When you click a Clickone link and trying to install the application, an error dialog pops which looks like the following dialog:
Figure 1 Exception Screen snapshot
Because dfsvc.exe is launched by other process, you have no chance to have a debugger attached to dfsvc.exe. And sometimes it is too late for you to click “Debug” button and examine what happens inside the debuggee (dfsvc.exe). In this case, you need debugger automate attach to dfsvc.exe while it is launching. We can see the exception stack trace from information logged in Event Viewer, there is a AccessViolationException thrown from dfsvc.exe.
Please check wiki page http://blog.csdn.net/Donjuan/archive/2008/12/04/3446657.aspx to learn how to prepare the environment.
Below texts describe the whole debugging session:
CommandLine: d:/WINDOWS/Microsoft.NET/Framework/xxxx/dfsvc.exe
Symbol search path is: SRV*//symbols/symbols
Executable search path is:
ModLoad: 00400000 00408000 dfsvc.exe
ModLoad: 7c900000 7c9af000 ntdll.dll
ModLoad: 79630000 7967e000 D:/WINDOWS/system32/mscoree.dll
ModLoad: 7c800000 7c8f6000 D:/WINDOWS/system32/KERNEL32.dll
(c60.3ac): Break instruction exception - code 80000003 (first chance)
eax=00251ea4 ebx=7ffda000 ecx=00000000 edx=00000001 esi=00251f18 edi=00251ea4
eip=7c90120e esp=0012fb20 ebp=0012fc94 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!DbgBreakPoint:
7c90120e cc int 3
0:000> g
ModLoad: 77dd0000 77e6b000 D:/WINDOWS/system32/ADVAPI32.dll
…
ModLoad: 76d60000 76d79000 D:/WINDOWS/system32/iphlpapi.dll
(c60.a4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=017116a5 ebx=00000017 ecx=04960016 edx=017116a5 esi=04a19eb8 edi=00000017
eip=4ed9b280 esp=0446eddc ebp=0446ee04 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
gdiplus!LZWDecompressor::FHandleNext+0x10a:
4ed9b280 8801 mov byte ptr [ecx],al ds:0023:04960016=??
0:008> kp
ChildEBP RetAddr
0446ee04 4ed991de gdiplus!LZWDecompressor::FHandleNext(void)+0x10a