We Keep Coding

UIAutomation throws AccessViolationException on Windows 11

The issue:
We have an application written in C# that uses UIAutomation to get the current text (either selected or the word behind the carret) in other applications (Word, OpenOffice, Notepad, etc.).
All is working great on Windows 10, even up to 21H2, last update check done today.
But we had several clients informing us that the application is closing abruptly on Windows 11.
After some debugging I've seen some System.AccessViolationException thrown when trying to use the TextPatternRange.GetText() method:
System.AccessViolationException: 'Attempted to read or write protected memory. This is often an indication that other memory is corrupt.'
What we've tried so far:
Setting uiaccess=true in manifest and signing the app : as mentionned here https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/350ceab8-436b-4ef1-8512-3fee4b470c0a/problem-with-manifest-and-uiaccess-set-to-true?forum=windowsgeneraldevelopmentissues => no changes (app is in C:\Program Files\
In addition to the above, I did try to set the level to "requireAdministrator" in the manifest, no changes either
As I've seen that it may come from a bug in Windows 11 (https://forum.emclient.com/t/emclient-9-0-1317-0-up-to-9-0-1361-0-password-correction-crashes-the-app/79904), I tried to install the 22H2 Preview release, still no changes.
Reproductible example
In order to be able to isolate the issue (and check it was not something else in our app that was causing the exception) I quickly made the following test (based on : How to get selected text of currently focused window? validated answer)
private void btnRefresh_Click(object sender, RoutedEventArgs e)
{
var p = Process.GetProcessesByName("notepad").FirstOrDefault();
var root = AutomationElement.FromHandle(p.MainWindowHandle);
var documentControl = new
PropertyCondition(AutomationElement.ControlTypeProperty,
ControlType.Document);
var textPatternAvailable = new PropertyCondition(AutomationElement.IsTextPatternAvailableProperty, true);
var findControl = new AndCondition(documentControl, textPatternAvailable);
var targetDocument = root.FindFirst(TreeScope.Descendants, findControl);
var textPattern = targetDocument.GetCurrentPattern(TextPattern.Pattern) as TextPattern;
string text = "";
foreach (var selection in textPattern.GetSelection())
{
text += selection.GetText(255);
Console.WriteLine($"Selection: \"{selection.GetText(255)}\"");
}
lblFocusedProcess.Content = p.ProcessName;
lblSelectedText.Content = text;
}
When pressing a button, this method is called and the results displayed in labels.
The method uses UIAutomation to get the notepad process and extract the selected text.
This works well in Windows 10 with latest update, crashes immediately on Windows 11 with the AccessViolationException.
On Windows 10 it works even without the uiaccess=true setting in the manifest.
Questions/Next steps
Do anyone know/has a clue about what can cause this?
Is Windows 11 way more regarding towards UIAutomation?
On my side I'll probably open an issue by Microsoft.
And one track we might follow is getting an EV and sign the app itself and the installer as it'll also enhance the installation process, removing the big red warnings. But as this is an app distributed for free we had not done it as it was working without it.
I'll also continue testing with the reproductible code and update this question should anything new appear.

I posted the same question on MSDN forums and got this answer:
https://learn.microsoft.com/en-us/answers/questions/915789/uiautomation-throws-accessviolationexception-on-wi.html
Using IUIautomation instead of System.Windows.Automation works on Windows 11.
So I'm marking this as solved but if anyone has another idea or knows what happens you're welcome to comment!

