The problem is that the program won't run with Data Execution Prevention
(DEP) turned on. (i.e. bad code)

Now that i know what the problem is, the bucket "CODE_RUNNING_ON_STACK" is
entirely understandable and logical; Money tried to setup dynamic code and
run it - that is so poor a design that the operating system and CPU team up
to forbid such activities.

Note: After disabling DEP for the executables required, the update ran fine.
Unfortuantly the new executables are Microsoft signed, and that means that
you can no longer disable DEP on them:
This program must run with data execution protection (DEP) enabled.
You cannot turn off DEP for this program.

This is so that Microsoft's own files are always protected. Perhaps the guys
in the Money team need to have their own certificate - sequestering them
from the implied QA of the "core" OS components.


So it was fixed long enough to get itself completely broken. The new
analysis is:

0:003> !analyze -v
************************************************** *****************************
*
*
* Exception Analysis
*
*
*
************************************************** *****************************

*** ERROR: Module load completed but symbols could not be loaded for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\onlinesvcs.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\autoupdate.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnymetal.dll -
*** ERROR: Module load completed but symbols could not be loaded for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\msmoney.exe

FAULTING_IP:
+23c412d
023c412d ed in eax,dx

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 023c412d
ExceptionCode: c0000096
ExceptionFlags: 00000008
NumberParameters: 0

FAULTING_THREAD: 00001f4c

PROCESS_NAME: msmoney.exe

ERROR_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.

DEFAULT_BUCKET_ID: CODE_RUNNING_ON_STACK

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

IP_ON_HEAP: 023c40ff
The fault address in not in any loaded module, please check your build's
rebase
log at <releasedir> \bin\build_logs\timebuild\ntrebase.log for module which
may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER: from 023c40ff to 023c412d

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
01dbdf98 023c40ff 01dbdfec 01dbdfdc 023f57e1 0x23c412d
01dbdfa4 023f57e1 01dbdfec 3e6f0ef4 00095ce0 0x23c40ff
01dbdfdc 023c40e0 023c40f0 01dbdfec 3e6f0e00 0x23f57e1
01dbdffc 023b983a 00000000 00000000 000000f0 0x23c40e0
01dbe50c 761ad26f 00212fe8 01dbe568 01dbe768 0x23b983a
01dbee58 023f57e1 01dbf018 3e6f3fb8 00000000
kernel32!WideCharToMultiByte+0x203
01dbeea4 761ad26f 00212fe8 0021126c 0021128a 0x23f57e1
01dbf02c 30abe9ee 01dbf044 30a90000 023e3cf0
kernel32!WideCharToMultiByte+0x203
01dbf094 30ac0078 01dbf044 77259834 01dbf160 onlinesvcs+0x2e9ee
01dbf1b4 30ac012e 63694d5c 6f736f72 4d207466 onlinesvcs+0x30078
01dbf2cc 30abe4fa 3e6d4f70 00000000 00000001 onlinesvcs+0x3012e
01dbf354 30ad49a4 30a90000 00000001 00000000 onlinesvcs+0x2e4fa
01dbf394 30ad4a4b 30a90000 7728e1c4 30a90000 onlinesvcs+0x449a4
01dbf3bc 7727c4c2 30ad4a2e 30a90000 00000001 onlinesvcs+0x44a4b
01dbf4b4 7727c673 00000000 70620dde 00000000
ntdll!LdrpRunInitializeRoutines+0x270
01dbf738 77277a52 00000000 00285e80 01dbfa2c ntdll!LdrpLoadDll+0x49a
01dbf9bc 761831ba 00285e80 01dbfa2c 01dbf9ec ntdll!LdrLoadDll+0x22a
01dbfa20 76189488 7ffdcc00 00000000 00000008 kernel32!LoadLibraryExW+0x252
01dbfa34 33943e31 01dbfa58 00000000 00000008 kernel32!LoadLibraryExA+0x1f
01dbfb60 33938dda 01dbfb80 01dbcdec 00000104
autoupdate!HrWaitOnCheckingDlg+0x7b0e
01dbfe18 33938e53 00000000 01e77d70 0026bc10
autoupdate!FAuthenticatePackage+0x526
01dbfeb0 3393926e 3394b28c 01e77d70 3393402d
autoupdate!FAuthenticatePackage+0x59f
01dbfee4 33933698 01e77d70 01e7717c 01e77170
autoupdate!FAuthenticatePackage+0x9ba
01dbfef8 339336da 01e7717c 00000000 01e77170
autoupdate!IsUpdateCompleted+0x12e
01dbff0c 0901943d 00000000 00000000 01db89ef
autoupdate!CAutoUpdateService::HrAquireAccess+0x29
01dbff3c 0900b7cf 00243d18 01db895b 00000000 mnymetal!Ordinal5+0x6c0
01dbff88 761a4911 01e77d08 01dbffd4 7728e4b6 mnymetal!Ordinal16+0x3b8
01dbff94 7728e4b6 01e907e0 70620532 00000000
kernel32!BaseThreadInitThunk+0xe
01dbffd4 7728e489 0900b706 01e907e0 00000000 ntdll!__RtlUserThreadStart+0x23
01dbffec 00000000 0900b706 01e907e0 00000000 ntdll!_RtlUserThreadStart+0x1b


