Mremoteng: Crashing when many sessions are open

Created on 27 Dec 2017  路  18Comments  路  Source: mRemoteNG/mRemoteNG


|Detail|Value|
|--:|---|
|Operating system | Windows 10 x64 1709 |
|mRemoteNG version| 1.75.7012.16814 |

Getting occasional crashes. Usually when I have more than 5 sessions open. It seems to happen right after I open a new connection and input my credentials. Here is the dump from the application log (12/27/2017 14:49:52):

Faulting application name: mRemoteNG.exe, version: 1.75.7012.16814, time stamp: 0x5a21814f
Faulting module name: Windows.UI.XamlHost.dll, version: 10.0.16299.15, time stamp: 0x133cf20e
Exception code: 0xc0000409
Fault offset: 0x00005929
Faulting process id: 0x2be4
Faulting application start time: 0x01d37b2eb4157045
Faulting application path: C:\Program Files (x86)\mRemoteNG\mRemoteNG.exe
Faulting module path: C:\Windows\System32\Windows.UI.XamlHost.dll
Report Id: 3288879d-b053-497d-98f0-6ca36cd14a53
Faulting package full name: 
Faulting package-relative application ID:

And here is the dump from the log file from the same time period:

2017-12-27 14:49:45,186 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:49:45,186 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:49:45,186 [1] INFO - RD Gateway is supported.
2017-12-27 14:49:50,228 [1] INFO - Protocol Event Connected
2017-12-27 14:49:50,228 [1] INFO - Connection to "REDACTED" via "RDP" established by user "REDACTED" (Description: ""; User Field: "")
2017-12-27 14:49:52,229 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:49:52,229 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:20,506 [1] INFO - mRemoteNG 1.75.7012.16814 starting.
2017-12-27 14:50:20,521 [1] INFO - Command Line: System.String[]
2017-12-27 14:50:21,639 [1] INFO - Microsoft Windows 10 Enterprise  64-bit
2017-12-27 14:50:21,639 [1] INFO - Microsoft .NET CLR 4.0.30319.42000
2017-12-27 14:50:21,639 [1] INFO - System Culture: en-US/English (United States)
2017-12-27 14:50:21,639 [1] INFO - Checking FIPS Policy...
2017-12-27 14:50:21,639 [1] INFO - Checking Lenovo AutoScroll Utility...
2017-12-27 14:50:22,656 [1] INFO - Loading External Apps from: C:\Users\REDACTED\AppData\Roaming\mRemoteNG\extApps.xml
2017-12-27 14:50:23,376 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,379 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:23,379 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:23,679 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,679 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:23,679 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:23,758 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,773 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:23,774 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:23,842 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,842 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:23,842 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:23,911 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,927 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:23,927 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:23,995 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:23,995 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:24,011 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:24,080 [1] ERROR- RDP SetCredentials failed!
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, BindingFlags invokeAttr, Binder binder, Object[] index, CultureInfo culture)
   at System.Reflection.RuntimePropertyInfo.GetValue(Object obj, Object[] index)
   at mRemoteNG.Connection.ConnectionInfo.GetInheritedPropertyValue[TPropertyType](String propertyName)
   at mRemoteNG.Connection.ConnectionInfo.GetPropertyValue[TPropertyType](String propertyName, TPropertyType value)
   at mRemoteNG.Connection.AbstractConnectionInfoData.get_Password()
   at mRemoteNG.Connection.Protocol.RDP.ProtocolRDP.SetCredentials()
2017-12-27 14:50:24,080 [1] INFO - Setting Console switch for RDC 10.0.16299.
2017-12-27 14:50:24,080 [1] INFO - RD Gateway is supported.
2017-12-27 14:50:24,342 [1] WARN - PuttySessions.Watcher.StartWatching() failed.
Not found 
2017-12-27 14:50:24,342 [1] WARN - XmingPortablePuttySessions.Watcher.StartWatching() failed.
The directory name sessions is invalid.


Bug VendoUpstream Issue Verified
Source
picture ryandevries
👍1

Most helpful comment

Reported to Microsoft with a minimal solution that reproduces the issue:
https://developercommunity.visualstudio.com/content/problem/352484/buffer-overflow-within-windowsuixamlhostdll-when-p.html

picture janis-veinbergs on 9 Oct 2018
❤5

All 18 comments

I've added some additional safety around the code that if failing for you. This should hopefully be resolved (or at least easier to diagnose) in v1.76

sparerd picture sparerd on 5 Feb 2018
🎉1

Failure of the module name: Windows.UI.XamlHost.dll,
same as v1.76
Failed Application Name: mRemoteNG.exe, Version: 1.76.3.32991, Timestamp: 0x5aa9bc20
Failure of the module name: Windows.UI.XamlHost.dll, version: 10.0.16299.15, timestamp: 0x133cf20e
Exception status code: 0xc0000409
Error displacement: 0x00005929
Failed Handler Identification Number: 0x2134
Failed application start time: 0x01d3c4c33d718393
Failed application path: C:\Data\Tools\mRemoteNG\mRemoteNG.exe
Failed module path: C:\Windows\System32Windows.UI.XamlHost.dll
Report identification number: 693ca16e-48b2-46de-9bb3-699a699132e1
Failed suite full name:
Failed suite-related application identifiers:

IvanYC picture IvanYC on 30 Mar 2018

Still seems to be happening on 1.76.3.32942.

Event Viewer:
Faulting application name: mRemoteNG.exe, version: 1.76.3.32942, time stamp: 0x5aa9bbbf
Faulting module name: Windows.UI.XamlHost.dll, version: 10.0.17134.1, time stamp: 0xecdec09f
Exception code: 0xc0000409
Fault offset: 0x000058af
Faulting process id: 0x2d5c
Faulting application start time: 0x01d40d5eb6d4e585
Faulting application path: C:\Program Files (x86)\mRemoteNG\mRemoteNG.exe
Faulting module path: C:\Windows\System32Windows.UI.XamlHost.dll
Report Id: 88bee802-1160-4f6c-a1c2-3f9565d797f3
Faulting package full name:
Faulting package-relative application ID:

Nothing in mRemoteNG.log, though.

ryandevries picture ryandevries on 28 Jun 2018

https://github.com/mRemoteNG/mRemoteNG/issues/930 appears to be the same crash.

hohokus picture hohokus on 12 Jul 2018

I haven't been able to replicate the issue myself, but I'm also not opening as many RDP sessions as I used to.

