEVE that i had 1 stick (2 GB) that had an issue – under stress test built by opening alot of copies of 1 program, that was the only 1 of 4 sticks in at the time, it froze up the machine.
So IMHO after a bit of research, I believe that the memory failed as i was playing the game, caused an error at some read/write location, and now that the stick of memory is replace, is still not allowing the game to play.
Any ideas as to a way to remove the offending error?
The game file checker says that all my files are on par and correct.
This is a Steam game.
Windows 7-64bit Pro
I am going to delete the .exe and replace it and see if that helps.
Thank you for any ideas and the time to assist me.
Taz
Reply
I’m haveing a crap of a time with SOF2. I’m running vista 32 bit OS and SOF2 ran fine before. I got spyware on my pc and I reformatted pc and now I am having this trouble:
Here is the error that I am getting:
Problem signature:
Problem Event Name: APPCRASH
Application Name: SoF2MP.exe
Application Version: 0.0.0.0
Application Timestamp: 3dc85c15
Fault Module Name: StackHash_1557
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Code: c0000005
Exception Offset: 615f7865
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: 1557
Additional Information 2: 6ad9a3a370bcb361a890190e4aa5e4cb
Additional Information 3: 659f
Additional Information 4: 7173dca564b34c9b0e1446cb797cd1c2
Reply
i am having this problem too
with every single one of my software even paint
i`ll be glad if anybody help me throw …
1- changing memory is one thing i can`t afford
if there is any other way that can decrease or make it ok i`d like to hear
Reply
Highly unlikely anyone is having a memory hardware failure which is generating the StackHash errors UNLESS you are overclocking. If you think you have a memory problem download and execute IntelBurnTest by AgentGOD. If your system passes the “Stress Level:Standard” with everything else as default you are good to go. If you don’t pass the test, downgrade you overclocking.
Reply
Problem Event Name: APPCRASH
Application Name: Ultimate Socket Plus by NIHAN.exe
Application Version: 1.0.0.0
Application Timestamp: 4f1ae477
Fault Module Name: StackHash_885e
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Code: c0000005
Exception Offset: 00000000
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033
Additional Information 1: 885e
Additional Information 2: 885ed6fb65a64802e444ec0d9c7fa988
Additional Information 3: f626
Additional Information 4: f6265522c6759ff2a0af90648080b4c0
check this
Reply
Problem signature:
Problem Event Name: APPCRASH
Application Name: Shogun2.exe
Application Version: 1.1.0.0
Application Timestamp: 4f636554
Fault Module Name: StackHash_9aec
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Code: c0000005
Exception Offset: 80ad1410
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1048
Additional Information 1: 9aec
Additional Information 2: 9aec98015d000507fa92aa552ce57306
Additional Information 3: 8081
Additional Information 4: 8081c826222f3be7d6c52b17a147535e
what to do?
Reply
So i have the same problem here, my customer was using win 2003 32 bits with their in-house apps. While they test the same apps on XP 64 and Win 7 64 bits, it works pretty good, but when we tried to test them in Win 2008 R2 SP1 doest work anyway.
Btw,i dont think DEP is solution (i tried too).
Regards.
Reply
i have a this stack hash error who to solution ?
Problem signature:
Problem Event Name: APPCRASH
Application Name: Risen2.exe
Application Version: 1.0.1174.0
Application Timestamp: 4f30f2d9
Fault Module Name: StackHash_199c
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Code: c00000fd
Exception Offset: 02ea639b
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033
Additional Information 1: 199c
Additional Information 2: 199cc907df8a4654c8ebf31545ec3b64
Additional Information 3: ac93
Additional Information 4: ac932fb721b478be6e53cf5b63cba0e7
Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0×0409
If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
Reply