Delphi 7 Setup for Access Violation Capture

[avinkles]

Hi all

New to BB as I've just download madExcept and been working with it all day today.

I've tried everything, but I cannot get madExcept to recognize when an 'invalid pointer exception' or 'Access Violation Occurs C000005' occurs to send me a report. Same with 'Invalid Pointer Operation'
Environment
Running Delphi 7 in x86
OS: Windows2008R2
Type: x64
Compatibility for Delphi: WindowsXP SP3
madEffect version: v4.0.16


Delphi is my second development platform, I develop in C#.net, so I'm probably missing something very obvious. So to that end, please let me know how I setup madExcept and the Delphi Debugger Options so that all errors are captured by madExcept, and a bugReport sent.

I did have exception handling included, but I removed the action statement but left the except statement.
The Invalid Pointer error brings me into the CPU window, which essentially to me is meaningless(with addresses and such) as I cannot correlate the ASSEMBLER code to what actually is executing. I would prefer that something would stop on the statement in the IDE that is causing the error to trigger so I can then debug.

Please let me know if there is anything I can provide that will help solve my issue. I'm at my wit's end. The error occurs in some files and not in others, so I can't tell if it's something in the files or it's the code itself doing something it should not.


Please help!

[madshi]

The IDE debugger is very eager to stop at any exceptions, right when they occur. madExcept is a bit more relaxed. It waits until all try..except blocks have run through, and only becomes active when no try..except block "handles" (resolves) the exception. Which means when you run your program inside of the IDE, madExcept won't become active until you tell the IDE debugger to "continue". Outside of the IDE that's not necessary, of course.

Does that help?

[avinkles]

Thank you for replying. Yes and no as far as answer. I'm in the middle of debugging the application so it's not running unattended. So, I need to know how to have madExcept work in the IDE while the code runs. Do I alter the debugger options for all errors as user-handled? Do I remove all the except action statements but leave Try Except in place meaning that nothing occurs if an exception occurs(since I've commented out the do action?)

Also when the error occurs, I do not get a chance to continue, the only button that is available is OK and a check box to 'View CPU Window'. The dialog box give me the address of the violation.

I don't think I can save the CPU window to a log. Here's the other issue. I'm the only DELPHI developer at my company. So I've no other resource to ask. And, as I mentioned, this is not what I usually develop in and inherited this app when the actual DELPHI programmer left. At that time I did not know Delphi at all. What that boils down to is I only program in Delphi for this project and it's usually month(s) or year(s) in between when a change is required.

Any help you can offer so I can pinpoint the issue would be great. Let me know if I can provide anything from the debug run that would help.

[madshi]

You don't need to change any Delphi settings. You simply tell the IDE debugger to continue to run the program, after it has stopped at an exception. It's as simple as that.

Does everything work as expected when running the exe outside of the IDE?

Do you have try..except blocks in your code? If so, what do they do?

[avinkles]

You don't need to change any Delphi settings. You simply tell the IDE debugger to continue to run the program, after it has stopped at an exception. It's as simple as that.
<AINKLES>OK

Does everything work as expected when running the exe outside of the IDE?
<AINKLES>I've not tried as I'm debugging it. Also the actual end product is a Delphi DLL called by a c#.net app. I've written a test program in Delphi that calls the necessary units that comprise the dll for testing

Do you have try..except blocks in your code? If so, what do they do?
<AINKLES> Nothing now, I've removed the action that raises the error and writes the error to a log file I maintain. The calling program would actually display the error as that's a forms(or windows app), the others raise the error thru the chain of callers until the form is the last recipient and displays.


The app purpose is this. It reads in and writes out a file comprised of names and addresses. During processing specific information(i.e. firm) is analyzed and as such it's used as lookups to several "text" tables to see if any cleansing can be done. I've highlighed the code below where I think the app is tanking. I have several of these "binarySearchf" routines(to different files) throughout the app. My theory is either it cannot read from m_fptAbbrev file(defined as file not textfile) and suffixNumber returned is 0(if I see the value). When it works, it either finds the data it's looking for and does the replace OR it doesn't and exits routine.

the previous programmer used pointers, which while faster, requires a lot of overhead to convert to and from strings to maintain the pchar. I stay away from pointers usually because they are more trouble than they are worth in my eyes. He also did NOT have any error checking, so the error would call up the chain to the caller and stop. Any error checking has been added by me. The stripSuffix routine below mostly is legacy except for the error checking I added. This was the result of trying to pinpoint the issue.


