Re: Bad_module_info

Do you all see the same events showing up in your event viewer that @PotatoPotahtoh mentioned in this post?

https://answers.ea.com/t5/Technical-Issues/bad-module-info-crash-correlation-to-Windows-security-auditing/m-p/7640898

Yes, eventId 1000.

I checked yesterday logs as timestamps corralates with my the game exits. 

The thing is that I cannot play this game anymore. There is no match now that I can play to the end, it exits randomly but on every matches without any error message.

@EA_Blueberry can you share information about how the investigation is going with Nvidia? When can we expect for a hotfix?

I have seen another eventId 1000, in the details it has complained about kms_spico. Removed that and since then there is no disconnect, 6x games in a row.

Thanks for looking into this @EA_Blueberry ! I wanted to share what I posted on Reddit about this as well since I feel like I explained it a little better the second time typing it up.

(https://www.reddit.com/r/apexlegends/comments/ay9a62/crash_to_desktop_no_error_bad_module_info_please/)

Thanks for taking a look into this @EA_Blueberry 

Wanted to add a comment here to maybe get more information from anyone else following this thread as well. 

Hi folks - I've been trying to get to the bottom of the bad_module_info crashes, which are the crashes where the game randomly quits with no error as if you pressed alt+F4. If you were to go into Event Viewer and check the Application events you will find a bad_module_info error logged at the precise moment the game crashed.

Anyways I just discovered that every single bad_module_info log in Event Viewer is preceded by two Microsoft Windows security auditing events (Event ID: 4624 and Event ID: 4672) that happen exactly 1 second before the game crashes.

Can someone else experiencing the bad_module_info errors check to see if they have the same security events showing up? This event will be logged under Event Viewer > Windows Logs > Security and will show up as Event ID: 4624 and Event ID: 4672 and the timestamp should be a second before the bad_module_info error

In my case it looks like there is a Logon Process: Advapi (which is a Windows OS dll file) that is occurring exactly one second before the bad_module_info game crash, so my theory is that whatever windows service that is accessing the Advanced API dll file is what is causing the crash.

Here is an example:

Application Event ID: 1000

(bad_module_info) at 08:38:42 PM (earlier tonight)

Faulting application name: bad_module_info, version: 0.0.0.0, time stamp: 0x00000000
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x00000000
Fault offset: 0x0000000000000000
Faulting process id: 0x17dc
Faulting application start time: 0x01d4d49b2c80ebd5
Faulting application path: bad_module_info
Faulting module path: unknown
Report Id: e7279b90-d0f2-48b5-8487-f5262b628f2d
Faulting package full name: 
Faulting package-relative application ID: 

Security Event ID: 4672

at 08:38:41 PM (1 second before the crash logged above)

An account was successfully logged on.

Subject:
	Security ID:		SYSTEM
	Account Name:		LUNCHBOX$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x378
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

I concur that these 2 security audit events correlate with the crashes.

@PotatoPotahtoh  This is exactly what's happening at my end. Event 4624 followed by Event 4672 and then the bad_module_info. Logon Process: Advapi is also the same. Thanks for maybe giving us some hope!

Yes. This is happening to me too, exactly as you've described. I feel like I've been crashing close to 50% of my games recently, if that's relevant information as well.

But yes, exactly 1 second prior to Bad Module Info events that correspond to crashes, there are events 4624 and 4672. There are occasions of these events that don't correlate to crashes, but every crash has a corresponding Bad Module Info event with events 4624 and 4672 preceding it by exactly 1 second.

---

@EA_Blueberry 
i do everything to fix bad_module but still not work 

Same for me. Both events 1 sec before crash

I'm at work currently so I can't test this out, but some research today about the history of advapi causing crashes on Windows (has been happening for a long time apparently) might have some relation to the services.exe process calling on Windows Error Reporting which then causes system hangs or application crashes. 

As a test I am going to try disabling Windows Error Reporting when I get home today, but I am going to be away from my computer for a few days after tonight so won't be able to test fully.