FOLLOWUP_IP:
onlinesvcs+2e9ee
30abe9ee 83c404 add esp,4

SYMBOL_STACK_INDEX: 8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: onlinesvcs

IMAGE_NAME: onlinesvcs.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 47b392ed

PRIMARY_PROBLEM_CLASS: CODE_RUNNING_ON_STACK

BUGCHECK_STR: APPLICATION_FAULT_CODE_RUNNING_ON_STACK

SYMBOL_NAME: onlinesvcs+2e9ee

STACK_COMMAND: ~3s ; kb

FAILURE_BUCKET_ID: APPLICATION_FAULT_CODE_RUNNING_ON_STACK_onlinesvcs +2e9ee

BUCKET_ID: APPLICATION_FAULT_CODE_RUNNING_ON_STACK_onlinesvcs +2e9ee

Followup: MachineOwner
---------

Fix it, build it, deploy it to the download servers, and let me know when
it's ready for production use.

p.s. Don't mark the MNYCoreFiles folder with the +SH attributes; you're not
that important.

Keywords: 0xc0000096, Privileged instruction, CODE_RUNNING_ON_STACK, DEP,
data execution prevention, Microsoft Money

- quote -

Yes. Microsoft Money fails with Data Execution Prevention enabled.

Which is absoutely intolerable for a Microsoft product released after 2004,
but at least their upcoming service pack claims to have fixed the bugs.


Exactly what i want from a program that communicates over the internet - the
potential for a buffer overrun to take control of my computer.

In microsoft.public.money, Ian Boyd wrote:

- quote -

http://www.microsoft.com/money/freetrial_deluxe.mspx links to, then
yes. However I would have saved the file to my hard drive first.
Then I would right-click the downloaded file. That is not to say
that the way I would do it is the only good way.


- quote -

Ok. That makes sense.

- quote -

See if http://support.microsoft.com/kb/942485 might apply to you.




- quote -

- quote -

No existing version of Money, no data files, first time trying it.
i realize Vista has virtual folder redirection of program files folder,
although i would hope that the Money guys manifested the app runAs=Invoker
to disable that compatibility hack.

- quote -

Do you mean:
http://switch.atdmt.com/action/mrtwx...eTrialPage_mny

i installed Money by clicking the link and hitting "Run"; i've never heard
of a "Money Plus" device from which i can install software.Don't need to run
setup as administrator - the Vista heuristics automatically elevate it.

- quote -

i suppose i could let execution continue after the JIT debugger appears when
running with an elevated token. i just assumed that i was seeing the same
error that causes the application to fail to initialize. But you have to
understand that it application doesn't launch. i see it loading dlls,
spinning up threads, and then exiting threads and finally calling
ExitProcess.

- quote -

that it won't require administrative access for updates.

- quote -

In microsoft.public.money, Ian Boyd wrote:

- quote -

First, you would have probably been disappointed with Essentials
anyway. It lacks some significant operations that Deluxe has. I
would uninstall that trial and download the Deluxe trial.

Be sure any existing Money and backup files are moved to a spot that
you will have full privileges to, such as within the user's
Documents folder. If they are in ProgramFiles, Vista will create
an impermanent copy of the file for the user to use, unless the
user explicitly right-clicks at launch and choose
RunAsAdministrator that time.


Install Money from the Money Plus by browsing to the setup file.
Right-click that file, and choose RunAsAdministrator.

After install, right-click the Money icon and choose
RunAsAdministrator to let potential updates happen. Reboot the
computer. You should not have to run as Administrator normally.



- quote -

No compatibility setting changes needed.

i downloaded money from
http://www.microsoft.com/money/freet...ssentials.mspx

Installed it. Click the big "M" to start it, and doesn't launch.
Tried reinstalled. Click the big "M" to start it, and it doesn't launch.

Tried setting compatibility for XPSP2, no DWM, etc, etc. Doesn't launch.

Set it to run as administrator (Vista) and WinDbg catches a privelaged
instruction exception:



0:003> !analyze -v
************************************************** *****************************
*
*
* Exception Analysis
*
*
*
************************************************** *****************************

*** ERROR: Module load completed but symbols could not be loaded for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\onlinesvcs.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\autoupdate.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnymetal.dll -
*** ERROR: Module load completed but symbols could not be loaded for
C:\Program Files\Microsoft Money Plus\MNYCoreFiles\msmoney.exe

FAULTING_IP:
+1d13aa8
01d13aa8 ed in eax,dx

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 01d13aa8
ExceptionCode: c0000096
ExceptionFlags: 00000008
NumberParameters: 0

FAULTING_THREAD: 00002624

PROCESS_NAME: msmoney.exe

ERROR_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.