******************************************************************************************************************************************************

Code: Select all

[b][color=#FF0000]procedure TCB.stripSuffix(var company:pchar);[/color][/b]
var
   position:integer;
   doStrip:Boolean;
   strTest:string;
   suffixNumber:Integer;
   //abPtr,abValue:pchar;
   spcCount,i:integer;

      begin
      try
         strTest:=strpas(company);
         position:=pos(' ',strTest);
         if position=0 then
              doStrip:=FALSE
         else
              doStrip:=TRUE;

         while (position <> 0) do
            begin
              strTest:=trim(copy(strTest,position+1,length(strTest)-1));
              if pos('&',strTest)<>0 then
                 begin {count spaces}
                      spcCount:=0;
                      for i := 1 to length(strtest) do
                         if strTest[i]=' ' then
                              inc(spcCount);
                      if spcCount = 1 then
                              doStrip := FALSE;
                 end;
              position:=pos(' ',strTest);
            end; {while}



 if doStrip then
            begin
             [b] [color=#000080] suffixNumber := binarySearchf(m_fptAbbrev,pchar(strTest),AB_RAW_START,AB_RAW_LEN,m_abbrevrecLen,m_abbrevNumRecs);
[/color] [/b]     <- Issue is happening here.  Usually it works(it's used elsewhere searching in other files)
                                               //m_fptAbbrev is a file pointer
                                               //strTest is the value I am looking for
                                               //AB_RAW_START, constant = 1
                                               //AB_RAW_LEN, constant = 50



             if suffixNumber <> -1 then   {suffix found}
                  begin
                      {move to found record number}
                      seek(m_fptAbbrev,(suffixNumber * m_abbrevrecLen)-m_abbrevRecLen);
                      {get line}
                      blockRead(m_fptAbbrev,m_tempPtr^,m_abbrevRecLen);  {read one record}
                      {Get if Suffix}
                      strLCopy(m_tempValue,@(m_tempPtr[SUF_START-1]),SUF_LEN);

                      if m_tempvalue='S' then
                        begin
                        strTest:=trim(copy(strpas(company),1,length(company)-(length(strTest)+1)));
                        strLCopy(company,pchar(strTest),length(strTest));
                        end;
                  end
               else
                  begin
                      //suffix.raw:=FALSE;
                  end;

 except on E:Exception do
                self.CreateRaisedError(E,'StripSuffix');  //I have added this to try and get to the error
        end;
end;



[color=#FF0000][b]procedure TCB.CreateRaisedError(var error:Exception;RoutineName:string);
[/b][/color]
begin
        error.Message:= error.Message + 'Module->' + RoutineName + ' ' +  error.Message;
        sLogEntry:=error.Message;
        self.WriteStepToLog(sLogEntry);
        raise error;


end;

[madshi]

A dll normally doesn't handle exceptions by itself. If you want your Delphi dll to handle its own exceptions, you need to put a try..except block around every "entry point" of your dll. And entry point is a exported function of your Delphi dll that might be called by your C# program. The try..except block needs to look like this:

Code: Select all

function SomeExportedFunction(...);
begin
  try
    [...]
  except
    madExcept.HandleException;
  end;
end;

See also the first section of this help page:

http://help.madshi.net/HowToUseMadExcept.htm

[avinkles]

Update: I've added error routines to anything I think might be an issue. While helpful, still not seeing what the issue is. Some Files run thru file, others, something about a record or perhaps the file causes Invalid pointer exception. I've uploaded the bug report I did manage to receive. my last resort is to bypass the record when the error occurs and then just continue processing the rest of the file. Is that doable?

The program reads in text files(defined as file...not my first choice) and use pchar variables through-out the processing. I have been at this for days and am no closer to solving the issue. I know Delphi a lot better, but that is no consolation.

Can I bypass the error if it occurs on a record, and instruct the program to continue reading from the next record? At some point, I'm going to have to run more test files for my CEO and at this point, I don't know what the trigger is.

