OMID SOFT
Freshman
An application raises the UnhandledException event when it encounters an unhandled exception.
For instance, you can use this event to ask user send you a report by email.
Why you should NOT use this event?
Although this is a useful event to control, debug and report the errors, but Microsoft does not recommend to use it.
According to Certified For Windows Vista guidelines:
Verify that the application only handles exceptions that are known and expected. (Test Case number 32.)
Expected Behaviour:
1. All of the applications executables above; when injected Access Violation (AV) resulted in the application crashing and must display the WER (Windows Error Reporting) dialog message in order to pass this test case. This means that the application AV failure properly allowed Windows Error Reporting to report this crash.
2. There must be both an Error message with Source listed as Application Error and an Information message with Source listed as Windows Error Reporting for each executable above in order to pass this test case.
STEPS:
1. Browse application install paths for all executables which contain only the .exe extension.
2. For each of the applications executables above:
a. Launch the applications executable.
b. Open command window.
c. Change directories to the directory that contains ThreadHijacker.
d. From the command window inject an AV crash using ThreadHijacker in the following manner:
i. Type threadhijacker.exe /ui /crash:av /process:<process_name>
e. Open Event Viewer by typing eventvwr from the command line or from the Administrator Tools.
i. Expand Windows Logs
ii. Click on Application
iii. There must be an Application Error (Error) and Window Error Reporting (Information) message for the executable.
For instance, you can use this event to ask user send you a report by email.
Visual Basic:
Private Sub UnhandledException(ByVal sender As Object, ByVal e As Microsoft.VisualBasic.ApplicationServices.UnhandledExceptionEventArgs)
If MessageBox.Show("Unhandled exception has occurred in My Application." + vbNewLine + "We ask you to report this error to My Company." + vbNewLine + "Would you like to send a report via email?", My.Application.Info.AssemblyName, MessageBoxButtons.YesNo, MessageBoxIcon.Error) = DialogResult.Yes Then
Dim MyString As String = Nothing
MyString = ("x-receiver: <user@company.com>" + vbNewLine)
MyString = MyString + ("To: ""user@company.com"" <user@company.com>" + vbNewLine)
MyString = MyString + ("Subject: Bug Report - My Product " + My.Application.Info.Version.Major.ToString + "." + My.Application.Info.Version.Minor.ToString + vbNewLine)
MyString = MyString + ("Date: " + Now.DayOfWeek.ToString.Substring(0, 3) + ", " + Now.ToString("dd") + " " + Now.ToString("MMMM").Substring(0, 3) + " " + Now.ToString("yyyy") + " " + Now.ToString("HH:mm:ss") + " " + TimeZone.CurrentTimeZone.GetUtcOffset(Now).ToString.Replace(":", "").Substring(0, 5) + vbNewLine)
MyString = MyString + ("X-Priority: 3" + vbNewLine)
MyString = MyString + ("MIME-Version: 1.0" + vbNewLine)
MyString = MyString + ("Content-type: text/plain; charset=Windows-1252" + vbNewLine)
MyString = MyString + ("Content-Transfer-Encoding: quoted-printable" + vbNewLine + vbNewLine)
MyString = MyString + (e.Exception.ToString + vbNewLine)
Dim TempPath As String = System.IO.Path.GetTempPath + "Report_" + Now.ToString("MM-dd-yyyy") + "_" + Now.ToString("HH-mm-ss") + ".eml"
If My.Computer.FileSystem.FileExists(TempPath) Then
System.IO.File.SetAttributes(TempPath, FileAttributes.Normal)
My.Computer.FileSystem.DeleteFile(TempPath)
End If
My.Computer.FileSystem.WriteAllText(TempPath, MyString, False)
System.Diagnostics.Process.Start(TempPath)
End If
End Sub
Why you should NOT use this event?
Although this is a useful event to control, debug and report the errors, but Microsoft does not recommend to use it.
According to Certified For Windows Vista guidelines:
Verify that the application only handles exceptions that are known and expected. (Test Case number 32.)
Expected Behaviour:
1. All of the applications executables above; when injected Access Violation (AV) resulted in the application crashing and must display the WER (Windows Error Reporting) dialog message in order to pass this test case. This means that the application AV failure properly allowed Windows Error Reporting to report this crash.
2. There must be both an Error message with Source listed as Application Error and an Information message with Source listed as Windows Error Reporting for each executable above in order to pass this test case.
STEPS:
1. Browse application install paths for all executables which contain only the .exe extension.
2. For each of the applications executables above:
a. Launch the applications executable.
b. Open command window.
c. Change directories to the directory that contains ThreadHijacker.
d. From the command window inject an AV crash using ThreadHijacker in the following manner:
i. Type threadhijacker.exe /ui /crash:av /process:<process_name>
e. Open Event Viewer by typing eventvwr from the command line or from the Administrator Tools.
i. Expand Windows Logs
ii. Click on Application
iii. There must be an Application Error (Error) and Window Error Reporting (Information) message for the executable.