Etch Invocation Errors

Recoverable Code Discovery Errors

Dubious instruction following call...backing off.

Etch tries to detect calls that never return (generated by some compilers, such as Visual Basic and IBM Visual Age). This is an informational message; while Etch handles most such situations, some programs that generate such code may fail when Etched.

Warning: Ignoring a Segment memory ref at x

Etch does not compute effective addresses for instructions that use the CS, FS, or GS segment registers. No action is required. A small number of data references will not be seen at runtime. In practice these all seem to be references to FS:[00000000].

- RVA x is a legal PC, but is used as a pointer to data.
n occurrences, only m occurrences handled
- RVA x is a legal PC, but is used as a pointer to data.
all n occurrences were handled successfully,
This indicates that the etched version of this program may not run properly.

This series of messages could indicate a problem in code discovery, or, more likely, that this program reads its own program text. Programs that read their own text can be patched. In some cases they can be etched successfully, if Etch can find and correct all uses of the pointer, but a program with this behavior should be considered suspect. If the problem is in code discovery (i.e. the source or target of the reference is actually in data, not code), then using less aggressive code discovery may solve the problem, though at the cost of leaving more instructions uninstrumented.

Info: String is likely a series of pushes

Some executables and a number of DLLs contain strings embedded in the text section. Etch tries to detect these strings and treat them as data. However, some code sequences can look like a short string; Etch is telling you that it found such a sequence with this message. It is informational only, and in no way implies that the module cannot be etched.

Fatal Code Discovery Errors

Fatal code discovery errors result in modules that either can not, or should not be etched. If these occur in an executable or DLL of yours, you will need to mark the component as either "patch, but not etch" or "no patch, and no etch" from the Modules menu. Please report the failure to the developers, as it indicates a bug in Etch.

- ExtractBits: Out of bounds access
- InstallBits: Out of bounds access

Etch tried to incorrectly access an internal data structure corresponding to the text section. The module should not be etched.

- Fatal error: File pointer not in text
- Fatal error: Virtual address not in text

Etch tried to incorrectly access data in the mapped module outside of the boundaries of any text sections. The module should not be etched.

- Oh no, jumped to data
- Oh no, jumped to illegal inst
- Internal Etch error: tried marking byte twice.

These errors correspond to conflicting interpretations of the bytes in the text section of the module being etched. Etch reached a byte in the text section via two different control paths, and on the second path it wanted to interpret the byte differently than it had on the first path. In the first case, Etch had originally considered the byte data but now thinks it should be code. In the second case, Etch followed a control path to bytes that could not be interpreted as a valid instruction. In the third case, Etch found internal bytes of an instruction marked as code (or data) without the first byte being marked; this typically corresponds to a module that contains a control path that jumps into the middle of another instruction. In all cases, the module should not be etched.

Failed to map pc to a basic block.

While instrumenting basic blocks, Etch tried to map a PC value to an unknown basic block. This reflects an internal inconsistency between the Etch instrumentation engine and the code discovery engine. The module should not be etched.

- OpenInfile: not a valid executable (failure)
- OpenInfile: not a PE00 executable (failure)

Etch only works on 32-bit x86 Windows 95 and Windows NT binaries. The target application is either not a valid executable, or is in some other executable format (such as a 16-bit executable.) Do not etch or patch this module.

Etch requires relocation records (failure)

Etch does not work on binaries that have their relocation records stripped. Do not etch or patch this module.

Unrecognized relocation x

This module has a non-standard relocation format unrecognized by etch. Do not etch or patch this module.

Failure: Address out of range (131L)

This module contains a static pointer into some other DLL's address space. Do not etch or patch this module.

Etch encountered an unhandled exception while instrumenting this program.

A tool-specific instrumentation routine caused an exception while instrumenting some object (instruction, basic block, procedure, etc.). A typical exception is caused by dereferencing a bad pointer. Either fix the tool, or do not apply this tool to the module for which the error occurred. You should still patch the module.

Etch encountered an unhandled exception while instrumenting this program.
rva %lx not in program, rva
Warning: IndexOfSection(%lx) is before first section.,rva
Warning, can't find section for %lx, rva

How can you have forwarders if the import table is not bound?
Import descriptor has no thunks
Must have OriginalFirstThunk in unbound import table
Exports:: Ordinal out of bounds
Warning, no OriginalFirstThunk for x
Warning, skipping import by ordinal

Etch has discovered an import table format that it does not entirely understand. Do not etch or patch the module.