TEST20170317 does not read in cleanly, only the first 1-2 records process and then it tanks.
AV_TEST_FILE runs to completion without a problem.

I've looked at the TEST file in hex and do not see any issue. I'm desperate.


This is what is processed from the TEST file:

MC->COMPANY:AMER SOC OF TOM S TESTING
MC->ROUTINE COMPLETED
CB->COMPANY: AMER SOC OF TOMS TESTING
CB->FIXPOSSESSIVES COMPLETED
CB->ROUTINE COMPLETED
********************************
MC->COMPANY:AMER SOCIETY OF TOM S TESTING <- this is where I think it tanked as it's the last log entry.

I have to run the error C00005 in the debbuger options as User Handled and Run Unhandled. If I indicate Run Handled....the program just stops unbeknownst to me with no indication that something has occurred.

[madshi]

Update: I've added error routines to anything I think might be an issue. While helpful, still not seeing what the issue is. Some Files run thru file, others, something about a record or perhaps the file causes Invalid pointer exception.

Do you get a madExcept report for those? Are you still testing this inside of the Delphi debugger? If so, did you tell the debugger to continue running the program after is stopped at the exception?

I've uploaded the bug report I did manage to receive.

Where?

my last resort is to ...

Right now you don't even have the basics working. I don't think it's the right time to think about last resorts. You need to make the basic exception handling work first. Try with some logic:

Add *intentional* crashes to your Delphi DLL. E.g. do "integer(nil^) := 0" to raise an access violation. Then check if madExcept catches and reports it. Only after you got that working, you can start analyzing the real crashes in your DLL.

[avinkles]

Here's the madExcpet bug report for the latest run:

Code: Select all

date/time          : 2017-03-17, 13:33:47, 761ms
computer name      : VENUS-DEV
wts client name    : Anitas-MacBook-
user name          : ainkles <admin>
registered owner   : Windows User
operating system   : Windows XP x64 Service Pack 3 build 2600
system language    : English
system up time     : 20 hours 26 minutes
program up time    : 29 seconds
processors         : 4x Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
physical memory    : 90682/98303 MB (free/total)
free disk space    : (C:) 30.52 GB (E:) 170.77 GB
display mode       : 1366x768, 16 bit
process id         : $22f4
allocated memory   : 45.73 MB
largest free block : 358.77 MB
executable         : Project2.txt
exec. date/time    : 2017-03-17 13:21
version            : 1.0.0.26
compiled with      : Delphi 7
madExcept version  : 4.0.16
callstack crc      : $cec634e7, $35635548, $35635548
exception number   : 1
exception class    : EInvalidPointer
exception message  : Invalid pointer operation.

main thread ($12a0):
004b6700 +06c Project2.txt cbglobals      63   +9 CreateRaisedError
004c22a6 +752 Project2.txt companybeaut 1372 +207 TCB.CreateBeautified
004c9b51 +519 Project2.txt Unit1         229 +125 DoCompanyMatch
004ca5a4 +3b0 Project2.txt Unit1         478  +85 TForm1.btnProcessClick
00496a70 +064 Project2.txt Controls               TControl.Click
0048e944 +01c Project2.txt StdCtrls               TButton.Click
0048ea38 +00c Project2.txt StdCtrls               TButton.CNCommand
004968d8 +188 Project2.txt Controls               TControl.WndProc
00499823 +157 Project2.txt Controls               TWinControl.WndProc
0048e808 +06c Project2.txt StdCtrls               TButtonControl.WndProc
004966a8 +024 Project2.txt Controls               TControl.Perform
0049995b +023 Project2.txt Controls               DoControlMsg
00499fb3 +00b Project2.txt Controls               TWinControl.WMCommand
004b0b88 +02c Project2.txt Forms                  TCustomForm.WMCommand
004968d8 +188 Project2.txt Controls               TControl.WndProc
00499823 +157 Project2.txt Controls               TWinControl.WndProc
004aebe1 +421 Project2.txt Forms                  TCustomForm.WndProc
004994a0 +02c Project2.txt Controls               TWinControl.MainWndProc
00478898 +014 Project2.txt Classes                StdWndProc
77840117 +02b ntdll.dll                           KiUserCallbackDispatcher
765196c0 +047 user32.dll                          SendMessageW
76528535 +016 user32.dll                          CallWindowProcA
00499907 +0d7 Project2.txt Controls               TWinControl.DefaultHandler
00496e78 +010 Project2.txt Controls               TControl.WMLButtonUp
004968d8 +188 Project2.txt Controls               TControl.WndProc
00499823 +157 Project2.txt Controls               TWinControl.WndProc
0048e808 +06c Project2.txt StdCtrls               TButtonControl.WndProc
004994a0 +02c Project2.txt Controls               TWinControl.MainWndProc
00478898 +014 Project2.txt Classes                StdWndProc
76517bc5 +00a user32.dll                          DispatchMessageA
004b4f87 +083 Project2.txt Forms                  TApplication.ProcessMessage
004b4fa6 +00a Project2.txt Forms                  TApplication.HandleMessage
004b51c6 +096 Project2.txt Forms                  TApplication.Run
004cb2c4 +04c Project2.txt Project2       35   +4 initialization
75503368 +010 kernel32.dll                        BaseThreadInitThunk

