none
WerFault.exe

    Question

  • WerFault.exe-Application Error
    The Instruction at 0x747193a8 referenced memory at 0x008d23a0.The memory could not be read.
    And The Instruction at 0x747193a8 referenced memory at 0x00492410.The memory could not be read.
    Wednesday, September 25, 2013 4:21 PM

Answers

  • Hi,

    The werfault.exe is used for Windows Error Reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system, Windows features, and applications. It gives you the option to send data about errors to Microsoft and to receive information about solutions. Look in the Event Log which applications crash.

    Try turning it off temporarily and see if this will fix the problem. 
    a. Click Start and type services in start search and press Enter.
    b. Locate Windows Error Reporting service in the services list
    c. Right-click on it and click Properties.
    d. Open "Startup type" list and select "Disabled" and click OK.
    e. Check and see if you are still getting the werfault.exe error.

    If there is no use, You can Make a clean boot to check whether this problem caused by 3<sup>rd</sup> program or service. Refer to the link below for more details.

    http://support.microsoft.com/kb/929135


    Roger Lu
    TechNet Community Support

    Friday, September 27, 2013 10:05 AM

All replies

  • Hi,

    The werfault.exe is used for Windows Error Reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system, Windows features, and applications. It gives you the option to send data about errors to Microsoft and to receive information about solutions. Look in the Event Log which applications crash.

    Try turning it off temporarily and see if this will fix the problem. 
    a. Click Start and type services in start search and press Enter.
    b. Locate Windows Error Reporting service in the services list
    c. Right-click on it and click Properties.
    d. Open "Startup type" list and select "Disabled" and click OK.
    e. Check and see if you are still getting the werfault.exe error.

    If there is no use, You can Make a clean boot to check whether this problem caused by 3<sup>rd</sup> program or service. Refer to the link below for more details.

    http://support.microsoft.com/kb/929135


    Roger Lu
    TechNet Community Support

    Friday, September 27, 2013 10:05 AM
  • The Instruction at 0x747193a8

    Use Event Viewer (or perhaps Reliability Monitor) to see if there is more information about this event, in particular which module it is occurring in.   Otherwise you could try using ProcExp to try to figure it out.  We don't even know which "application" is crashing.  I was going to tell you that in my IE11 iexplore.exe I see nothing loaded at 0x74719000 but that may not be the program that is crashing.



    Robert Aldwinckle
    ---

    Friday, September 27, 2013 7:39 PM
  • I think these error messages highlight how weak the error reporting culture is in Microsoft.

    Since WerFault.exe is an error reporting component, this message leaves you to wonder: Is WerFault.exe reporting to you an error that happened in some other application, or is this an error occurring in the execution of the program WerFault.exe?

    Since the message does not indicate any other program or process, I think it logically must be the latter, that the program WerFault.exe is failing due to a memory fault. The instruction addresses and memory addresses do not usually make sense without a particular application or program, since each program (process) has its own address space, and the instruction address 0x747193a8 (e.g.) would be something completely different if it were in, say, winword.exe. So I conclude that this message means that an instruction belonging to the WerFault.exe program triggered a memory fault. More on that below.

    Still there is another possibility, that the addresses are physical addresses, not virtual addresses. But it is usually not informative to learn that an instruction in a particular physical memory location is making an incorrect or unsuccessful memory access. It would be extremely difficult to find out what application to fix. So I assume that the instruction addresses are virtual addresses.

    But nowadays even virtual addresses are not as informative as they used to. There is a specific type of "vulnerability", or security weakness, where attackers provide malicious data to programs that fail to validate their inputs properly and allow buffer overflows t happen. Attackers carefully craft the input to overflow the program's buffers, overwriting subroutine return addresses with pointers to code contained in the input. This code will make calls to routines in the program. But the attacker needs to know the addresses of the routines he wants to call. Nowadays this is thwarted by "address space randomization". Each time a program is run, the routines are loaded to different places in the virtual address space. But then the information given in this message becomes meaningless.

    Not all programs use such randomization, and I have not checked if Microsoft is using this technique. Therefore, it is possible that the message is meaningful, if randomization is not used. 

    Now, assuming that the instruction address is meaningful, what is this error message actually telling? That the memory location at address 0x008d23a0 could not be read. There are two main reasons for this. We do not know if the program has any memory with that address. There could be a programming error, leading the program to want to access memory locations that were never allocated to the program. Or there could be a hardware fault, where a memory module failed to return the contents of that memory location.

    In the first case, the program WerFault.exe needs to be fixed. The address of the non-readable memory location may be completely random, depending on the nature of the programming fault. Or it could be revealing for a programmer that wants to fix the error,  and knows or has access to a memory map for the program.

    In the second case, the address location is usually meaningless if it is a virtual address. Next time the program is run, it would be loaded to a different part of the physical memory, and it may not use the faulty memory location at all. Instead a different program may have the faulty memory allocated to it, and fail mysteriously, or with similar messages. To find out what memory location to fix, on would (in theory) have to determine in each case, what physical memory was used to carry the specified virtual memory location. But nobody does that. Memory modules are cheap, you do not repair them, you replace them.

    But then there is a third possibility: It could be a physical memory fault, but a transient one. Cosmic radiation, radon gas, and other sources of background radioactivity will randomly hit your memory and change it in unpredictable ways. If you have error correcting memory (more expensive), the memory module will notice and report the random change.  Sometimes it will even know how to fix it, but then it does not report it. But error correcting circuitry is itself prone to failures. I don't know what is the current state of the art in this regard. So I don't know if it is likely that the errors reported above are purely transient.

    To sum up, some guys inside Microsoft may know more about this, but the general "computer expert" has no way of reaching a useful conclusion based on these error messages. The messages simply do not contain the needed information. All you can do, is to replace your computer if you get many such messages. Otherwise ignore them.

    But take home the lesson that computers are not completely reliable. If you build something that can threaten your life if it fails, you must use thorough methods of redundant computing to minimize the risk.

    Tuesday, December 31, 2013 4:20 AM