How to prevent modules from getting attached to my application process? C#

For Example: I have installed an application called "RivaTuner Statistics Server v6.6.0" which has made for gamers to show FPS mark on games, since WPF apps are using DirectX, this program attaches a module to my WPF app by mistake which makes it crash (without giving any exceptions) before my app gets loaded, and when I close that program, my app works just fine!
I've fixed this problem by setting RenderOptions.ProcessRenderMode = RenderMode.SoftwareOnly
I also have the same problem with BitDefender antivirus, my program is a VPN Connection software that uses Proxifier app to set global proxy.. When my app begins to start Proxifier process, my app crashes without any exceptions.. by the way BitDefender doesn't detect Proxifier or my app as a virus or threat, it just makes my app crash and Proxifier continues to work without any problem. (Which whitelisting my app got the problem solved).
What I want to know generally, is there any way to prevent DLL injection or stopping it after it attached?
Here is the provided information by EventViewer:
Version=1
EventType=APPCRASH
EventTime=131414331835897163
ReportType=2
Consent=1
UploadTime=131414331849773927
ReportStatus=393
ReportIdentifier=c52be1e0-6378-4555-bddc-cd49f22e98d4
IntegratorReportIdentifier=e415e187-7b4d-4689-92a7-5522957c6300
Wow64Host=34404
NsAppName=TurboVPN.exe
AppSessionGuid=000037d0-0001-0015-6d89-3176a3e0d201
TargetAppId=W:00065bd30e4a6caee77eb9ec126f39eeb11200000000!000072443a77ce17608085aa75f649187cf7129fd9a8!TurboVPN.exe
TargetAppVer=2017//06//08:20:58:47!0!TurboVPN.exe
BootId=4294967295
TargetAsId=3395
Response.BucketId=c2e6858b6015d605f3dea6f209e5a680
Response.BucketTable=4
Response.LegacyBucketId=120776215139
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=TurboVPN.exe
Sig[1].Name=Application Version
Sig[1].Value=8.0.0.0
Sig[2].Name=Application Timestamp
Sig[2].Value=5939ba87
Sig[3].Name=Fault Module Name
Sig[3].Value=d3d9.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=10.0.15063.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=631de416
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=000000000000fd0c
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.15063.2.0.0.256.4
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=9b4f
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=9b4f78d83ca7cfa07fe4d1531372a428
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=9991
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=99915f8f3f68939dc06e64d116ece58a
UI[2]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
UI[3]=TurboVPN has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\WINDOWS\SYSTEM32\MSCOREE.DLL
LoadedModule[3]=C:\WINDOWS\System32\KERNEL32.dll
LoadedModule[4]=C:\WINDOWS\System32\KERNELBASE.dll
LoadedModule[5]=C:\Program Files\Bitdefender\Bitdefender 2017\Active Virus Control\Avc3_00125_004\avcuf64.dll
LoadedModule[6]=C:\WINDOWS\SYSTEM32\apphelp.dll
LoadedModule[7]=C:\WINDOWS\System32\ADVAPI32.dll
LoadedModule[8]=C:\WINDOWS\System32\msvcrt.dll
LoadedModule[9]=C:\WINDOWS\System32\sechost.dll
LoadedModule[10]=C:\WINDOWS\System32\RPCRT4.dll
LoadedModule[11]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
LoadedModule[12]=C:\WINDOWS\System32\SHLWAPI.dll
LoadedModule[13]=C:\WINDOWS\System32\combase.dll
LoadedModule[14]=C:\WINDOWS\System32\ucrtbase.dll
LoadedModule[15]=C:\WINDOWS\System32\bcryptPrimitives.dll
LoadedModule[16]=C:\WINDOWS\System32\GDI32.dll
LoadedModule[17]=C:\WINDOWS\System32\gdi32full.dll
LoadedModule[18]=C:\WINDOWS\System32\msvcp_win.dll
LoadedModule[19]=C:\WINDOWS\System32\USER32.dll
LoadedModule[20]=C:\WINDOWS\System32\win32u.dll
LoadedModule[21]=C:\WINDOWS\System32\IMM32.DLL
LoadedModule[22]=C:\WINDOWS\System32\kernel.appcore.dll
LoadedModule[23]=C:\WINDOWS\SYSTEM32\VERSION.dll
LoadedModule[24]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
LoadedModule[25]=C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll
LoadedModule[26]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\59ea37125345a946fbfb8868aa11ed27\mscorlib.ni.dll
LoadedModule[27]=C:\WINDOWS\System32\ole32.dll
LoadedModule[28]=C:\WINDOWS\system32\uxtheme.dll
LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll
LoadedModule[30]=C:\WINDOWS\SYSTEM32\WINMM.dll
LoadedModule[31]=C:\WINDOWS\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9279_none_08e667efa83ba076\MSVCR90.dll