What we know:

  1. This only seems to occur on Windows 10, starting with release 1709. There is one report of it occurring in version 1803 (https://github.com/mRemoteNG/mRemoteNG/issues/930#issuecomment-419241169) Has anyone seen this occur on a version prior to 1709?
  2. So far there are 2 known ways the crash can occur:

    1. Opening a new RDP connection

    2. During a connection resize (going from full screen mode to non-full screen). https://github.com/mRemoteNG/mRemoteNG/issues/930#issuecomment-384276075

  3. The exception is occurring in Windows.UI.XamlHost.dll which is a low level Windows api for displaying windows and doing layout. The exception code is always 0xc0000409. There are a few google results for "Windows.UI.Xaml 0xc0000409" but then tend to point to Windows profile or file corruption.

Open questions:

  • Can this crash be reproduced on an older version of mRemoteNG (such as the latest v1.75)? This is the last big issue holding up v1.76 from being released under the Stable channel. However, if the bug occurs based on OS version rather than mRNG version, I'm ok with releasing. I just don't want to expose a known crash bug to Stable channel users.
  • What version of windows are the target hosts in most cases? Server 2016? 2012? A mix?
  • What is the RAM usage of mRemoteNG at the time of the crash? RDP has been known to use a lot of memory in certain cases.
  • Has anyone been able to replicate this with a single RDP connection, or is it always with multiple connections (at least 4+, 5+, etc)?
sparerd picture sparerd on 30 Sep 2018

@sparerd today i'm going to try opening/closing RDP sessions and see if I can (hopefully) reproduce crashes and answer some of your questions / provide more details.

janis-veinbergs picture janis-veinbergs on 1 Oct 2018
👍1

@sparerd

  1. I have a folder with 6 connections and saved credentials. Like 10 times i tried to connect to all hosts and disconnect and no crash. Had like 3 other open tabs. Then closed all tabs and tried to reconnect to a RDP session which asks credentials. after 3 tries - crash.
  2. Restarted RDC Man. Tried reconnecting to single session non stop when it prompts for credentials. On EXACTLY 27th retry I have a crash BEFORE credential popup.
  3. Memory doesn't seem to be an issue. After 20+ reconnects, 110MB while connected (same amount), ~60mb disconnected.
  4. Source OS Win10b1803, Target OS tested against = Server 2012R2
  5. Stable v1.75.7012 also crashes

Pretty sure it is due to Credential Dialog. As I got this additional info:

shellcommon\shell\auth\authux\credux\creduxlib\credux.cpp(29)\Windows.UI.Cred.dll!6577F43A: (caller: 6709222F) ReturnHr(1) tid(c98) 802B000A pcshell\shell\auth\authux\credux\controller\lib\viewdefinition.cpp(46)\windows.ui.creddialogcontroller.dll!670922B0: (caller: 6708CDD8) ReturnHr(1) tid(c98) 802B000A internal\pcshellshell\inc\xamlhostviewdefinition.h(309)\windows.ui.creddialogcontroller.dll!6708CDF1: (caller: 6708CE43) ReturnHr(2) tid(c98) 802B000A internal\pcshellshell\inc\xamlhostviewdefinition.h(78)\windows.ui.creddialogcontroller.dll!6708CE5A: (caller: 66C2D36A) ReturnHr(3) tid(c98) 802B000A pcshell\shell\xamlhost\lib\xamlhost.cpp(895)\Windows.UI.XamlHost.dll!66C2D524: (caller: 66C2CAC7) FailFast(1) tid(c98) 802B000A     CallContext:[\CreateHostWindowActivity] 
(404c.c98): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)

This exception happens to be on thread 53 which doesn't run any managed code.

