How does Windows detect if a program is "stopped working"?

Question

When I clicked the X button to close a program (say it is MYAPP), a dialog popped up saying:

MYAPP has stopped working

Windows can check online for a solution to the problem."

But actually the application had already exited.

Error info:

    Problem signature:
      Problem Event Name:   APPCRASH
      Application Name: MYAPP.EXE
      Application Version:  1.0.0.0
      Application Timestamp:    56a8dfa8
      Fault Module Name:    MSVCP90D.dll
      Fault Module Version: 9.0.30729.6161
      Fault Module Timestamp:   4dace5bf
      Exception Code:   c0000005
      Exception Offset: 00007b3f
      OS Version:   6.3.9600.2.0.0.272.7
      Locale ID:    3081

How does Windows detect if a program is "stopped working"? Does it indicate the application throws an exception or a dead lock?

Answer 1

Windows Error Reporting (WER) will catch unhandled exceptions. It won't catch a deadlock. That dialog box that pops up when a program "stops working" is a WER crash-dump being taken (or it communicating with a MS server to see if it wants to take a crash-dump, etc.).

There are several ways to debug a crashing program that are tried and true (although arduous). Some of these include:

• Using GFlags to launch Visual Studio or WinDbg
• Including code in the program to launch a debugger

In this case with WER, you could turn on local crash dumps, and then, as long as you have the symbol database (pdb) file, you can debug from a local crash dump. You can read more on taking local crash dumps at Collecting User-Mode Dumps.