LoadedModule[32]=C:\WINDOWS\SYSTEM32\WINMMBASE.dll
LoadedModule[33]=C:\WINDOWS\System32\cfgmgr32.dll
LoadedModule[34]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\4b4b69a2aa9b596c8b8e7a32267eac35\System.ni.dll
LoadedModule[35]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\d4035216edd875be919d339859343a6c\System.Core.ni.dll
LoadedModule[36]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\WindowsBase\d6053a0b7badab04868dc6e51ab4c02e\WindowsBase.ni.dll
LoadedModule[37]=C:\WINDOWS\SYSTEM32\CRYPTSP.dll
LoadedModule[38]=C:\WINDOWS\system32\rsaenh.dll
LoadedModule[39]=C:\WINDOWS\SYSTEM32\bcrypt.dll
LoadedModule[40]=C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
LoadedModule[41]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\PresentationCore\b5bfbcf78210cf783ff665fea098ebfa\PresentationCore.ni.dll
LoadedModule[42]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\73dece296df0b44862aa59e1f73825c3\PresentationFramework.ni.dll
LoadedModule[43]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xaml\44f34f029c456762dba3d085d6b9fa9c\System.Xaml.ni.dll
LoadedModule[44]=C:\WINDOWS\SYSTEM32\dwrite.dll
LoadedModule[45]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll
LoadedModule[46]=C:\WINDOWS\System32\OLEAUT32.dll
LoadedModule[47]=C:\WINDOWS\SYSTEM32\MSVCP120_CLR0400.dll
LoadedModule[48]=C:\WINDOWS\SYSTEM32\D3DCOMPILER_47.dll
LoadedModule[49]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll
LoadedModule[50]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
LoadedModule[51]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\9f298b9fdf9d3d88c051ba8d0cfcdd98\System.Configuration.ni.dll
LoadedModule[52]=C:\WINDOWS\SYSTEM32\urlmon.dll
LoadedModule[53]=C:\WINDOWS\System32\shcore.dll
LoadedModule[54]=C:\WINDOWS\System32\windows.storage.dll
LoadedModule[55]=C:\WINDOWS\System32\powrprof.dll
LoadedModule[56]=C:\WINDOWS\System32\profapi.dll
LoadedModule[57]=C:\WINDOWS\SYSTEM32\iertutil.dll
LoadedModule[58]=C:\WINDOWS\SYSTEM32\SspiCli.dll
LoadedModule[59]=C:\WINDOWS\SYSTEM32\msiso.dll
LoadedModule[60]=C:\WINDOWS\SYSTEM32\PROPSYS.dll
LoadedModule[61]=C:\WINDOWS\System32\shell32.dll
LoadedModule[62]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\246b8fa70f43db970414bb4119fe629f\System.Xml.ni.dll
LoadedModule[63]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\9ed83e5a61548d2d78bc4b7a667e9139\System.Runtime.Remoting.ni.dll
LoadedModule[64]=C:\WINDOWS\System32\ws2_32.dll
LoadedModule[65]=C:\WINDOWS\system32\mswsock.dll
LoadedModule[66]=C:\WINDOWS\system32\dwmapi.dll
LoadedModule[67]=C:\WINDOWS\System32\MSCTF.dll
LoadedModule[68]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Drawing\763d0ca89a77cfd983874efe156a9296\System.Drawing.ni.dll
LoadedModule[69]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\d63d7f874bb64e51ee0ef09cc99218f6\System.Windows.Forms.ni.dll
LoadedModule[70]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Security\35f9d2604274a3e8fbf814e10789dc51\System.Security.ni.dll
LoadedModule[71]=C:\WINDOWS\System32\crypt32.dll
LoadedModule[72]=C:\WINDOWS\System32\MSASN1.dll
LoadedModule[73]=C:\WINDOWS\SYSTEM32\DPAPI.dll
LoadedModule[74]=C:\WINDOWS\SYSTEM32\WindowsCodecs.dll
LoadedModule[75]=C:\WINDOWS\SYSTEM32\d3d9.dll
LoadedModule[76]=C:\WINDOWS\SYSTEM32\igdumdim64.dll
LoadedModule[77]=C:\WINDOWS\System32\SETUPAPI.dll
LoadedModule[78]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca#\248dd0bba3037acdc2ab60513b34c3f2\PresentationFramework.Aero2.ni.dll
LoadedModule[79]=C:\WINDOWS\SYSTEM32\WtsApi32.dll
LoadedModule[80]=C:\WINDOWS\SYSTEM32\WINSTA.dll
LoadedModule[81]=C:\WINDOWS\System32\clbcatq.dll
LoadedModule[82]=C:\WINDOWS\system32\dataexchange.dll
LoadedModule[83]=C:\WINDOWS\system32\d3d11.dll
LoadedModule[84]=C:\WINDOWS\system32\dcomp.dll
LoadedModule[85]=C:\WINDOWS\system32\dxgi.dll
LoadedModule[86]=C:\WINDOWS\system32\twinapi.appcore.dll
LoadedModule[87]=C:\WINDOWS\SYSTEM32\igdusc64.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
File[0].CabName=Report.zip
File[0].Path=Report.zip
File[0].Flags=196608
File[0].Type=11
File[0].Original.Path=\\?\C:\WINDOWS\system32\Report.zip
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=TurboVPN
AppPath=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=ED5A83A5552697FBE579A0CAAEF2FF9E
MetadataHash=1411986728
If you take a look, you can see the attached module LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll

Preventing the DLL injection technique that this software uses completely defeats the point of using it. It has to do this, the only way it can wire itself into the DirectX render pipeline to display the statistics. That this ends up poorly and crashes your program with a completely undiagnosable AccessViolationException is quite normal. It takes just one change in an internal function that is not part of the documented API, the kind that the utility has to "hook", and the show is over.
It could be fixable, but that has to be done by the author of this utility. It is just one guy, a Russian master-hacker. Hard to get in touch with, his life can't possibly easy lately with Win10 updates arriving at a high rate these days.
You need to consider getting ahead by uninstalling it. There are other ways to accomplish the same thing, ways that are much less brittle, supported and dedicated to WPF. Use the WPF Performance Suite.

AFAIK, there are quite a few ways of preventing other processes to attach to your process.
Basically, there are two well-known approaches to attach to external process:
Debugging the external process
Injecting a thread to that process
you can overcome the first method by implementing one of anti-debug methods(There are a lot of these methods on the internet. An example would be to debug your own process )
To prevent other processes to inject thread to your process, you can set some hooks on CreateRemoteThread or LoadLibrary and initiate a procedure before they attach to your process.

Did you tried to catch exceptions during the initializecomponents function? Since this happens during the window drawing, you can try this:
public MainWindow()
{
try{
InitializeComponent();
//you remaining code
}
catch(Exception ex){
Console.Out.Writeline(ex.Message);
}
}
Also, you can try to subscribe to _Application.DispatcherUnhandledException_ and _AppDomain.CurrentDomain.UnhandledException_ that can give you more info about the application crash exception.

Strange error while impersonating other user

this is next step after
How to run wpf(c#) application by service account and integrated security
I created impersonation successfully, but i am getting some really strange error.
Let me explain situation:
My app is WPF
I have 2 users, my local account (localUser) and service account (saUser).
I am using Frame.Navigate() function to show diferent modules in my frame
I open app with localuser and then impersonate saUser
When i run my app with localUser it works OK (with local admin rights and without)
When i run my app with saUser i am getting this error, no mather if saUser is local admin or not, and the funniest thing is i get error when Navigate(...) is called 2nd time!, first time it works normal... :)
Requested registry access is not allowed.
stackTrace:
at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)
at System.Windows.Application.GetSystemSound(String soundName)
at System.Windows.Application.PlaySound(String soundName)
at System.Windows.Application.FireNavigating(NavigatingCancelEventArgs e, Boolean isInitialNavigation)
at System.Windows.Navigation.NavigationService.FireNavigating(Uri source, Object bp, Object navState, WebRequest request)
at System.Windows.Navigation.NavigationService.HandleNavigating(Uri source, Object content, Object navState, WebRequest newRequest, Boolean navigateOnSourceChanged)
at System.Windows.Navigation.NavigationService.Navigate(Uri source, Object navigationState, Boolean sandboxExternalContent, Boolean navigateOnSourceChanged)
at System.Windows.Navigation.NavigationService.Refresh()
at MyApp.MyNavigation.Navigate(Module modul, Boolean reverse) -> my function
Guyz help, any suggestions? i don't know what is going on...
If i wasn't clear enough ask me...
EDIT:
I am adding some code like asked, just small peace of it where error happens:
I have public static class for navigation
MainWindow mainWin = Application.Current.Windows.Cast<Window>().FirstOrDefault(window => window is MainWindow) as MainWindow;
current <- currentlly selected module
mainFrame <- frame that is showing all pages
// if current module if already selected refresh frame content
if (current.Link == mainWin.mainFrame.NavigationService.CurrentSource.ToString()) mainWin.mainFrame.Refresh();
// else show page content in frame
else mainWin.mainFrame.NavigationService.Navigate(new Uri(current.acLink, UriKind.Relative));
Error happens on Refresh() and Navigate().