0:052> !dumpstack
OS Thread Id: 0xc98 (52)
Current frame: Windows_UI_XamlHost!wil::details::ReportFailure+0xc7
ChildEBP RetAddr  Caller, Callee
1304e084 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304e0d4 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304e0d8 66c2cac7 Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow+0x57b, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent
1304e280 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e298 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e2b0 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e2fc 64c19f91 Windows_UI_Xaml!operator delete+0x31, calling ntdll!RtlFreeHeap
1304e320 64d22cc0 Windows_UI_Xaml!std::vector<std::pair<enum KnownPropertyIndex,EffectiveValue>,Jupiter::stack_allocator<std::pair<enum KnownPropertyIndex,EffectiveValue>,256,8> >::_Tidy+0x20, calling Windows_UI_Xaml!CValue::~CValue
1304e330 64c92d43 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x4c3, calling Windows_UI_Xaml!std::vector<std::pair<enum KnownPropertyIndex,EffectiveValue>,Jupiter::stack_allocator<std::pair<enum KnownPropertyIndex,EffectiveValue>,256,8> >::_Tidy
1304e338 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e350 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e368 64c928b9 Windows_UI_Xaml!CDependencyObject::ResetReferencesFromSparsePropertyValues+0x39, calling Windows_UI_Xaml!__security_check_cookie
1304e378 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e388 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e3a0 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e3e8 64c19f91 Windows_UI_Xaml!operator delete+0x31, calling ntdll!RtlFreeHeap
1304e408 64dc3f10 Windows_UI_Xaml!operator delete+0xd, calling Windows_UI_Xaml!operator delete
1304e414 64cacafa Windows_UI_Xaml!ctl::ComObject<DirectUI::ExternalObjectReference>::`scalar deleting destructor'+0x37, calling Windows_UI_Xaml!operator delete
1304e418 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e428 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e43c 64c23f9e Windows_UI_Xaml!CValue::Dispatch<CValueDetails::Handlers::ConvertAndCopy,long,CValue const &>+0x18e, calling Windows_UI_Xaml!__security_check_cookie
1304e440 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e678 65720509 wincorlib!Platform::Details::ControlBlock::ReleaseTarget+0x49, calling ntdll!RtlFreeHeap
1304e690 657bb81a Windows_UI_Cred!__abi_FTMWeakRefData::__abi_dtor+0x7a, calling Windows_UI_Cred!Platform::Details::ControlBlock::__abi_Release
1304e6b4 77320a35 msvcrt!_NLG_Return+0x1e, calling msvcrt!_NLG_Notify1
1304e6d0 77319daf msvcrt!__FrameUnwindToState+0x82, calling msvcrt!_CallSettingFrame
1304e6dc 77319de6 msvcrt!__FrameUnwindToState+0xb9, calling msvcrt!_SEH_epilog4
1304e714 77319de6 msvcrt!__FrameUnwindToState+0xb9, calling msvcrt!_SEH_epilog4
1304e718 77319e94 msvcrt!__InternalCxxFrameHandler+0x83, calling msvcrt!__FrameUnwindToState
1304e734 77319f26 msvcrt!__InternalCxxFrameHandler+0x115, calling msvcrt!__security_check_cookie
1304e740 7731ab46 msvcrt!__CxxFrameHandler+0x26, calling msvcrt!__InternalCxxFrameHandler
1304e77c 77a8eb32 ntdll!ExecuteHandler2+0x26
1304e7a0 77a8eb04 ntdll!ExecuteHandler+0x24, calling ntdll!ExecuteHandler2
1304e7c4 77a729a1 ntdll!RtlUnwind+0x111, calling ntdll!RtlpExecuteHandlerForUnwind
1304e7cc 77a7a69c ntdll!NtContinue+0xc
1304e7d0 77a729da ntdll!RtlUnwind+0x14a, calling ntdll!NtContinue
1304e954 7731a978 msvcrt!_UnwindNestedFrames+0x2c, calling ntdll!RtlUnwind
1304e978 770aa46c combase!SendReport+0x169, calling combase!__SEH_epilog4_GS
1304e97c 77156b1e combase!RoOriginateErrorW+0x3e, calling combase!SendReport
1304e994 77156b2a combase!RoOriginateErrorW+0x4a, calling combase!__security_check_cookie
1304e9c8 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304e9d8 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304ea10 770aedf6 combase!operator delete+0x16, calling ntdll!RtlFreeHeap
1304ea24 7715dd16 combase!operator delete+0xd, calling combase!operator delete
1304ea30 770ab05e combase!CRestrictedError::`scalar deleting destructor'+0x1e, calling combase!operator delete
1304ea44 770aaef3 combase!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,Microsoft::WRL::ChainInterfaces<ICreateRestrictedErrorInfo3,ICreateRestrictedErrorInfo2,ICreateRestrictedErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfo,IErrorInfo,IRestrictedErrorInfoContext,Microsoft::WRL::ChainInterfaces<ILanguageExceptionErrorInfo2,ILanguageExceptionErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfoTelemetry,IRestrictedErrorInfoInternal,IMarshal>::Release+0x53, calling combase!CRestrictedError::`scalar deleting destructor'
1304ea48 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304ea90 65723dbe wincorlib!Platform::Details::HeapFreeHelper+0x2e, calling ntdll!RtlFreeHeap
1304eaac 657203c9 wincorlib!Platform::Details::ControlBlock::__abi_Release+0x29, calling wincorlib!Platform::Details::HeapFreeHelper
1304eabc 65724135 wincorlib!Platform::COMException::__abi_Release+0x45, calling wincorlib!Platform::Details::ControlBlock::__abi_Release
1304ead4 7733ca12 msvcrt!_SEH_epilog4_GS+0xa, calling msvcrt!__security_check_cookie
1304ead8 7731906c msvcrt!__DestructExceptionObject+0x8c, calling msvcrt!_SEH_epilog4_GS
1304eb08 7731906c msvcrt!__DestructExceptionObject+0x8c, calling msvcrt!_SEH_epilog4_GS
