BugId fails with error: "Cannot find module 'ntdll'!?"

[maxcoderrrr]

Hi,
I was running the latest release of BugId (2024-07-09 13:37) and encountered the following error:

→ Command line: C:\foo\bar.exe C:\asdf\asdf.bar
+ Main process 6908/0x1AFC (bar.exe, x86, IL:3): Attached ("C:\foo\bar.exe" C:\asdf\asdf.bar).
┌───[ Fatal builtins.AssertionError Exception in thread 8172/0x1FEC (cThread#2E16418FB10{main = __fRun, #8172, running}) ]────────────────────────────────────────────────────
│ Cannot find module 'ntdll'!?
│ 
│ Local variables:
│   i0OffsetFromStartOfFunction = None
│   o0Function = None
│   o0Module = None
│   obSymbolOrAddressMatch = <re.Match object; span=(0, 42), match=b'ntdll!NtWow64IsProcessorFeaturePresent+0xc'>#2E1640F3640
│   oProcess = <mBugId.cProcess.cProcess.cProcess object at 0x000002E1641E8E90>#2E1641E8E90
│   sb0Address = None
│   sb0FunctionSymbol = <instance builtins:bytes "b'NtWow64IsProcessorFeaturePresent'">#2E1641F04E0
│   sb0ModuleCdbIdOrAddress = <instance builtins:bytes "b'ntdll'">#2E16416DB60
│   sb0ModuleOffset = None
│   sb0OffsetInFunction = <instance builtins:bytes "b'c'">#7FFBDD3915E0
│   sb0UnloadedModuleFileName = None
│   sb0UnloadedModuleOffset = None
│   sbModuleCdbId = <instance builtins:bytes "b'ntdll'">#2E16416DB60
│   sbPlusOrMinusOffset = <instance builtins:bytes "b'+'">#7FFBDD390B60
│   sbSymbolOrAddress = <instance builtins:bytes "b'ntdll!NtWow64IsProcessorFeaturePresent+0xc'">#2E1641F17F0
│   u0Address = None
│   u0ModuleOffset = None
│ 
│ Stack for thread 8172/0x1FEC (cThread#2E16418FB10{main = __fRun, #8172, running}):
│ ─┐ __fRun @ C:\BugId33\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:58
│  │ 57:      try:
│  │ 58:        oSelf.__fActivity(*oSelf.__axActivityArguments);
│  ├─┐ cCdbWrapper_fCdbStdInOutHelperThread @ C:\BugId33\modules\mBugId\cCdbWrapper\cCdbWrapper_fCdbStdInOutHelperThread.py:53
│  ╷ │ 52:    oCdbWrapper.fbFireCallbacks("Log message", "Main loop #%d" % uMainLoopCounter);
│  ╷ │ 53:    (bEventIsFatal, bEventHasBeenHandled) = oCdbWrapper.ftbHandleLastCdbEvent(asbOutputWhileRunningApplication);
│  ╷ ├─┐ cCdbWrapper_ftbHandleLastCdbEvent @ C:\BugId33\modules\mBugId\cCdbWrapper\cCdbWrapper_ftbHandleLastCdbEvent.py:219
│  ╷ ╷ │ 218:    oCdbWrapper.o0ReservedMemoryVirtualAllocation = None;
│  ╷ ╷ │ 219:  o0BugReport = cBugReport.fo0CreateForException(
│  ╷ ╷ ├─┐ cBugReport?.fo0CreateForException @ C:\BugId33\modules\mBugId\cBugReport\cBugReport.py:138
│  ╷ ╷ ╷ │ 137:    # Create a preliminary error report.
│  ╷ ╷ ╷ │ 138:    o0BugReport = cBugReport.foCreate(
│  ╷ ╷ ╷ ├─┐ cBugReport?.foCreate @ C:\BugId33\modules\mBugId\cBugReport\cBugReport.py:185
│  ╷ ╷ ╷ ╷ │ 184:    );
│  ╷ ╷ ╷ ╷ │ 185:    fApplyBugTranslationsToBugReport(oCdbWrapper, oBugReport);
│  ╷ ╷ ╷ ╷ ├─┐ fApplyBugTranslationsToBugReport @ C:\BugId33\modules\mBugId\mBugTranslations\fApplyBugTranslationsToBugReport.py:65
│  ╷ ╷ ╷ ╷ ╷ │ 64:    for oBugTranslation in aoBugTranslations:
│  ╷ ╷ ╷ ╷ ╷ │ 65:      if oBugTranslation.fbApplyToBugReport(oCdbWrapper, oBugReport):
│  ╷ ╷ ╷ ╷ ╷ ├─┐ cBugTranslation?.fbApplyToBugReport @ C:\BugId33\modules\mBugId\mBugTranslations\cBugTranslation.py:141
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 140:    # If more top frames may be irrelevant, see if they are there and hide them:
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 141:    if (oSelf.bAdditionalIrrelevantNoneTopStackFrames or oSelf.rb0AdditionalIrrelevantStackFrameSymbols) and oBugReport.o0Stack:
│  ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ o0Stack @ C:\BugId33\modules\mBugId\cBugReport\cBugReport.py:105
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 104:    if oSelf.__o0Stack is None:
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 105:      oSelf.__o0Stack = cStack.foCreate(oSelf.__oProcess, oSelf.__oWindowsAPIThread, oSelf.uStackFramesCount);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cStack?.foCreate @ C:\BugId33\modules\mBugId\cStack.py:269
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 268:        o0Function, i0OffsetFromStartOfFunction
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 269:      ) = oProcess.ftxSplitSymbolOrAddress(sbCdbSymbolOrAddress);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cProcess_ftxSplitSymbolOrAddress @ C:\BugId33\modules\mBugId\cProcess\cProcess_ftxSplitSymbolOrAddress.py:32
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 31:    o0Module = oProcess.fo0GetModuleForCdbId(sbModuleCdbId);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 32:    assert o0Module, \
│  ╒═════════════════╛ ▲ Assertion failed: "Cannot find module 'ntdll'!?"
│  │ __fRun @ C:\BugId33\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:66
│  │ 65:        cException, oException, oTraceBack = sys.exc_info();
│  │ 66:        if not oSelf.__oCdbWrapper.fbFireCallbacks("Internal exception", oSelf.__oThread, oException, oTraceBack):
│ ═╛ ▲ Application terminated because exception was not handled.
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Please report the above details at the below web-page so it can be addressed:
    https://github.com/SkyLined/BugId/issues/new
If you do not have a github account, or you want to report this issue
privately, you can also send an email to:
    BugId@skylined.nl