thread $20c8:
77850166 +0e ntdll.dll     NtWaitForMultipleObjects
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $1ae0:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $1494:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $10e4:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $1bac:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $21cc:
7784fd9a +0e ntdll.dll                NtDelayExecution
762d3d36 +5f KERNELBASE.dll           SleepEx
762d4607 +0a KERNELBASE.dll           Sleep
0045efe5 +0d Project2.txt   madExcept CallThreadProcSafe
0045f04f +37 Project2.txt   madExcept ThreadExceptFrame
75503368 +10 kernel32.dll             BaseThreadInitThunk
>> created by main thread ($12a0) at:
7614da5e +00 ole32.dll

thread $1ab0:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $1104:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

thread $e10:
77851f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
75503368 +10 kernel32.dll  BaseThreadInitThunk

modules:
00400000 Project2.txt                             1.0.0.26           E:\Projects\cBeaut\cBeaut\cBeaut\cBeaut_II_DLL\Test Program
006a0000 BORdbk70.dll                             50.4.227.0         C:\Program Files (x86)\Common Files\Borland Shared\Debugger
0e6e0000 StructuredQuery.dll                      7.0.7601.23451     C:\Windows\System32
0f7e0000 SortServer2003Compat.dll                 6.1.7600.16385     C:\Windows\system32
16ae0000 SearchFolder.dll                         6.1.7601.17514     C:\Windows\system32
22910000 NetworkExplorer.dll                      6.1.7601.17514     C:\Windows\system32
2a250000 AcXtrnal.DLL                             6.1.7601.19050     C:\Windows\AppPatch
40b70000 SHDOCVW.dll                              6.1.7601.18222     C:\Windows\system32
56f90000 actxprxy.dll                             6.1.7601.17514     C:\Windows\SysWOW64
64bf0000 SHUNIMPL.DLL                             6.1.7601.17514     C:\Windows\system32
693c0000 dwmapi.dll                               6.1.7601.18917     C:\Windows\system32
69410000 WindowsCodecs.dll                        6.2.9200.21830     C:\Windows\system32
69720000 api-ms-win-downlevel-shlwapi-l2-1-0.dll  6.2.9200.16492     C:\Windows\system32
69730000 ieproxy.dll                              11.0.9600.18616    C:\Program Files (x86)\Internet Explorer
69a20000 ieframe.DLL                              11.0.9600.18616    C:\Windows\system32
6a730000 api-ms-win-downlevel-shell32-l1-1-0.dll  6.2.9200.16492     C:\Windows\system32
6ac80000 cscapi.dll                               6.1.7601.17514     C:\Windows\system32
6ae80000 slc.dll                                  6.1.7600.16385     C:\Windows\system32
6e290000 ntshrui.dll                              6.1.7601.17755     C:\Windows\system32
6ef30000 PROPSYS.dll                              7.0.7601.17514     C:\Windows\system32
6f0a0000 sfc_os.DLL                               6.1.7600.16385     C:\Windows\system32
6f0b0000 sfc.dll                                  6.1.7600.16385     C:\Windows\system32
6fa00000 wsock32.dll                              6.1.7600.16385     C:\Windows\system32
71530000 AcLayers.dll                             6.1.7601.19050     C:\Windows\AppPatch
72440000 apphelp.dll                              6.1.7601.19050     C:\Windows\system32
72650000 UxTheme.dll                              6.1.7600.16385     C:\Windows\system32
72780000 comctl32.dll                             5.82.7601.18837    C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc
72810000 MPR.dll                                  6.1.7600.16385     C:\Windows\system32
72cf0000 Secur32.dll                              6.1.7601.23677     C:\Windows\System32
73680000 comctl32.dll                             6.10.7601.18837    C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
73820000 WINSPOOL.DRV                             6.1.7601.17514     C:\Windows\system32
73880000 WINMM.dll                                6.1.7601.17514     C:\Windows\system32
73cb0000 samcli.dll                               6.1.7601.17514     C:\Windows\system32
74200000 srvcli.dll                               6.1.7601.17514     C:\Windows\system32
74220000 netutils.dll                             6.1.7601.17514     C:\Windows\system32
74820000 AcGenral.DLL                             6.1.7601.19050     C:\Windows\AppPatch
74cd0000 RpcRtRemote.dll                          6.1.7601.17514     C:\Windows\system32
74d10000 ntmarta.dll                              6.1.7600.16385     C:\Windows\system32
74eb0000 rsaenh.dll                               6.1.7600.16385     C:\Windows\system32
74ef0000 CRYPTSP.dll                              6.1.7601.23471     C:\Windows\system32