1304eb0c 773193e4 msvcrt!CallCatchBlock+0x1fd, calling msvcrt!__DestructExceptionObject
1304eb18 77319356 msvcrt!CallCatchBlock+0x16f, calling msvcrt!_SEH_epilog4
1304eb58 77346622 msvcrt!_getptd+0x8, calling msvcrt!_getptd_noexit
1304eb7c 77319356 msvcrt!CallCatchBlock+0x16f, calling msvcrt!_SEH_epilog4
1304eb80 773194a7 msvcrt!CatchIt+0x68, calling msvcrt!CallCatchBlock
1304eba4 773194b5 msvcrt!CatchIt+0x76, calling msvcrt!_JumpToContinuation
1304ebc0 7731979f msvcrt!FindHandler+0x296, calling msvcrt!CatchIt
1304ec48 77319f13 msvcrt!__InternalCxxFrameHandler+0x102, calling msvcrt!FindHandler
1304ec80 7731ab46 msvcrt!__CxxFrameHandler+0x26, calling msvcrt!__InternalCxxFrameHandler
1304ecbc 77a8eb32 ntdll!ExecuteHandler2+0x26
1304ece0 77a8eb04 ntdll!ExecuteHandler+0x24, calling ntdll!ExecuteHandler2
1304ed04 77a72b2a ntdll!RtlDispatchException+0x142, calling ntdll!RtlpExecuteHandlerForException
1304ed5c 64c1e013 Windows_UI_Xaml!DirectUI::DXamlCore::GetPeerPrivate+0x183, calling ntdll!RtlReleaseSRWLockExclusive
1304ed80 64c276a5 Windows_UI_Xaml!CValueConvert::TryUnboxCDependencyObjectValue<CValue>+0xf5
1304ed8c 64c276f6 Windows_UI_Xaml!CValueConvert::TryUnboxCDependencyObjectValue<CValue>+0x146, calling Windows_UI_Xaml!__security_check_cookie
1304eda8 77a7c716 ntdll!KiUserExceptionDispatcher+0x26, calling ntdll!RtlDispatchException
00000000 0000bfff 0000bfff ====> Exception cxr@1304edc0
1304edc8 7758ddc2 KERNELBASE!RaiseException+0x62, calling ntdll!RtlRaiseException
1304edf4 770aaece combase!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,Microsoft::WRL::ChainInterfaces<ICreateRestrictedErrorInfo3,ICreateRestrictedErrorInfo2,ICreateRestrictedErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfo,IErrorInfo,IRestrictedErrorInfoContext,Microsoft::WRL::ChainInterfaces<ILanguageExceptionErrorInfo2,ILanguageExceptionErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfoTelemetry,IRestrictedErrorInfoInternal,IMarshal>::Release+0x2e, calling combase!__security_check_cookie
1304ee00 6571eec7 wincorlib!Platform::PrepareForThrow+0x87, calling wincorlib!__security_check_cookie
1304eec4 7758ddc2 KERNELBASE!RaiseException+0x62, calling ntdll!RtlRaiseException
1304effc 64d25ef0 Windows_UI_Xaml!GetCallerReturnAddressFromDirectCaller+0x29, calling ntdll!RtlCaptureStackBackTrace
1304f018 64d25ead Windows_UI_Xaml!GetErrorContextLinkedListHead+0x11, calling KERNEL32!TlsGetValueStub
1304f048 7758ddc2 KERNELBASE!RaiseException+0x62, calling ntdll!RtlRaiseException
1304f05c 64d24e80 Windows_UI_Xaml!OnFailure<610>+0x41, calling Windows_UI_Xaml!__security_check_cookie
1304f08c 64bb7a1a Windows_UI_Xaml!Application_LoadComponent+0xdc, calling Windows_UI_Xaml!OnFailure<505>
1304f0bc 64e805d3 Windows_UI_Xaml!DirectUI::FrameworkApplication::LoadComponent+0x2c8ef0, calling Windows_UI_Xaml!OnFailure<505>
1304f148 77a522e3 ntdll!RtlFreeHeap+0x1f3, calling ntdll!RtlpHpStackLoggingEnabled
1304f194 64c19f91 Windows_UI_Xaml!operator delete+0x31, calling ntdll!RtlFreeHeap
1304f1f0 77a5492a ntdll!RtlpAllocateHeapInternal+0xda, calling ntdll!RtlpLowFragHeapAllocFromContext
1304f228 64c1902e Windows_UI_Xaml!xstring_ptr::~xstring_ptr+0x4e, calling combase!WindowsDeleteString
1304f230 77a5483e ntdll!RtlAllocateHeap+0x3e, calling ntdll!RtlpAllocateHeapInternal
1304f238 77a5483e ntdll!RtlAllocateHeap+0x3e, calling ntdll!RtlpAllocateHeapInternal
1304f244 77150077 combase!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<2>,1,IErrorInfo,IRestrictedErrorInfoContext,Microsoft::WRL::ChainInterfaces<ILanguageExceptionErrorInfo2,ILanguageExceptionErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfoTelemetry,IRestrictedErrorInfoInternal,IMarshal>::CanCastTo+0x15, calling combase!InlineIsEqualGUID
1304f25c 7758ddb5 KERNELBASE!RaiseException+0x55, calling ntdll!memcpy
1304f264 7758ddc2 KERNELBASE!RaiseException+0x62, calling ntdll!RtlRaiseException
1304f278 7758ddc2 KERNELBASE!RaiseException+0x62, calling ntdll!RtlRaiseException
1304f2a4 770aaece combase!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,Microsoft::WRL::ChainInterfaces<ICreateRestrictedErrorInfo3,ICreateRestrictedErrorInfo2,ICreateRestrictedErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfo,IErrorInfo,IRestrictedErrorInfoContext,Microsoft::WRL::ChainInterfaces<ILanguageExceptionErrorInfo2,ILanguageExceptionErrorInfo,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,IRestrictedErrorInfoTelemetry,IRestrictedErrorInfoInternal,IMarshal>::Release+0x2e, calling combase!__security_check_cookie
1304f2b0 6571eec7 wincorlib!Platform::PrepareForThrow+0x87, calling wincorlib!__security_check_cookie
1304f2bc 657241bc wincorlib!__abi_FTMWeakRefData::Decrement+0x3e, calling wincorlib!__security_check_cookie
1304f2c8 7731a272 msvcrt!_CxxThrowException+0x72, calling KERNELBASE!RaiseException
1304f310 6571eab3 wincorlib!__abi_WinRTraiseCOMException+0x33, calling msvcrt!_CxxThrowException
1304f344 6577c356 Windows_UI_Cred!__abi_WinRTraiseException+0xa5, calling wincorlib!__abi_WinRTraiseCOMException
1304f350 6577c1d7 Windows_UI_Cred!__abi_ThrowIfFailed+0x17, calling Windows_UI_Cred!__abi_WinRTraiseException
1304f35c 657cf93e Windows_UI_Cred!Windows::UI::Xaml::IApplicationStatics::LoadComponent+0x32, calling Windows_UI_Cred!__abi_ThrowIfFailed
1304f370 657ccf49 Windows_UI_Cred!Windows::UI::Xaml::Application::LoadComponent+0x58, calling Windows_UI_Cred!Windows::UI::Xaml::IApplicationStatics::LoadComponent