In your report, please copy ALL the information about the exception reported
above, as well as the stack trace and BugId version information. This makes
it easier to determine the cause of this issue and makes for faster fixes.

If you can reproduce the issue, it would help a lot if you can run BugId in
verbose mode by adding the --verbose command-line argument.
as in: BugId -v --isa=x86 --n0ApplicationMaxRunTimeInSeconds=120 C:\foo\bar.exe -- C:\asdf\asdf.bar


  ____________________________________________________________________________
                              __
   ││▌║█▐▐║▌▌█│║║│      _,siSP**YSis,_       ╒╦╦══╦╗             ╒╦╦╕    ╔╦╕
   ││▌║█▐▐║▌▌█│║║│    ,SP*'`    . `'*YS,      ║╠══╬╣ ╔╗ ╔╗ ╔╦═╦╗  ║║  ╔╦═╬╣
   ╵2808197631337╵   dS'  _    |    _ 'Sb    ╘╩╩══╩╝ ╚╩═╩╝ ╚╩═╬╣ ╘╩╩╛ ╚╩═╩╝
                    dP     \,-` `-<` `  Y;                 ╚╩═╩╝    ╮╷╭
      ╮╷╭          ,S`  \+' \      \    `Sissssssssssssssssssss,   :O()    ╲ö╱
     :O()          (S   (   | --====)   :SSSSSSSSSSSSSSSSSSSSSSD    ╯╵╰    ─O─
      ╯╵╰  ╮╷╭     'S,  /+, /      /    ,S?********************'           ╱O╲
           ()O:     Yb    _/'-_ _-<._.  dP
           ╯╵╰       YS,       |      ,SP         https://bugid.skylined.nl
  ____________________`Sbs,_    ' _,sdS`______________________________________
                        `'*YSissiSY*'`
                              ``
┌───[ Version information ]───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ ▲ BugId version: 2024-07-09 11:41 (in trial period).
│ ▲ mBugId version: 2024-07-09 11:41 (in trial period).
│ √ mConsole version: 2024-07-09 11:41.
│ √ mDateTime version: 2024-07-09 11:41.
│ √ mDebugOutput version: 2024-07-09 11:41.
│ √ mFileSystemItem version: 2024-07-09 11:41.
│ √ mHumanReadable version: 2024-07-09 11:41.
│ √ mMultiThreading version: 2024-07-09 11:41.
│ √ mNotProvided version: 2024-07-09 11:41.
│ √ mProductDetails version: 2024-07-09 11:41.
│ √ mRegistry version: 2024-07-09 11:41.
│ √ mWindowsAPI version: 2024-07-09 11:41.
│ √ mWindowsSDK version: 2024-07-09 11:41.
│ • Platform OS: Windows-10-10.0.19045-SP0 on AMD64 processor.
│ • Python version: 3.11.1, 64 bit.
│ • cdb.exe (x86) version: 10.0.17763.132.
│ • cdb.exe (x64) version: 10.0.17763.132.
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Thank you in advance for helping to improve BugId!