74f10000 WINSTA.dll                               6.1.7601.18540     C:\Windows\system32
74f40000 wtsapi32.dll                             6.1.7601.17514     C:\Windows\system32
74f50000 version.dll                              6.1.7600.16385     C:\Windows\system32
74f60000 api-ms-win-core-synch-l1-2-0.DLL         10.0.10586.9       C:\Windows\system32
74f70000 sophos_detoured.dll                      10.6.3.500         C:\Program Files (x86)\Sophos\Sophos Anti-Virus
750c0000 CRYPTBASE.dll                            6.1.7601.23677     C:\Windows\syswow64
750d0000 SspiCli.dll                              6.1.7601.23677     C:\Windows\syswow64
75130000 api-ms-win-downlevel-normaliz-l1-1-0.dll 6.2.9200.16492     C:\Windows\syswow64
75140000 IMM32.DLL                                6.1.7601.17514     C:\Windows\system32
75200000 iertutil.dll                             11.0.9600.18616    C:\Windows\syswow64
75440000 USP10.dll                                1.626.7601.23688   C:\Windows\syswow64
754e0000 api-ms-win-downlevel-version-l1-1-0.dll  6.2.9200.16492     C:\Windows\syswow64
754f0000 kernel32.dll                             6.1.7601.23677     C:\Windows\syswow64
75600000 WININET.dll                              11.0.9600.18616    C:\Windows\syswow64
75970000 urlmon.dll                               11.0.9600.18616    C:\Windows\syswow64
75ac0000 WS2_32.dll                               6.1.7601.23451     C:\Windows\syswow64
75b00000 api-ms-win-downlevel-user32-l1-1-0.dll   6.2.9200.16492     C:\Windows\syswow64
75b10000 MSCTF.dll                                6.1.7601.23572     C:\Windows\syswow64
75be0000 CFGMGR32.dll                             6.1.7601.17621     C:\Windows\syswow64
75c10000 msvcrt.dll                               7.0.7601.17744     C:\Windows\syswow64
75cc0000 normaliz.DLL                             6.1.7600.16385     C:\Windows\syswow64
75cd0000 DEVOBJ.dll                               6.1.7601.17621     C:\Windows\syswow64
75cf0000 CLBCatQ.DLL                              2001.12.8530.16385 C:\Windows\syswow64
75d80000 GDI32.dll                                6.1.7601.23688     C:\Windows\syswow64
75e10000 comdlg32.dll                             6.1.7601.17514     C:\Windows\syswow64
75e90000 api-ms-win-downlevel-shlwapi-l1-1-0.dll  6.2.9200.16492     C:\Windows\syswow64
75ea0000 PSAPI.DLL                                6.1.7600.16385     C:\Windows\syswow64
75eb0000 RPCRT4.dll                               6.1.7601.23677     C:\Windows\syswow64
75fa0000 SHLWAPI.dll                              6.1.7601.17514     C:\Windows\syswow64
76000000 WLDAP32.dll                              6.1.7601.17514     C:\Windows\syswow64
76080000 oleaut32.dll                             6.1.7601.23569     C:\Windows\syswow64
76120000 ole32.dll                                6.1.7601.23392     C:\Windows\syswow64
76280000 sechost.dll                              6.1.7601.18869     C:\Windows\SysWOW64
762a0000 api-ms-win-downlevel-advapi32-l1-1-0.dll 6.2.9200.16492     C:\Windows\syswow64
762b0000 NSI.dll                                  6.1.7600.16385     C:\Windows\syswow64
762c0000 KERNELBASE.dll                           6.1.7601.23677     C:\Windows\syswow64
76310000 ADVAPI32.dll                             6.1.7601.23677     C:\Windows\syswow64
763c0000 api-ms-win-downlevel-ole32-l1-1-0.dll    6.2.9200.16492     C:\Windows\syswow64
763d0000 CRYPT32.dll                              6.1.7601.23566     C:\Windows\syswow64
76500000 user32.dll                               6.1.7601.23594     C:\Windows\syswow64
76600000 LPK.dll                                  6.1.7601.23587     C:\Windows\syswow64
76610000 SETUPAPI.dll                             6.1.7601.17514     C:\Windows\syswow64
767b0000 MSASN1.dll                               6.1.7601.17514     C:\Windows\syswow64
767c0000 shell32.dll                              6.1.7601.18952     C:\Windows\syswow64
77410000 USERENV.dll                              6.1.7601.17514     C:\Windows\syswow64
77800000 profapi.dll                              6.1.7600.16385     C:\Windows\syswow64
77830000 ntdll.dll                                6.1.7601.23677     C:\Windows\SysWOW64
779b0000 MSACM32.dll                              6.1.7600.16385     C:\Windows\system32
779d0000 thumbcache.dll                           6.1.7601.17514     C:\Windows\SysWOW64
77a40000 EhStorShell.dll                          6.1.7600.16385     C:\Windows\system32
77af0000 TortoiseSVN32.dll                        1.9.5.27581        C:\Program Files\TortoiseSVN\bin
77e70000 TortoiseStub32.dll                       1.9.5.27581        C:\Program Files\TortoiseSVN\bin
77e90000 TortoiseOverlays.dll                     1.1.4.26626        C:\Program Files (x86)\Common Files\TortoiseOverlays