DEFAULT_BUCKET_ID: CODE_RUNNING_ON_STACK

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

IP_ON_HEAP: 01d13a66
The fault address in not in any loaded module, please check your build's
rebase
log at <releasedir> \bin\build_logs\timebuild\ntrebase.log for module which
may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER: from 01d13a66 to 01d13aa8

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
01cde0ec 01d13a66 000007ab 01d40f98 00000000 0x1d13aa8
01cde11c 01d0d723 01d40f98 00000001 00000000 0x1d13a66
01cde638 763b20e2 76400430 00113fc4 ffffffff 0x1d0d723
01cdf070 30abe5c3 01cdf09c 30a90000 01d12728
comdlg32!SHFusionInitializeFromModuleID+0xae
01cdf0d8 30abfc73 01cdf19c 77a89834 0ef0ffcd onlinesvcs+0x2e5c3
01cdf1f0 30abfd09 72676f72 46206d61 73656c69 onlinesvcs+0x2fc73
01cdf300 30abe1bb 00000000 00000001 30a90000 onlinesvcs+0x2fd09
01cdf37c 30ad0787 30a90000 00000001 00000000 onlinesvcs+0x2e1bb
01cdf39c 77abe1c4 30a90000 00000001 00000000 onlinesvcs+0x40787
01cdf3bc 77aac4c2 30ad0737 30a90000 00000001 ntdll!LdrpCallInitRoutine+0x14
01cdf4b4 77aac673 00000000 7893443d 00000000
ntdll!LdrpRunInitializeRoutines+0x270
01cdf738 77aa7a52 00000000 001367e8 01cdfa2c ntdll!LdrpLoadDll+0x49a
01cdf9bc 765831ba 001367e8 01cdfa2c 01cdf9ec ntdll!LdrLoadDll+0x22a
01cdfa20 76589488 7ffdbc00 00000000 00000008 kernel32!LoadLibraryExW+0x252
01cdfa34 33943e41 01cdfa58 00000000 00000008 kernel32!LoadLibraryExA+0x1f
01cdfb60 33938df2 01cdfb80 01cd21c1 00000104
autoupdate!HrWaitOnCheckingDlg+0x7b0e
01cdfe18 33938e6b 00000000 01dc7d70 00117428
autoupdate!FAuthenticatePackage+0x526
01cdfeb0 33939286 3394b28c 01dc7d70 3393402d
autoupdate!FAuthenticatePackage+0x59f
01cdfee4 33933698 01dc7d70 01dc717c 01dc7170
autoupdate!FAuthenticatePackage+0x9ba
01cdfef8 339336da 01dc717c 00000000 01dc7170
autoupdate!IsUpdateCompleted+0x12e
01cdff0c 0901943d 00000000 00000000 01cd3bc8
autoupdate!CAutoUpdateService::HrAquireAccess+0x29
01cdff3c 0900b7cf 000f3da0 01cd3b7c 00000000 mnymetal!Ordinal5+0x6c0
01cdff88 765a4911 01dc7d08 01cdffd4 77abe4b6 mnymetal!Ordinal16+0x3b8
01cdff94 77abe4b6 024107e0 78934cd1 00000000
kernel32!BaseThreadInitThunk+0xe
01cdffd4 77abe489 0900b706 024107e0 00000000 ntdll!__RtlUserThreadStart+0x23
01cdffec 00000000 0900b706 024107e0 00000000 ntdll!_RtlUserThreadStart+0x1b


FOLLOWUP_IP:
comdlg32!SHFusionInitializeFromModuleID+ae
763b20e2 83f8ff cmp eax,0FFFFFFFFh

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: comdlg32

IMAGE_NAME: comdlg32.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4791a752

PRIMARY_PROBLEM_CLASS: CODE_RUNNING_ON_STACK

BUGCHECK_STR: APPLICATION_FAULT_CODE_RUNNING_ON_STACK

SYMBOL_NAME: comdlg32!SHFusionInitializeFromModuleID+ae

STACK_COMMAND: ~3s ; kb

FAILURE_BUCKET_ID:
APPLICATION_FAULT_CODE_RUNNING_ON_STACK_comdlg32!S HFusionInitializeFromModuleID+ae

BUCKET_ID:
APPLICATION_FAULT_CODE_RUNNING_ON_STACK_comdlg32!S HFusionInitializeFromModuleID+ae

Followup: MachineOwner
---------



Fix it, build it, deploy a new copy to the download servers, and tell me
when it's ready for use on Vista.

btw, don't forget to include the Vista specific manifest for disabling
high-dpi scaling and to run as invoker. You're a Microsoft program: you
should be an example of people following the rules.