1304f3b8 657be25c Windows_UI_Cred!?InitializeComponent@?Q__IFramePublicNonVirtuals@CredUX@@Frame@2@U$AAAXXZ+0x6c, calling Windows_UI_Cred!Windows::UI::Xaml::Application::LoadComponent
1304f400 6578b386 Windows_UI_Cred!CredUX::Frame::Frame+0xe4, calling Windows_UI_Cred!?InitializeComponent@?Q__IFramePublicNonVirtuals@CredUX@@Frame@2@U$AAAXXZ
1304f44c 6709222f windows_ui_creddialogcontroller!CredUXViewDefinition::v_GetRootElement+0x3f
1304f458 6577d96d Windows_UI_Cred!wil::details::ReportFailure_Hr+0x22, calling Windows_UI_Cred!wil::details::ReportFailure
1304f468 6577f43a Windows_UI_Cred!CredUXViewProviderImpl::GetView+0x4a, calling Windows_UI_Cred!wil::details::in1diag3::Return_Hr
1304f478 6709222f windows_ui_creddialogcontroller!CredUXViewDefinition::v_GetRootElement+0x3f
1304f47c 6708cdd8 windows_ui_creddialogcontroller!ViewDefinitionBase::_EnsureViewInitialized+0x9a
1304f488 67078c60 windows_ui_creddialogcontroller!wil::details::ReportFailure_Hr+0x22, calling windows_ui_creddialogcontroller!wil::details::ReportFailure
1304f498 670922b0 windows_ui_creddialogcontroller!CredUXViewDefinition::v_GetRootElement+0xc0, calling windows_ui_creddialogcontroller!wil::details::in1diag3::Return_Hr
1304f4a4 6708ce43 windows_ui_creddialogcontroller!ViewDefinitionBase::get_RootUIElement+0x23, calling windows_ui_creddialogcontroller!ViewDefinitionBase::_EnsureViewInitialized
1304f4b0 67078c60 windows_ui_creddialogcontroller!wil::details::ReportFailure_Hr+0x22, calling windows_ui_creddialogcontroller!wil::details::ReportFailure
1304f4bc 66c2d36a Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x1fb
1304f4c8 67078c60 windows_ui_creddialogcontroller!wil::details::ReportFailure_Hr+0x22, calling windows_ui_creddialogcontroller!wil::details::ReportFailure
1304f4d8 6708ce5a windows_ui_creddialogcontroller!ViewDefinitionBase::get_RootUIElement+0x3a, calling windows_ui_creddialogcontroller!wil::details::in1diag3::Return_Hr
1304f4dc 66c2cac7 Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow+0x57b, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent
1304f4e8 66c2590a Windows_UI_XamlHost!wil::details::ReportFailure_Hr+0x22, calling Windows_UI_XamlHost!wil::details::ReportFailure
1304f4f8 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304f508 66c2cac7 Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow+0x57b, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent
1304f510 66c3872f Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr+0x19, calling Windows_UI_XamlHost!wil::details::ReportFailure_Hr
1304f520 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304f530 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304f54c 66c2d080 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlRuntimeSites+0x29c, calling Windows_UI_XamlHost!__security_check_cookie
1304f574 6708bea5 windows_ui_creddialogcontroller!Windows::Foundation::Collections::Internal::SimpleVectorIterator<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *,Windows::Foundation::Collections::Internal::Vector<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *,Windows::Foundation::Collections::Internal::DefaultEqualityPredicate<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *>,Windows::Foundation::Collections::Internal::DefaultLifetimeTraits<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *>,Windows::Foundation::Collections::Internal::VectorOptions<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *,0,1,0> >,Windows::Foundation::Collections::Internal::DefaultLifetimeTraits<Windows::UI::Xaml::Hosting::IXamlRuntimeSite *>,XWinRT::IntVersionTag,1>::`vector deleting destructor'+0x25, calling windows_ui_creddialogcontroller!operator delete
1304f588 66c2cac7 Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow+0x57b, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent
1304f6b8 66c2d524 Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent+0x3b5, calling Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr
1304f6bc 66c2cac7 Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow+0x57b, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_InitializeXamlContent
1304f6d0 770cbf65 combase!WindowsDeleteString+0x35, calling ntdll!RtlFreeHeap
1304f6e0 66c2c0d7 Windows_UI_XamlHost!XAMLHostWindowImpl::_Show+0x26, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_CreateHostWindow
1304f6f8 66c2c534 Windows_UI_XamlHost!XAMLHostWindowImpl::_LoadResourceMap+0x166, calling Windows_UI_XamlHost!__security_check_cookie
1304f710 66c2b935 Windows_UI_XamlHost!<lambda_f0bb3f735932ab7d044ccb3dbad54cbc>::operator()+0x89, calling Windows_UI_XamlHost!XAMLHostWindowImpl::_Show
1304f728 66c33383 Windows_UI_XamlHost!DispatchableTaskWithContext<<lambda_f0bb3f735932ab7d044ccb3dbad54cbc> >::Dispatch+0x13, calling Windows_UI_XamlHost!<lambda_f0bb3f735932ab7d044ccb3dbad54cbc>::operator()
1304f734 66c38b85 Windows_UI_XamlHost!ASTAThreadHost::ASTAThreadHostStartThreadProc+0x5a
1304f758 66c38b01 Windows_UI_XamlHost!ASTAThreadHost::s_ASTAThreadHostStartThreadProc+0x41, calling Windows_UI_XamlHost!ASTAThreadHost::ASTAThreadHostStartThreadProc
1304f770 746298f3 shcore!_WrapperThreadProc+0x183
1304f7f8 75cf8484 KERNEL32!BaseThreadInitThunk+0x24
1304f80c 77a7305a ntdll!__RtlUserThreadStart+0x2f
1304f854 77a7302a ntdll!_RtlUserThreadStart+0x1b, calling ntdll!__RtlUserThreadStart