processes:
0000 Idle                         0 0   0
0004 System                       0 0   0
0168 smss.exe                     0 0   0
01d0 csrss.exe                    0 0   0
0204 csrss.exe                    1 0   0
020c wininit.exe                  0 0   0
0230 winlogon.exe                 1 0   0
026c services.exe                 0 0   0
0278 lsass.exe                    0 0   0
0280 lsm.exe                      0 0   0
02e4 svchost.exe                  0 0   0
0324 hmpalert.exe                 0 0   0
0390 svchost.exe                  0 0   0
03dc svchost.exe                  0 0   0
0200 svchost.exe                  0 0   0
0298 svchost.exe                  0 0   0
02f4 svchost.exe                  0 0   0
02b8 SavService.exe               0 0   0
0554 svchost.exe                  0 0   0
05d4 svchost.exe                  0 0   0
0674 spoolsv.exe                  0 0   0
06b0 armsvc.exe                   0 0   0
06e0 svchost.exe                  0 0   0
06f4 aspnet_state.exe             0 0   0
0744 svchost.exe                  0 0   0
0768 dmxd.exe                     0 0   0
07a0 PresentationFontCache.exe    0 0   0
07ac conhost.exe                  0 0   0
07f4 ibguard.exe                  0 0   0
0634 KaseyaEndpoint.exe           0 0   0
01d8 AgentMon.exe                 0 0   0
0830 MRService.exe                0 0   0   normal
084c mdm.exe                      0 0   0
0868 sqlservr.exe                 0 0   0   normal
08a4 msmdsrv.exe                  0 0   0   normal
098c ReportingServicesService.exe 0 0   0   normal
0a54 Locator.exe                  0 0   0
0a68 SAVAdminService.exe          0 0   0
0aac SntpService.exe              0 0   0
0ae0 ALsvc.exe                    0 0   0
0b3c SophosClean.exe              0 0   0
0b6c Health.exe                   0 0   0
0b8c Heartbeat.exe                0 0   0
0bd4 McsAgent.exe                 0 0   0
0968 McsClient.exe                0 0   0
0bf0 swc_service.exe              0 0   0
0c30 ssp.exe                      0 0   0
0cf0 sqlbrowser.exe               0 0   0   normal
0d24 SQLAGENT.EXE                 0 0   0   normal
0d90 conhost.exe                  0 0   0
0dd8 sqlwriter.exe                0 0   0   normal
0e04 raw_agent_svc.exe            0 0   0
0f48 ImageReady.exe               0 0   0
0f68 raw_agent_svc.exe            0 0   0
0f70 conhost.exe                  0 0   0
0df8 ImageReady.exe               0 0   0
0a44 conhost.exe                  0 0   0
0e30 svcCrossMatch.exe            0 0   0   normal
0c68 JTService.exe                0 0   0
0fe4 appServerRebootReminder.exe  0 0   0   normal
1050 swi_service.exe              0 0   0
109c vds.exe                      0 0   0
10bc vmtoolsd.exe                 0 0   0
