Garry's Mod crashing to desktop a few minutes after joining server (Ntdll.dll)?

BinaryGreen

Honorable
Dec 23, 2014
61
0
10,530
I've asked this on a couple of forums, Facepunch, the server's forums (who to no avail, did nothing), and Steam. Now that I am looking at Event Logs, I believe this may be a memory leak.

The following is quoted from when I posted on the Facepunch site:

" I've asked the community on Steam, and no one has ever found a solution, and from what they can tell, this may be a first, or a very mysterious bug.

There's one specific server that makes me crash (but usually noone else). I do suffer from lag (low end PC) but I don't believe performance is affecting me too much. I even tried allocating more RAM to gmod through -heapsize, and even after I play for a few minutes on the server, it freezes, then crashes to desktop without any reason. I did find a dump file though, and was wondering if anyone could interpret it, whether it's a serverside bug, too many addons, computer component issues, etc.

The following is quoted from a response through the thread:

"I'm looking at this, and it's really, really odd! It appears the system requested the crash!
ntdll.dll requested the crash, and kernel32.dll induced it. Console logs show nothing but an error message:

Assert( Assertion Failed: !"unexpected split SRC packet" ):socket.cpp:1023"


I tried observing the console, and yet, no major errors were popping up prior to the crash (and would not be able to see any if gmod froze).

After that, I decided to observe task manager. Joining the server, driving around, walking causes a few frame drops (which is normal on my computer), and CPU was running at about 36%, and RAM was at about 4.5 / 5.9 GB RAM. Even when the program was freezing, the RAM seemed to stay in the 4.5-4.8 GB range.

Besides, it is only THAT server, and without any dialog boxes, or reasons, this makes this crash very mysterious. I even scanned for computer viruses, and nothing showed up.

The dump file from a few days ago is here: http://dumps.metastruct.uk.to/dumper...23173122_1.dmp

The game also crashed today while walking around in a building, here is that file: http://dumps.metastruct.uk.to/dumper...49174249_1.dmp

It has happened since the day I joined this server, usually 8-15 minutes after getting onto the server. There are no indicators of the crash either, it's just a frozen game, then back to desktop, nothing.

If anyone could please interpret this further (hopefully further than the guys back on Steam) then thank you! "

Robotboy, one of the lead developers of Garry's Mod, had responded to my post:

" The server might be crashing you on purpose, for example some sort of anti cheat the server might have with a binary module to send malformed packets to your client if you were banned/detected cheating or whatever.

I found your Steam ID ( STEAM_0:0:80096019 ) on some fastdl in hex anticheat logs or whatever

http://fastdl.unitedhosts.org/HAC_Bo...2571271284.txt "

I have never put anything foreign into the Garry's Mod directory nor exploited, but do know that this sort of logging for exploiters has been happening to many people. What I want to know if these two things, the "requested" crash and possibly the anticheat that HeX had been using is correlated. Another user on Steam has recommended a "dummy" for the Awesomium Renderer, which may be causing the issue as well. What I really need to do is not generalize this issue, but find which of the many things I've explained here is the real issue.

I decided to enable the console.log for crashes, but to no avail, no errors were shown: The server might be crashing you on purpose, for example some sort of anti cheat the server might have with a binary module to send malformed packets to your client if you were banned/detected cheating or whatever.

I found your Steam ID ( STEAM_0:0:80096019 ) on some fastdl in hex anticheat logs or whatever

http://fastdl.unitedhosts.org/HAC_Bo...2571271284.txt

I have also found the two following Event Logs, the first being identified as "information" and the second being "error"
1.
Log Name: Application
Source: Windows Error Reporting
Date: 6/23/2016 10:05:49 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: EpicDanny11
Description:
Fault bucket , type 0
Event Name: AppHangB1
Response: Not available
Cab Id: 0

Problem signature:
P1: hl2.exe
P2: 0.0.0.0
P3: 57164c47
P4: b55b
P5: 67246080
P6:
P7:
P8:
P9:
P10:

Attached files:
C:\Users\danny_000\AppData\Local\Temp\WER80A3.tmp.version.xml
C:\Users\danny_000\AppData\Local\Temp\WER80D3.tmp.xml
C:\Users\danny_000\AppData\Local\Temp\WER8122.tmp.WERInternalMetadata.xml
WERGenerationLog.txt

These files may be available here:
C:\Users\danny_000\AppData\Local\Microsoft\Windows\WER\ReportQueue\Critical_hl2.exe_59535203c98f6cff0847ad1d40fbd7132ab4c9_06a7b3cd_cab_1abe822a

Analysis symbol:
Rechecking for solution: 0
Report Id: 2a0678af-39b0-11e6-86bc-008cfa77a23b
Report Status: 131076
Hashed bucket:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-06-24T02:05:49.000000000Z" />
<EventRecordID>149763</EventRecordID>
<Channel>Application</Channel>
<Computer>EpicDanny11</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>0</Data>
<Data>AppHangB1</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>hl2.exe</Data>
<Data>0.0.0.0</Data>
<Data>57164c47</Data>
<Data>b55b</Data>
<Data>67246080</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
C:\Users\danny_000\AppData\Local\Temp\WER80A3.tmp.version.xml
C:\Users\danny_000\AppData\Local\Temp\WER80D3.tmp.xml
C:\Users\danny_000\AppData\Local\Temp\WER8122.tmp.WERInternalMetadata.xml
WERGenerationLog.txt</Data>
<Data>C:\Users\danny_000\AppData\Local\Microsoft\Windows\WER\ReportQueue\Critical_hl2.exe_59535203c98f6cff0847ad1d40fbd7132ab4c9_06a7b3cd_cab_1abe822a</Data>
<Data>
</Data>
<Data>0</Data>
<Data>2a0678af-39b0-11e6-86bc-008cfa77a23b</Data>
<Data>131076</Data>
<Data>
</Data>
</EventData>
</Event>

2.

Log Name: Application
Source: Application Hang
Date: 6/23/2016 10:05:49 PM
Event ID: 1002
Task Category: (101)
Level: Error
Keywords: Classic
User: N/A
Computer: EpicDanny11
Description:
The program hl2.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1154
Start Time: 01d1cdac97181185
Termination Time: 4294967295
Application Path: C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
Report Id: 2a0678af-39b0-11e6-86bc-008cfa77a23b
Faulting package full name:
Faulting package-relative application ID:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Hang" />
<EventID Qualifiers="0">1002</EventID>
<Level>2</Level>
<Task>101</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-06-24T02:05:49.000000000Z" />
<EventRecordID>149764</EventRecordID>
<Channel>Application</Channel>
<Computer>EpicDanny11</Computer>
<Security />
</System>
<EventData>
<Data>hl2.exe</Data>
<Data>0.0.0.0</Data>
<Data>1154</Data>
<Data>01d1cdac97181185</Data>
<Data>4294967295</Data>
<Data>C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe</Data>
<Data>2a0678af-39b0-11e6-86bc-008cfa77a23b</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>54006F00700020006C006500760065006C002000770069006E0064006F0077002000690073002000690064006C00650000000000</Binary>
</EventData>
</Event>

Now, people have been telling me that this is an error correlating to ntdll.dll, and was wondering if that is really the case, and if so, how can I fix or repair the .dll?

Thank you,

Daniel