I am facing same issue. Is there any solution to this?
There is an article related to how to access HKCU reg key, however it applies to code owned by us & not applicable to for WPF since its code is owned by Microsoft.
[Edit]
My observation is that if WPF user control/Window is initialized prior to impersonation then later on after impersonation there is no issue about how many times they get created; no error is thrown. Can this be done as a workaround?.

GetPrintJobInfoCollection() Exception sometimes

This code that might seem useless it reproduces the problem. Another application is using
http://printqueuewatch.codeplex.com/ to be notified when a print job is sent to printer.
It works but sometimes when you send a print job it crashes here GetPrintJobInfoCollection.
I have pasted the inner exception. To reproduce I send with Notepad++ or my application a small text file about 20 times until i get a crash.
If after the crash I call GetPrintJobInfoCollection it works successfully or I retry.
Any suggestion how to fix this ?
while (true)
{
Thread.Sleep(10);
LocalPrintServer server = new LocalPrintServer();
var q = server.GetPrintQueue("vp1");
q.Refresh();
// Debug.WriteLine(q.IsBusy);
PrintJobInfoCollection infos = null;
infos = q.GetPrintJobInfoCollection();
}
Error in
System.NullReferenceException was unhandled Message=Object reference
not set to an instance of an object. Source=System.Printing
StackTrace:
at MS.Internal.PrintWin32Thunk.AttributeNameToInfoLevelMapping.InfoLevelCoverageList.Release()
at MS.Internal.PrintWin32Thunk.EnumDataThunkObject.GetPrintSystemValuesPerPrintJobs(PrintQueue
printQueue, Queue`1 printObjectsCollection, String[] propertyFilter,
UInt32 firstJobIndex, UInt32 numberOfJobs)
at System.Printing.PrintJobInfoCollection..ctor(PrintQueue printQueue, String[] propertyFilter)
at System.Printing.PrintQueue.GetPrintJobInfoCollection()
at WpfApplication7.MainWindow.button2_Click(Object sender, RoutedEventArgs e) in

According to this MSDN article you shouldn't use System.Printing namespace.
Classes within the System.Printing namespace are not supported for use
within a Windows service or ASP.NET application or service. Attempting
to use these classes from within one of these application types may
produce unexpected problems, such as diminished service performance
and run-time exceptions. If you want to print from a Windows Forms
application, see the System.Drawing.Printing namespace.
I am thinking that your problem is due to resource leak. The LocalPrintServer class seems to be an unmanaged resource and needs to be disposed.