- Can't handle files with goofy SizeOfRawData fields yet
- First section and headers overlap
- Changed size of original section
- Buffer: streams added out of order.
- Hope you don't mind changing section 0's VMBase from x to y
- CorrectOffsets: PointerToRelocations non-zero.

The target program has an executable file header that Etch cannot understand. Do not etch or patch the module.

- Unknown register, may be disassembling data (pc x)
- Illegal scale n, hopefully data (pc x)
- Incorrect jump offset in REP
- Illegal width field
- RegisterOffset: r out of range

This indicates a bug in the decoder, or that code discovery misidentified data as code. You may continue to etch and patch this module, although if your program fails, the offending module may be the one that caused this error message.

RealReg: Offset to SP too large

Etch's assumption that data saved on the stack is within 128 bytes failed. Possible cause: saving floating point state (-Cf command line option) Possibly don't save floating point state (it is unnecessary unless the tool uses floating point operations).

%d total calls to malloc in main loop unaccounted for, MemoryEaten

This message indicates a memory leak in the main Etch loop. No action required. If the number is large (say, in the thousands), it may indicate a serious memory leak and a bug report should be filed.

Problems with Tools

Messages from the Visual Etch User Inteface and Scripts

This may cause the etched program to break. Are you sure ?

The user decided to uncheck the "Fix calls to LoadLibrary". Unchecking this may cause the program to load copies of both etched and unetched DLLs which may cause unpredictable and undesirable behavior.

Delete user entered module options and revert to default settings ?

Reverts the module options to the default. This effectively causes Visual Etch to forget about all the special per-module settings that the user had set.

Cannot find the output of DLLWatch: <filename>. Please run dllwatch first.
Cannot parse output file: <filename>. Try rerunning dllwatch.

Run dllwatch on the application.

Warning: Cannot find <modulename> which was mentioned in the dllwatch output file.

The file modulename was mentioned in the dllwatch output file but it could not be found in the path. Use find to find the file in the system and use "Options | Add Explicitly Loaded Modules | Browse..." to add the DLL.

Warning: Error opening: <project>. Opening DefaultProject.vpr.

The user tried to open a file (project) that was either not a project file or was corrupted. If the project file was corrupted, delete the project file and start over. (This should be very rare.)

The exception unknown software exception (0xe000001) occurred in the application at location 0xsomewhere

This error message is generated when you select an application and Visual Etch tries to determine the import table for all of the application's modules. If one of the modules is not a PE00 executable (say, it's a DOS executable), you can get this somewhat cryptic message. To determine if this is in fact the problem, examine the console log to see on which file dllwalk failed. Suppose it was c:\winnt\occache\ietimer.ocx. Then, open up a console window in the experiment directory and run dllwalk on the offending file:

dllwalk c:\winnt\occache\ietimer.ocx

You should see the same error that you saw from Visual Etch. Simply remove this file from the Modules list.

Error opening project <projectfile>. Please check that no other program is using it.

Projectfile is being used by another application. Usually Visual Etch or MSAccess. Quit the other application and try again.

Warning: Cannot find <executablename>. Proceeding without an application name.

This occurs when the executable that the project was previously working on could not be found. Either the executable was moved or deleted, or the path to the executable has been changed. The second case usually happens when you mount/unmount network drives or run on a different machine. Browse the computer for the needed application.

Error: <Filename> is not a PE binary. Etch will not process it.

You attempted to use an application that is not a 32-bit Windows binary. Choose a different binary.

- Warning: Cannot find table file: <filename>
- Warning: Table file <filename> has zero length.

This usually occurs when the application crashes or exited without going through the DLL clean-up routines, so the tool was not able to produce an output file. The message is just indication that the application crashed or exited in a bad way.

- Warning: Read file <filename> failed. [ErrorMsg]
- Warning: Cannot find file <filename>.
- Warning: Unable to read <filename>. [ErrorMsg]

The file either doesn't exist or there was a locking violation between different processes using the same file. Or, this may mean that the application crashed or exited without going through the DLL clean-up routine, so the tool wasn't able to produce an output file. The solution depends on the context where the read file error happened. See: [Warning: Cannot find table file <filename>]

Warning: No Media in <Drive Letter>

Attempted to browse into a floppy or CD-ROM drive that doesn't have any media in it. Insert a floppy or CD-ROM into the drive.