1114 svchost.exe                  0 0   0
113c WmiApSrv.exe                 0 0   0
1188 ShadowProtectSvc.exe         0 0   0
132c vsnapvss.exe                 0 0   0
100c sdcservice.exe               0 0   0
13dc ibserver.exe                 0 0   0
1430 svchost.exe                  0 0   0
1468 svchost.exe                  0 0   0
1534 Lua.exe                      0 0   0
153c Lua.exe                      0 0   0
1544 conhost.exe                  0 0   0
1554 conhost.exe                  0 0   0
1578 Kaseya.AgentEndpoint.exe     0 0   0
15b8 conhost.exe                  0 0   0
1618 msdtc.exe                    0 0   0
12b0 GoogleCrashHandler.exe       0 0   0
0f0c GoogleCrashHandler64.exe     0 0   0
1868 hmpalert.exe                 1 0   0   normal C:\Program Files (x86)\HitmanPro.Alert
1878 taskhost.exe                 1 0   0   normal
11a0 dwm.exe                      1 0   0   normal
1bf0 explorer.exe                 1 0   0   normal
1b28 vmtoolsd.exe                 1 0   0   normal
1744 KaUsrTsk.exe                 1 0   0   normal C:\Program Files (x86)\Kaseya\FLXBSN68494820284961
1030 MRSvrMgr.exe                 1 0   0   normal E:\PW\Architect
12b4 ALMon.exe                    1 0   0   normal C:\Program Files (x86)\Sophos\AutoUpdate
1548 WZQKPICK.EXE                 1 0   0   normal C:\Program Files\WinZip
1b68 TSVNCache.exe                1 0   0   normal
1920 mmc.exe                      1 0   0   normal
1a04 csrss.exe                    2 0   0
1aec winlogon.exe                 2 0   0
17ec taskhost.exe                 2 4   7   normal
16e8 rdpclip.exe                  2 4   12  normal
12f4 dwm.exe                      2 6   2   normal
0560 explorer.exe                 2 398 320 normal
1b30 vmtoolsd.exe                 2 41  18  normal
0170 WZQKPICK.EXE                 2 13  22  normal C:\Program Files\WinZip
1c1c ALMon.exe                    2 36  39  normal C:\Program Files (x86)\Sophos\AutoUpdate
1cf4 iexplore.exe                 2 445 191 normal
1d34 IEXPLORE.EXE                 2 78  70  normal C:\Program Files (x86)\Internet Explorer
1d70 mmc.exe                      2 326 361 normal
1f54 TrustedInstaller.exe         0 0   0
1f68 sppsvc.exe                   0 0   0
1cdc OUTLOOK.EXE                  2 796 747 normal C:\Program Files (x86)\Microsoft Office\Office15
1e5c WmiPrvSE.exe                 0 0   0
1a30 MsSpellCheckingFacility.exe  2 4   1   normal
1fdc IEXPLORE.EXE                 2 114 107 normal C:\Program Files (x86)\Internet Explorer
1814 delphi32.exe                 2 561 276 normal C:\Program Files (x86)\Borland\Delphi7\Bin
02dc uedit64.exe                  2 516 300 normal
22f4 Project2.txt                 2 92  52  normal E:\Projects\cBeaut\cBeaut\cBeaut\cBeaut_II_DLL\Test Program