Window Service Getting Hanged on Starting

I have written a Windows service which is logging user activities of the Windows system and makes a REST API request to the server for preserving data..
But I am facing the issue that when the system starts it causes the user System to hang.
Window Application log Reports:
Version=1
EventType=ServiceHang
EventTime=130095268907958116
ReportType=3
Consent=1
UploadTime=130123814084883007
ReportIdentifier=6fe19abe-9ce8-11e2-afdf-00218508c07c
Response.BucketId=6956ff7a549827f0fa19859393538633
Response.BucketTable=5
Response.LegacyBucketId=-743991677
Response.type=4
Sig[0].Name=Service Name
Sig[0].Value=DMAService
Sig[1].Name=Image Name
Sig[1].Value=Com.Altair.DMA.DMAService.exe"
Sig[2].Name=Image Version
Sig[2].Value=0.0.0.0
Sig[3].Name=Service Type
Sig[3].Value=10
Sig[4].Name=Start Type
Sig[4].Value=2
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.2.9200.2.0.0.768.101
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
LoadedModule[0]=C:\Program Files\Altair Engineering Inc\DMAService\Com.Altair.DMA.DMAService.exe
LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\WINDOWS\SYSTEM32\MSCOREE.DLL
LoadedModule[3]=C:\WINDOWS\system32\KERNEL32.dll
LoadedModule[4]=C:\WINDOWS\system32\KERNELBASE.dll
LoadedModule[5]=C:\WINDOWS\system32\ADVAPI32.dll
LoadedModule[6]=C:\WINDOWS\system32\msvcrt.dll
LoadedModule[7]=C:\WINDOWS\SYSTEM32\sechost.dll
LoadedModule[8]=C:\WINDOWS\system32\RPCRT4.dll
LoadedModule[9]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
LoadedModule[10]=C:\WINDOWS\system32\SHLWAPI.dll
LoadedModule[11]=C:\WINDOWS\system32\USER32.dll
LoadedModule[12]=C:\WINDOWS\system32\GDI32.dll
LoadedModule[13]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
LoadedModule[14]=C:\WINDOWS\SYSTEM32\MSVCR110_CLR0400.dll
LoadedModule[15]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\374a0cc6603f58864831897ef723bd4a\mscorlib.ni.dll
LoadedModule[16]=C:\WINDOWS\system32\ole32.dll
LoadedModule[17]=C:\WINDOWS\SYSTEM32\combase.dll
LoadedModule[18]=C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
LoadedModule[19]=C:\WINDOWS\SYSTEM32\bcryptPrimitives.dll
LoadedModule[20]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
LoadedModule[21]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\a7811936e59aaee26b1d9d467174d6d4\System.ni.dll
LoadedModule[22]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\1f3dbc5b0a874bf49a4559e71274f8ba\System.ServiceProcess.ni.dll
LoadedModule[23]=C:\WINDOWS\SYSTEM32\VERSION.dll
LoadedModule[24]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\cb1bedf1f9e8972aa76ad73f725b964b\System.Management.ni.dll
LoadedModule[25]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\05cc6faa6704d01e78700561b22937e3\System.Configuration.ni.dll
LoadedModule[26]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\e1ec8b9a6d4f9af9d6065c4187fb1b5f\System.Xml.ni.dll
LoadedModule[27]=C:\WINDOWS\SYSTEM32\CRYPTSP.dll
LoadedModule[28]=C:\WINDOWS\system32\rsaenh.dll
LoadedModule[29]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
LoadedModule[30]=C:\WINDOWS\system32\OLEAUT32.dll
LoadedModule[31]=C:\WINDOWS\SYSTEM32\clbcatq.dll
LoadedModule[32]=C:\WINDOWS\system32\wbem\wmiutils.dll
LoadedModule[33]=C:\WINDOWS\SYSTEM32\wbemcomn.dll
LoadedModule[34]=C:\WINDOWS\system32\WS2_32.dll
LoadedModule[35]=C:\WINDOWS\system32\NSI.dll
LoadedModule[36]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\0247de206c1c48ac4f8b55df16468405\System.Core.ni.dll
LoadedModule[37]=C:\WINDOWS\system32\wbem\wbemprox.dll
LoadedModule[38]=C:\WINDOWS\system32\wbem\wbemsvc.dll
LoadedModule[39]=C:\WINDOWS\system32\wbem\fastprox.dll
LoadedModule[40]=C:\WINDOWS\SYSTEM32\rasapi32.dll
LoadedModule[41]=C:\WINDOWS\SYSTEM32\rasman.dll
LoadedModule[42]=C:\WINDOWS\SYSTEM32\rtutils.dll
LoadedModule[43]=C:\WINDOWS\system32\mswsock.dll
LoadedModule[44]=C:\WINDOWS\SYSTEM32\winhttp.dll
LoadedModule[45]=C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
LoadedModule[46]=C:\WINDOWS\SYSTEM32\WINNSI.DLL
LoadedModule[47]=C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL
LoadedModule[48]=C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL
State[0].Key=Transport.DoneStage1
State[0].Value=1
State[1].Key=Headless.2ndLevelConsentNeeded
State[1].Value=1
File[0].CabName=WERInternalMetadata.xml
File[0].Path=WER756D.tmp.WERInternalMetadata.xml
File[0].Flags=327682
File[0].Type=5
File[0].Original.Path=C:\Windows\Temp\WER756D.tmp.WERInternalMetadata.xml
File[1].CabName=memory.hdmp
File[1].Path=WER761A.tmp.hdmp
File[1].Flags=2162688
File[1].Type=3
File[1].Original.Path=C:\Windows\Temp\WER761A.tmp.hdmp
File[2].CabName=minidump.mdmp
File[2].Path=WERAEA7.tmp.mdmp
File[2].Flags=2359298
File[2].Type=2
File[2].Original.Path=C:\Windows\Temp\WERAEA7.tmp.mdmp
FriendlyEventName=Service Hang Report
ConsentKey=ServiceHang
AppName=DMAService
AppPath="C:\Program Files\Altair Engineering Inc\DMAService\Com.Altair.DMA.DMAService.exe"
ReportDescription=Service DMA Service hung on starting
But I am not able to decipher what is cause making service to hang at warm boot (the service is running in elevated permission).
Can I debug my service when the system starts?