Cannot delete <filename>. [Error message]

Visual Etch attempted to delete a file but failed Check permissions on the file. Also check that no other process is using the file.

No Etch stamp found in binary

Visual Etch was unable to find the timestamp in a file that it had previously etched. The file may have been written incorrectly. Clear the cache and re-etch.

Error while clearing the cache. Check console window for details.

The clear cache operation did not manage to delete everything in the cache. Another process is using a file or is cd'ed into a subdirectory in the cache. Make sure that no other program is using files in the cache.

Cannot find <Filename>. Please make sure that Etch and Visual Etch were installed correctly.

Visual Etch could not find Filename which is required for it to run properly. Reinstall Etch and Visual Etch.

Unable to write to . Please check permissions and available disk space.

Visual Etch attempted to write a temporary file to tempdir but failed. Check permissions on tempdir and check to see if there is sufficient disk space.

Warning: Process still active when cleanup call done.

The process that the console window was monitoring was still active when the UI tried to clean up. If this happens consistently, contact the Etch team.

Warning: Graph file: <Filename> is in the wrong format.

The tool attempted to show a graph that isn't in the format expected by Visual Etch. Fix the way the tool formats its output to conform to that expected by Visual Etch (see the Visual Etch API).

Error. POpen on <Command> failed!

Attempt to create a process failed. Check to make sure that the executable expected in the command is in the path.

Etching process died prematurely.

The etching process died without telling Visual Etch that it was done. There is likely a bug in the tool script. Check the tool script to make sure that it doesn't cause the top-level script to die in a bad way.

Error terminating process: return code = <errorcode>

There was a problem terminating the subjecting Perl process on an abort. Use the task manager to terminate perl.exe.

Error opening project <Projectfile>. Please make sure that the project file is up to date and not corrupted

Projectfile has been corrupted. (This message could occur if the Projectfile is from an outdated version of Visual Etch, however this should never happen.) Delete the project file and start over. If this error message reoccurs, it means that ProjectTemplate.mdb is corrupted. In this case, copy ProjectTemplate.mdb from a clean installation.

Warning: Cannot find tool named <Toolname>

Vetch can not find a tool named in a params.mdb entry. Check the entry, and make sure that the tool exists and is executable.

- Warning: Attempted to ShowOutput of a non-existent process.
- Warning: Attempted to SendCommand to a non-existent process.
- Warning: Cannot find key named <string>

Internal debugging error. Contact the Etch team.

Warning: Ignoring message: <Message>

The scripts tried to ask Visual Etch to perform a task that it does not understand. Debug the script to make sure that there are no typos in the message that was sent

Messages from Scripts

Run of command <dllwalk...> died. Error = [error message].

Dllwalk encountered an error trying to fix the import tables for the given file.

Dllwatch: Couldn't open summary file <outfile>

dllwatch had trouble opening outfile to write output to. Check permissions and disk space on the path to outfile.

Can't etch primary application executable: <Executable name>. Can't proceed.

Etching the primary executable failed. Check previous error messages from Etch in experiments to see what caused this.

Copy failed to produce <filename>.

Please check disk space and permissions, you may not have sufficient disk space to write the etched file.

Having trouble deleting <filename>.

Another process is using the file or Visual Etch may not have delete permission on the file.

Can't move <srcfile> into <destfile>.

Another process maybe using destfile. Also check file permissions and disk space.

- Warning: Can't find debug info for <modulename>. CVDump: [error message]>
- Warning: No debug info for any of the files.

The module doesn't have debug information. Tools that use debug information to give a per-procedure breakdown will not be able to produce the breakdowns.

Warning: Etch command <etch command> failed for <modulename>. Error = [Error msg]

Error occurred trying to etch <modulename>. If modulename is the primary application executable, this is a fatal error. Otherwise, etching will continue, just using the original module instead of an etched module.

Can't find Etch or patch file for <file>

Internal Etch error: No patched or etched file was available for <file>. Contact Etch team.

Attempt to fix DLL Jumps in <file> failed. Error: [error message].

The attempt to dllwrap the file failed. Usually because the importables for the file are in a format that Etch does not understand. Contact Etch team.

Tool <toolname> stamp <stamp> has [spaces | special character]. Contact <toolname> toolwriter.

Stamp given to Etch has special characters that would cause the command processor to do unexpected things. Complain to the tool writer, and take out the special characters from the stamp.