Strange tcc.exception.log

[vefatica]

I don't remember what I was doing at 23:54 on 2017-04-18, but at that time I got a strange tcc.exception.log. It's strange because
(1) it's in "c:\ProgramData\JP Software\Take Command 21". Normally exception logs go into TCC's home directory.
(2) it's 19 MB with 92,243 lines, all but the first lines being identical except for the time stamp. Here are the first, second, and last lines.

[2017/04/18 23:52:39.226] ..\tcc\ntinit.cpp:346 wmain()  SEH Exception: 0x5D77C876 - ACCESS_VIOLATION
[2017/04/18 23:52:39.226] ..\tcc\ntinit.cpp:346 wmain()  SEH Exception: 0x5D77E159 - ACCESS_VIOLATION
[2017/04/18 23:53:21.206] ..\tcc\ntinit.cpp:346 wmain()  SEH Exception: 0x5D77E159 - ACCESS_VIOLATION

The file is stamped 23:54, a little odd since its last line is stamped 23:53:21.

The file is Unicode but has no BOM (normal?). HEAD. TAIL, and TYPE all choke on it. In the same directory is a tcmd.exception.log, empty except for a BOM.

Is there a sure-fire way to get TCC to write an exception log? I'd like to test where it actually goes.

 

[rconn]

The exception log in v21 is written to \programdata to avoid permission problems when writing to \program files.

TCC *always* writes an exception log at startup. It's empty (other than a BOM) until an internal (fatal) exception occurs. But 99% of the exceptions these days are coming from Windows or third-party injected dll's, so it's rare to actually get an exception log that contains anything.

In your log file, something else (not TCC) is throwing the exception; TCC is catching it & logging it.

 

[vefatica]

90,000 times in 42 seconds? And if there was a BOM there when it was created, it was overwritten.

 

[rconn]

Assuming you weren't running something at the time, then it was happening when TCC was waiting for a keystroke. Lots of apps inject themselves there.

 

[vefatica]

And if that's an address that's logged, it's in MSHTML.DLL.

 

[vefatica]

I just tested several times. If tcc.exception.log does not exist, TCC creates it without a BOM; likewise tcmd.exception.log. moments ago, I deleted both with v20 and started TCMD21.

 

[rconn]

No. The log file is created with a BOM; but you're looking at an open file that Windows hasn't updated the directory entry for yet. Close the TCMD session and you'll see the files are 2 bytes with a BOM.

 

[vefatica]

No. The log file is created with a BOM; but you're looking at an open file that Windows hasn't updated the directory entry for yet. Close the TCMD session and you'll see the files are 2 bytes with a BOM.

The file I mentioned at the beginning of this thread did not have a BOM.