Btw here is Thread 0 call stack, which looks like is prompting for credentials:

Thread   0
Current frame: win32u!NtUserMsgWaitForMultipleObjectsEx+0xc
ChildEBP RetAddr  Caller, Callee
010fbd30 760ba0d8 USER32!RealMsgWaitForMultipleObjectsEx+0x78, calling win32u!NtUserMsgWaitForMultipleObjectsEx
010fbd54 770a6a3a combase!CCliModalLoop::HandlePendingMessage+0xcf, calling combase!__security_check_cookie
010fbd78 770a6f7d combase!CCliModalLoop::SetPointerInputModeAsAppropriateForQueueAttachmentConditions+0xa, calling combase!IsSetThreadInputBlockedPresent
010fbd7c 7715e364 combase!__SEH_epilog4_GS+0xb, calling combase!__security_check_cookie
010fbd80 770a6dc4 combase!CCliModalLoop::HandleWakeForMsg+0x11a, calling combase!__SEH_epilog4_GS
010fbd94 7710cd60 combase!CFmCtrlUnknown::QueryInterface+0x60
010fbda4 760ba003 USER32!MsgWaitForMultipleObjectsEx+0x63, calling USER32!RealMsgWaitForMultipleObjectsEx
010fbdcc 770a70a2 combase!CCliModalLoop::BlockFn+0xfd, calling USER32!MsgWaitForMultipleObjectsEx
010fbe04 770a3cc4 combase!ClassicSTAThreadWaitForHandles+0xb4, calling combase!CCliModalLoop::BlockFn
010fbe28 77a5492a ntdll!RtlpAllocateHeapInternal+0xda, calling ntdll!RtlpLowFragHeapAllocFromContext
010fbebc 770b2f7e combase!CoWaitForMultipleHandles+0x8e, calling combase!ClassicSTAThreadWaitForHandles
010fbeec 67087240 windows_ui_creddialogcontroller!WaitForCompletion<Windows::Foundation::IAsyncOperationCompletedHandler<Windows::Internal::UI::Credentials::Controller::RequestCredentialsData *>,Windows::Foundation::IAsyncOperation<Windows::Internal::UI::Credentials::Controller::RequestCredentialsData *> >+0x93, calling combase!CoWaitForMultipleHandles
010fbf34 6707bf5a windows_ui_creddialogcontroller!PromptInternal+0x2ad, calling windows_ui_creddialogcontroller!WaitForCompletion<Windows::Foundation::IAsyncOperationCompletedHandler<Windows::Internal::UI::Credentials::Controller::RequestCredentialsData *>,Windows::Foundation::IAsyncOperation<Windows::Internal::UI::Credentials::Controller::RequestCredentialsData *> >
010fc054 6707c11c windows_ui_creddialogcontroller!PromptAndWaitForCredsWithStyle+0x54, calling windows_ui_creddialogcontroller!PromptInternal
010fc0a4 67080b19 windows_ui_creddialogcontroller!CredUXController::Prompt+0x239, calling windows_ui_creddialogcontroller!PromptAndWaitForCredsWithStyle
010fc244 670cc573 wincredui!CredUIPromptForWindowsCredentialsWorkerInternal+0x4c0
010fc360 7212ec34 clr!DispatchInfo::InvokeMemberWorker+0x11d1, calling clr!_EH_epilog3_GS
010fc364 7212e142 clr!DispatchInfo::InvokeMemberDebuggerWrapper+0xf2, calling clr!DispatchInfo::InvokeMemberWorker
010fc420 77a76713 ntdll!RtlStringVPrintfWorkerA+0x1c, calling ntdll!_vsnprintf
010fc6c4 670cc00d wincredui!CredUIInternalPromptForWindowsCredentialsWorker+0x2d, calling wincredui!CredUIPromptForWindowsCredentialsWorkerInternal
010fc6f4 670cc7d1 wincredui!CredUIInternalPromptForWindowsCredentialsW+0xa1, calling wincredui!CredUIInternalPromptForWindowsCredentialsWorker
010fc73c 5afa23ec mstscax!CTscCredentialsQueryUi::PromptForCredentialsNew+0x109, calling credui!CredUIPromptForWindowsCredentialsW
010fc79c 5b019aa8 mstscax!CTscCredsAssistant::PromptForTsCredentials+0x5c6, calling mstscax!CTscCredentialsQueryUi::PromptForCredentialsNew
010fdd90 5b017794 mstscax!CTscCredsAssistant::AcquireTsCredentials+0xa61, calling mstscax!CTscCredsAssistant::PromptForTsCredentials
010fddc0 7636a13b gdi32full!RenderItemNoFallback+0x42b, calling gdi32full!ShlPlaceOT
010fe41c 5aefa653 mstscax!CTSPropertySet::GetBoolProperty+0xa3, calling mstscax!__security_check_cookie
010fe42c 5b01a404 mstscax!CTscCredsAssistant::OnSecurityLayerNegotiationComplete+0x225, calling mstscax!CTscCredsAssistant::AcquireTsCredentials
010fe478 760bbe6b USER32!_InternalCallWinProc+0x2b
010fe52c 017e5e16 (MethodDesc 0576ce04 +0x56 WeifenLuo.WinFormsUI.Docking.DockPanel+FocusManagerImpl+LocalWindowsHook.CoreHookProc(Int32, IntPtr, IntPtr)), calling 017e583c
010fe544 013fd197 013fd197
010fe574 760aa53e USER32!DispatchHookA+0x8e
010fe58c 760aa56d USER32!DispatchHookA+0xbd, calling USER32!__security_check_cookie
010fe5b8 7610b1b4 USER32!fnHkINLPCWPRETSTRUCTA+0x84, calling USER32!DispatchHookA
010fe5c8 7610b1bd USER32!fnHkINLPCWPRETSTRUCTA+0x8d, calling USER32!IsTouchInputMessage
010fe6d8 7609bc57 USER32!SendMessageW+0x137, calling USER32!SendMessageWorker
010fe6f4 7609bc65 USER32!SendMessageW+0x145, calling USER32!__security_check_cookie
010fe704 6bbea68f (MethodDesc 6ba531a8 +0x10f System.Windows.Forms.Internal.WindowsGraphics.MeasureText(System.String, System.Windows.Forms.Internal.WindowsFont, System.Drawing.Size, System.Windows.Forms.Internal.IntTextFormatFlags)), calling (MethodDesc 6ba53708 +0 System.Windows.Forms.Internal.IntUnsafeNativeMethods.DrawTextEx(System.Runtime.InteropServices.HandleRef, System.String, RECT ByRef, Int32, DRAWTEXTPARAMS))
010fe71c 6bc40e14 (MethodDesc 6ba5536c +0x3c DomainBoundILStubClass.IL_STUB_PInvoke(System.Runtime.InteropServices.HandleRef, Int32, IntPtr, IntPtr))
010fe77c 6c25f1e5 (MethodDesc 6bb0204c +0x101 System.Windows.Forms.ListView.SetColumnWidth(Int32, System.Windows.Forms.ColumnHeaderAutoResizeStyle)), calling (MethodDesc 6ba501c0 +0 System.Windows.Forms.Control.SendMessage(Int32, Int32, IntPtr))
010fe784 6c25f1f0 (MethodDesc 6bb0204c +0x10c System.Windows.Forms.ListView.SetColumnWidth(Int32, System.Windows.Forms.ColumnHeaderAutoResizeStyle))
010fe7a0 6c2541ba (MethodDesc 6bb01c5c +0x32 System.Windows.Forms.ColumnHeader.set_Width(Int32)), calling 6bbc3dd4
010fe7b0 0ab5d43c (MethodDesc 0ac2a758 +0x2c4 mRemoteNG.UI.Controls.ConnectionTree.AutoResizeColumn(System.Windows.Forms.ColumnHeader)), calling 6bbafa70
010fe81c 720e947c clr!SafeHandle::DangerousRelease+0x6e, calling clr!SafeHandle::Release
010fe820 720e94ac clr!SafeHandle::DangerousRelease+0xa6, calling clr!_EH_epilog3
010fe840 7212ec34 clr!DispatchInfo::InvokeMemberWorker+0x11d1, calling clr!_EH_epilog3_GS