hardware:
+ Batteries
  - Microsoft AC Adapter
  - Microsoft Composite Battery
+ Computer
  - ACPI x64-based PC
+ Disk drives
  - VMware Virtual disk SCSI Disk Device
  - VMware Virtual disk SCSI Disk Device
  - VMware Virtual disk SCSI Disk Device
  - VMware Virtual disk SCSI Disk Device
+ Display adapters
  - Mirage Driver (driver 2.0.105.0)
  - VMware SVGA 3D (driver 7.14.1.2032)
+ DVD/CD-ROM drives
  - NECVMWar VMware IDE CDR10 ATA Device
+ Floppy disk drives
  - Floppy disk drive
+ Floppy drive controllers
  - Standard floppy disk controller
+ IDE ATA/ATAPI controllers
  - ATA Channel 0
  - ATA Channel 1
  - Intel(R) 82371AB/EB PCI Bus Master IDE Controller
+ Keyboards
  - Standard PS/2 Keyboard
+ Memory devices
  - Memory Module
  - Memory Module
  - Memory Module
  - Memory Module
  - Memory Module
+ Mice and other pointing devices
  - VMware Pointing Device (driver 12.5.2.0)
+ Monitors
  - Generic Non-PnP Monitor
+ Network adapters
  - Microsoft ISATAP Adapter
  - Microsoft Teredo Tunneling Adapter
  - vmxnet3 Ethernet Adapter (driver 1.5.2.0)
  - WAN Miniport (IKEv2)
  - WAN Miniport (IP)
  - WAN Miniport (IPv6)
  - WAN Miniport (L2TP)
  - WAN Miniport (Network Monitor)
  - WAN Miniport (PPPOE)
  - WAN Miniport (PPTP)
  - WAN Miniport (SSTP)
+ Ports (COM & LPT)
  - Communications Port (COM1)
  - Communications Port (COM2)
  - Printer Port (LPT1)
+ Processors
  - Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
  - Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
  - Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
  - Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
+ Storage controllers
  - LSI Adapter, SAS 3000 series, 8-port with 1068 (driver 1.28.3.52)
  - Microsoft iSCSI Initiator
+ System devices
  - ACPI Fixed Feature Button
  - Composite Bus Enumerator
  - Direct memory access controller
  - EISA programmable interrupt controller
  - File as Volume Driver
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - Generic Bus
  - High precision event timer
  - Intel 82371AB/EB PCI to ISA bridge (ISA mode)
  - Intel 82443BX Pentium(R) II Processor to PCI Bridge
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft Virtual Drive Enumerator Driver
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - PCI bus
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI Express standard Root Port
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - Plug and Play Software Device Enumerator
  - Printer Port Logical Interface
  - Remote Desktop Device Redirector Bus
  - StorageCraft Volume Snapshot Driver (driver 2.2.63.19643)
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - UMBus Enumerator
  - UMBus Root Bus Enumerator
  - VMware VMCI Bus Device (driver 9.5.10.0)
  - VMware VMCI Host Device (driver 9.5.10.0)
  - Volume Manager

disassembling:
[...]
004b66f1 62   mov     eax, $4d305c
004b66f6      call    -$c3 ($4b6638)         ; cbglobals.WriteStepToLog
004b66f6
004b66fb 63   mov     eax, [ebp-4]
004b66fe      mov     eax, [eax]
004b6700    > call    -$b2289 ($40447c)      ; System.@RaiseExcept
004b6700
004b6705      xor     eax, eax
004b6707      pop     edx
004b6708      pop     ecx
004b6709      pop     ecx
[...]

[madshi]

The process is named "Project2.txt" instead of "Project2.exe"? That seems very weird.

You where talking about a Delphi DLL. But this looks more like a normal Delphi EXE/process? Anyway, the invalid pointer operation occurred in "companybeaut.pas" in line 1372.