Anyone else in here willing to try disabling Windows Error Reporting and see if it helps with the bad_module_info crashing?

In regedit find the following entry: 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

 Find the value called Disabled. If it doesn't exist, make a new DWORD value with that exact name. Then double-click the Disabled value to change it from a 0 to a 1, and then save it by selecting OK. Reboot computer.

Well I receive the same bad_module_info error in the event viewer but there are no Event ID: 4624 nor Event ID: 4672. There is only Event ID: 1001 ~5sec after bad_module_info event everytime.

bad_module_info:

Log Name:      Application
Source:        Application Error
Date:          2019-03-07 20:57:41
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-DL2AC3B
Description:
Faulting application name: bad_module_info, version: 0.0.0.0, time stamp: 0x00000000
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x00000000
Fault offset: 0x0000000000000000
Faulting process id: 0x1634
Faulting application start time: 0x01d4d5155fed4762
Faulting application path: bad_module_info
Faulting module path: unknown
Report Id: 62408655-29ff-4fbf-a9f7-0f5c310eaaa8
Faulting package full name: 
Faulting package-relative application ID: 

Event 1001:

Log Name:      Application
Source:        Windows Error Reporting
Date:          2019-03-07 20:57:46
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-DL2AC3B
Description:
Fault bucket 120792870519, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: bad_module_info
P2: 0.0.0.0
P3: 00000000
P4: unknown
P5: 0.0.0.0
P6: 00000000
P7: 00000000
P8: 0000000000000000
P9: 
P10: 

Attached files:
\\?\C:\Users\Martynas\AppData\Local\Temp\WERAF08.tmp.WERDataCollectionStatus.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEA9.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBED7.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bad_module_info_d38ab07e65678332d5f962bea87df6e5c12a9d28_85207d7d_003fc212

Analysis symbol: 
Rechecking for solution: 0
Report Id: 62408655-29ff-4fbf-a9f7-0f5c310eaaa8
Report Status: 268435456
Hashed bucket: 2fa587f61571ffe999423f2b2f32e164
Cab Guid: 0

@Smt923I thought it was strange as well, but apparently Advapi is used by a TON of Windows services. The reasoning behind it being related to WER is that WER calls on Advapi (Advapi32.dll is an advanced Windows 32 base API DLL file; it is an API services library that supports security and registry calls) in order to generate reports and it seems that some folks on the internet (the most trusted source of information) believe that WER could be "logging on" and overwhelming the system with a ton of bad reports (or something). Anyways just something to try!

@PotatoPotahtohahh yeah.. you're right. There are such events as you said under Security logs 🤐

I get the exact same problem.

hardware:

i5 6500 

rx480

8GB ram

@PotatoPotahtoh Is there any possible disadvantage in trying this? If not I will defnitely test it aswell

@KuratohhI am no expert, but I believe it simply disables the ability of Windows to automatically send error and diagnostics reports. It should be something you can reverse easily enough.

EDIT - I want to add that the registry is not something that you should go futzing around in if you're not comfortable with it 

K guys ive been playing for 2 week without any crash so i  can confirm you one of  these 3 tricks fixed the crash that occured every game.

I set my monitor to a refresh rate that matches my desktop AND in-game resolution ; so 1360x768  both ,  at 75 hz was the best option for me. knowing it was also  easier on the gpu

 " +fps_max 75 "    ( dont forget the + sign and the space )  in the launch option 

I stopped any AMD services running in the task manager.

around 45 games played since . no crash at all 

I had like 2 or 3 ''feeze' but my game didnt crash out of it like it did before.

To confirm all this , I tried without the launch command and i crashed after my third game.put it back , never crashed again . 

try this out 

Played for 1,5h and then crashed again. Disabling diagnostics did not help for me.

Those 2 Events are still there 1 sec before crash ...

@EA_Blueberry- I managed to get a crash to happen while Process Monitor was running on my machine. I'd like to send my Logfile if you can tell me how to send it over to you guys privately. I am concerned that this file will contain personally identifiable information. This file is approximately 550MB.