010fe844 7212e142 clr!DispatchInfo::InvokeMemberDebuggerWrapper+0xf2, calling clr!DispatchInfo::InvokeMemberWorker
010fe888 7212e14e clr!DispatchInfo::InvokeMemberDebuggerWrapper+0xfe, calling clr!_SEH_epilog4
010fe8dc 720ed214 clr!GCCoopHackNoThread::GCCoopHackNoThread+0xb, calling clr!GetThread
010fe8e8 720ed78a clr!HashMap::LookupValue+0x2f, calling clr!GCCoopHackNoThread::GCCoopHackNoThread
010fe8ec 720ed814 clr!HashMap::LookupValue+0xde, calling clr!_EH_epilog3
010fe930 720ed814 clr!HashMap::LookupValue+0xde, calling clr!_EH_epilog3
010fe934 7212e1de clr!DispatchInfo::FindMember+0x27, calling clr!HashMap::LookupValue
010fe948 720df1fb clr!_EH_epilog3_catch_GS+0xa, calling clr!__security_check_cookie
010fe94c 7212e4ed clr!DispatchInfo::InvokeMember+0x609, calling clr!_EH_epilog3_catch_GS
010fe9f4 6c262ca3 (MethodDesc 6bb025fc +0x4bb System.Windows.Forms.ListView.WndProc(System.Windows.Forms.Message ByRef)), calling (MethodDesc 6ba506cc +0 System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef))
010fea6c 7212e4ed clr!DispatchInfo::InvokeMember+0x609, calling clr!_EH_epilog3_catch_GS
010fea70 7212e616 clr!InternalDispatchImpl_Invoke+0x187, calling clr!DispatchInfo::InvokeMember
010fea94 7212e668 clr!InternalDispatchImpl_Invoke+0x33b, calling clr!_EH_epilog3
010feb34 7212e668 clr!InternalDispatchImpl_Invoke+0x33b, calling clr!_EH_epilog3
010feb38 7212e6c9 clr!InternalDispatchImpl_Invoke_CallBack+0x72, calling clr!InternalDispatchImpl_Invoke
010feb68 7212e7ab clr!InternalDispatchImpl_Invoke_Wrapper+0x104, calling clr!InternalDispatchImpl_Invoke_CallBack
010febc4 5af28bde mstscax!CTSSimpleComPtrArray<IDispatch>::ComPtrCopyAll+0x6e
010febd0 5ae224b1 mstscax!CTSSimpleComPtrArray<IDispatch>::RemoveAll+0x21, calling mstscax!CTSSimpleArray<IDispatch *,16>::GetNext
010febd8 5ae224ec mstscax!CTSSimpleComPtrArray<IDispatch>::RemoveAll+0x5c, calling mstscax!__security_check_cookie
010febe8 5af292ed mstscax!CProxy_IMsTscAxEvents<CMsTscAx>::Fire_Event+0x253, calling mstscax!CTSSimpleComPtrArray<IDispatch>::RemoveAll
010febf4 5af29316 mstscax!CProxy_IMsTscAxEvents<CMsTscAx>::Fire_Event+0x27c, calling mstscax!__security_check_cookie
010fec1c 5acc23a0 mstscax!CTSUnknown::NonDelegatingAddRef+0x10, calling mstscax!PAL_System_AtomicIncrement
010fec24 5acf3687 mstscax!CAAMessageReceivedEvent::AddRef+0x27
010fec2c 5acf3692 mstscax!CAAMessageReceivedEvent::AddRef+0x32, calling mstscax!__security_check_cookie
010fec38 5afed122 mstscax!CSecLayerNegCompleteEvent::NonDelegatingQueryInterface+0xa2, calling mstscax!CAAMessageReceivedEvent::AddRef
010fec50 5acf386c mstscax!CAAMessageReceivedEvent::QueryInterface+0x2c
010fec54 5acc23a0 mstscax!CTSUnknown::NonDelegatingAddRef+0x10, calling mstscax!PAL_System_AtomicIncrement
010fec74 5afea5ef mstscax!CUI::OnSecurityLayerNegotiationComplete+0x17e, calling mstscax!CTscCredsAssistant::OnSecurityLayerNegotiationComplete
010feca8 5afec267 mstscax!CUI::OnSecurityLayerNegotiationCompleteAsyncCallback::Invoke+0x17, calling mstscax!CUI::OnSecurityLayerNegotiationComplete
010fecb8 5aefb97a mstscax!CTSMsg::Invoke+0xa2
010fece8 5aefd362 mstscax!CTSThread::RunQueueEvent+0xbd, calling mstscax!CTSMsg::Invoke
010fecf8 5af03f04 mstscax!PAL_System_CritSecLeave+0x11, calling ntdll!RtlLeaveCriticalSection
010fed24 5aefd439 mstscax!CTSThread::RunAllQueueEvents+0x6a, calling mstscax!CTSThread::RunQueueEvent
010fed4c 5aefef81 mstscax!CTSThread::OnNotifyThreadEventQueue+0x91, calling mstscax!CTSThread::RunAllQueueEvents
010fed60 5aefefbb mstscax!CTSThread::OnNotifyThreadMessage+0x2b, calling mstscax!CTSThread::OnNotifyThreadEventQueue
010fed70 5aeeeeff mstscax!PAL_System_Win32_ThreadWndProc+0x2f
010fed80 760bbe6b USER32!_InternalCallWinProc+0x2b
010fedac 760b833a USER32!UserCallWinProcCheckWow+0x3aa, calling USER32!_InternalCallWinProc
010fede0 760bab56 USER32!CtfHookProcWorker+0x36
010fedf0 760bab65 USER32!CtfHookProcWorker+0x45, calling USER32!__security_check_cookie
010fedfc 760ba5c1 USER32!CallHookWithSEH+0x2a
010fee08 760bfa76 USER32!_SEH_epilog4_GS+0xa, calling USER32!__security_check_cookie
010fee0c 760ba5d3 USER32!CallHookWithSEH+0x3c, calling USER32!_SEH_epilog4_GS
010fee2c 760b818f USER32!UserCallWinProcCheckWow+0x1ff, calling ntdll!RtlActivateActivationContextUnsafeFast
010fee78 760b905b USER32!_PeekMessage+0x2b, calling win32u!NtUserPeekMessage
010fee94 760b7bee USER32!DispatchMessageWorker+0x20e, calling USER32!UserCallWinProcCheckWow
010feec4 77702b3c win32u!NtUserGetMessage+0xc
010fef10 760b79d0 USER32!DispatchMessageW+0x10, calling USER32!DispatchMessageWorker
010fef1c 6bc4302c (MethodDesc 6ba54a14 +0x3c DomainBoundILStubClass.IL_STUB_PInvoke(MSG ByRef))
010fef38 6bc4302c (MethodDesc 6ba54a14 +0x3c DomainBoundILStubClass.IL_STUB_PInvoke(MSG ByRef))
010fef58 6bbf6ce1 (MethodDesc 6badd7b4 +0x24d System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32)), calling 6bb8e0e4
010fefdc 6bbf68f3 (MethodDesc 6badb688 +0x15f System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext)), calling 01409696
010ff030 6bbf6760 (MethodDesc 6ba528f8 +0x4c System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext)), calling (MethodDesc 6badb688 +0 System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext))
010ff04c 6bbcb801 (MethodDesc 6bad3e6c +0x55 System.Windows.Forms.ApplicationContext.set_MainForm(System.Windows.Forms.Form)), calling 6bb8f1b0
010ff05c 6bbcb7a5 (MethodDesc 6ba52e18 +0x31 System.Windows.Forms.Application.Run(System.Windows.Forms.Form)), calling 6bb8f7b0
010ff074 017e0f17 (MethodDesc 013f6068 +0x37 mRemoteNG.App.ProgramRoot.StartApplication()), calling (MethodDesc 6ba52e18 +0 System.Windows.Forms.Application.Run(System.Windows.Forms.Form))
010ff080 017e0913 (MethodDesc 013f605c +0x5b mRemoteNG.App.ProgramRoot.Main(System.String[])), calling (MethodDesc 013f6068 +0 mRemoteNG.App.ProgramRoot.StartApplication())
...

