Fusion Log Assembly Binder Error - Bind result: hr = 0x1. Incorrect function

Question

I am trying to get to the bottom of a strange behavior on one machine. I have a trivial console application that will run interactively, but when I invoke it via WMI, it will start and exit immediately.

I enabled the Fusion log, since Procmon was unrevealing. I see the following error:

*** Assembly Binder Log Entry (31-01-2015 @ 19:22:51) *** 
The operation was successful. 
Bind result: hr = 0x1. Incorrect function. 
Assembly manager loaded from: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll 
Running under executable C:\CMCBOOTSTRAP\Cmc.Installer.Agent.Console.exe 
--- A detailed error log follows. 
BEGIN : Native image bind. 
END : Incorrect function. (Exception from HRESULT: 0x00000001 (S_FALSE))

What is the cause for "incorrect function"? What else can I look at to determine why this application effectively dies on startup via WMI?

And I mean trivial...

class Program
{
 static void Main(string[] args)
 {
 Thread.Sleep(30000);
 }
}

Environment is Windows Server 2012 R2 and .NET 4.5.

• Alois Kraus: You should can use Image File Execution Options to start a debugger when your process starts. With Windbg you can start it as debugging server so you can connect to it from another session. Not so easy to set up but it will give you direct insights. Another option is to profile your app and check where the CPU is going to with ETW.
• Mark Richman: I only have connectivity to this machine via a Terminal Server gateway, and the machine has no internet access, so connecting a debugger remotely is unlikely. I'm not sure what you're suggesting with the profiler. What would I be looking for, given the application is one line of code? What's ETW?
• Alois Kraus: When you start your process via ETW it is usually started under session zero where a debugger UI has no desktop accesss and you cannot use the debugger. But you can start Windbg as debugging server processs and you can connect locally via tcp or named pipes to it so you can see what is going on. ETW is Event Tracing For Windows. You can use e.g. PerfView. If managed exceptions happen there you will see them in theprofiling data. Exception paths tend to be slow which could give you an idea what was going wrong.
• Mark Richman: I captured the life of the process via PerfView. A few seconds of systemwide capture time is about 14MB. I'm not sure which event type to look at, but I do see the Fusion events (same as the FusionLog file). I'm not sure which others to look at, but Microsoft-Windows-DotNETRuntime/Exception/Start is empty. Anything else I can look at? Are there any verbose WMI logs I can turn on? Wmiprvse.exe is its parent process, so maybe that might "know" why the process is exiting.
• Alois Kraus: It is unlikely that the parent process knows why the child did break. But you can look at the CPU stacks for your process to check out what was happening until it died. But to look at CPU stacks more exactly WPA from the Windows Performance Toolkit of the Win8.1 SDK would be a better viewer.

Answer 1

This is an entirely normal mishap, you got it from Fuslogvw.exe by selecting the "Native Images" radio button in the Log Categories setting. Readily reproducible on my own machine as well, I see many of them.

The actual error code is S_FALSE, a COM error code that means "it successfully failed". Which is why it says The operation was successful. Misinterpreted for the diagnostic message as "Function failed", that's the description for Windows error 1 and returned by the FormatMessage() winapi function.

The successful failure is entirely expected, you didn't run Ngen.exe on your console mode app yet so the native image for it is not available. Keep looking, this is not it. Change the Log Category back to "Default", native images are not your problem.

• Mark Richman: Thanks, back to square one. No idea why this app starts and then dies immediately. I can't even get GFlags to attach a debugger to it on start.
• Hans Passant: I have no reasonable guess of course. Drag the machine to a 4th story floor and let it slip out of a window. Opening the window first is optional.

Answer 2

This error can also occur if you have a 64 bit dependency while your process or IIS runs on 32 bit.