Looks like Xaml issue?

janis-veinbergs picture janis-veinbergs on 1 Oct 2018
👍1

@janis-veinbergs Thanks for taking the time to test all of that! This helps quite a bit in narrowing things down. Since it seems this wasn't introduced in v1.76 we can proceed with that release.

Unfortunately, we still have the problem of how to prevent these crashes. I went through the RDP code and I think every call has a try/catch block, so we should be capturing these exceptions. It might be time to add exception capturing logic at the root of mRemoteNG to gracefully catch any previously uncaught exception. It doesn't look good when the app completely dies.

sparerd picture sparerd on 6 Oct 2018

Created a ticket to add root-level exception catching to try to prevent this from crashing the app. #1123

sparerd picture sparerd on 6 Oct 2018

@sparerd I suspect this exception won't be caught. I don't know, will have to test when #1123 commit lands, but this is a native thread that throws stack buffer overflow.

https://stackoverflow.com/a/13567016/50173

By the way, it's not even necessary to connect to remote session. Just trying to connect, when credential popup shows up, press esc, repeat 26 times and crash. Could you provide me with with a link at where in the source code it spawns this thread to connect to RDP & Prompt with credential dialog? I would like to try to make a minimal repro and if sucessfull, try submit that to Microsoft.

janis-veinbergs picture janis-veinbergs on 8 Oct 2018

Yea, it doesn't seem likely that we will be able to catch it.

We call the native RDP client here: https://github.com/mRemoteNG/mRemoteNG/blob/d1a7a3790930e9658b7fed30b34c8345c8547c24/mRemoteV1/Connection/Protocol/RDP/RdpProtocol.cs#L187

sparerd picture sparerd on 8 Oct 2018

Reported to Microsoft with a minimal solution that reproduces the issue:
https://developercommunity.visualstudio.com/content/problem/352484/buffer-overflow-within-windowsuixamlhostdll-when-p.html

janis-veinbergs picture janis-veinbergs on 9 Oct 2018
❤5

Great work @janis-veinbergs, thanks for putting that together.

sparerd picture sparerd on 9 Oct 2018
👍1

Removed the bug label and milestone. This was confirmed to be a vendor issue and reported to MS accordingly (another HUGE thanks to @janis-veinbergs for testing/reporting/created proof of concept code).

Users of other applications (RDCMan and RoyalTS) also have the same problems.

Leaving this open for now for tracking purposes, but there's not much else for us to do at this point.

kmscode picture kmscode on 10 Dec 2018

This is more of a feature request but related to this issue.

RDC Manager's "Connect server as..." collects credentials before making initial connection while mRemoteNG's "Connect without credentials" loads the credential dialog that crashes the application. would it be possible to add and option to "Connect As" or "Connect with credentials"

I realize the easy solution to this for me would be to store passwords in the app but the security angel on my shoulder tells me that I should keep my passwords in a password manager outside of the application/windows profile.

smitty0157 picture smitty0157 on 7 Jun 2019

@smitty0157 The credential management feature should solve both of these concerns for you (#208). We are splitting connections/credentials to allow for easy assignment, which will also allowing creds to be imported from different sources (we are getting out of the cred storage business). In addition, there is a "Connect with credential" option which allows you to select a specific cred pair to use.

sparerd picture sparerd on 14 Jun 2019

I don't know where they have this info from, but the folks over at RoyalTS quote this line:

Microsoft acknowledged the bug and according to them, the fix has been approved and it鈥檚 making its way to 19H2 at the moment. Afterwards, it will get ported to 19H1 and RS5.

See https://support.royalapps.com/support/solutions/articles/17000084181-royal-ts-crashing-due-to-windows-ui-xamlhost-dll-when-using-remote-desktop

farosch picture farosch on 19 Sep 2019
🎉1

Guys, @sparerd, @farosch, @kmscode finally this is fixed as of September 26, 2019 update!

Perhaps this line, but not sure:

  • Addresses an issue with MSCTF.dll that causes an application to stop working.

Because there is a CtfHookProcWorker call in callstack. And it is related to Microsoft Text Services Framework

But I may very well be wrong. Anyways, fixed is fixed.

https://developercommunity.visualstudio.com/content/problem/352484/buffer-overflow-within-windowsuixamlhostdll-when-p.html

janis-veinbergs picture janis-veinbergs on 3 Oct 2019
❤1 👍1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

iron51 picture iron51  路  3Comments
mmcnay picture mmcnay  路  4Comments
mattbob-brock picture mattbob-brock  路  3Comments
sparerd picture sparerd  路  3Comments
sparerd picture sparerd  路  4Comments