Any help to fix this issue would be great. Please let me know in case any further information is required.

[SkyLined]

I believe this is a problem that happens only when debugging a 32-bit x86-ISA process on a 64-bit x64-ISA OS. I do not know the root cause but I've modified the code to collect debugging information the next time it is triggered. If you still encounter this error once the new version is released, copy+paste the error, as that should help me find the root cause.

[maxcoderrrr]

Great, thank you. I ran into this issue quite frequently, so I will try to capture it next time I see it and share the bug report. I don't believe I have any of my relevant test environments available at the moment.

[SkyLined]

The new version is ready for use. Please let me know if you can still reproduce and if it provides a more detailed error report.

[maxcoderrrr]

Here is a new bug report with the latest version. I think it is related to the same issue:

─────────────────────────
→ Command line: C:\temp\foo.exe C:\temp\foo.bar
+ Main process 280/0x118 (foo.exe, x86, IL:3): Attached ("C:\asdf\foo.exe" C:\temp\foo.bar).
┌───[ Fatal builtins.AssertionError Exception in thread 6936/0x1B18 (cThread#217B1A37D90{main = __fRun, #6936, running}) ]───────────────────────────────────────────────────
│ cdb reports module 'b'ntdll'' to be at address 0x77980000 but there is no module there!?
│ 
│ Local variables:
│   asbLoadedModulesInCdbForDebugging = [b'start    end        module name', b'00400000 0046d000   foo    C (export symbols)       foo.exe', b'77980000 77b24000   ntdll      (pdb symbols)          C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\sym\\wntdll.pdb\\6771C2E71C152DBA302EC8C50FE2E9261\\wntdll.pdb']#1
│   asLoadedModulesByStartAddressForDebugging = ['4194304: foo.exe (C:\\asdf\\foo.exe)', '140706351087616: ntdll.dll (C:\\WINDOWS\\SYSTEM32\\ntdll.dll)', '5701632: verifier.dll (C:\\WINDOWS\\System32\\verifier.dll)', '140706333589504: wow64.dll (C:\\WINDOWS\\System32\\wow64.dll)', '140706344271872: wow64win.dll (C:\\WINDOWS\\System32\\wow64win.dll)', '2006384640: wow64cpu.dll (C:\\WINDOWS\\System32\\wow64cpu.dll)']#1
│   o0Module = None
│   oModule = <instance mBugId.mModule.cModule:cModule (Cannot get any symbol for Module <cdb id not cached> (C:\WINDOWS\System32\wow64cpu.dll) at 0x7797`0000) #1>
│   oProcess = <mBugId.mProcess.cProcess.cProcess object at 0x00000217B300C190 #1>
│   sbCdbId = b'ntdll'
│   u0StartAddress = 2006450176
│   uStartAddress = 2006450176
│ 
│ Stack for thread 6936/0x1B18 (cThread#217B1A37D90{main = __fRun, #6936, running}):
│ ─┐ __fRun @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:58
│  │ 57:      try:
│  │ 58:        oSelf.__fActivity(*oSelf.__axActivityArguments);
│  ├─┐ cCdbWrapper_fCdbStdInOutHelperThread @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_fCdbStdInOutHelperThread.py:55
│  ╷ │ 54:    oCdbWrapper.fbFireCallbacks("Log message", "Main loop #%d" % uMainLoopCounter);
│  ╷ │ 55:    (bEventIsFatal, bEventHasBeenHandled) = oCdbWrapper.ftbHandleLastCdbEvent(asbOutputWhileRunningApplication);
│  ╷ ├─┐ cCdbWrapper_ftbHandleLastCdbEvent @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_ftbHandleLastCdbEvent.py:218
│  ╷ ╷ │ 217:    oCdbWrapper.o0ReservedMemoryVirtualAllocation = None;
│  ╷ ╷ │ 218:  o0BugReport = cBugReport.fo0CreateForException(
│  ╷ ╷ ├─┐ cBugReport?.fo0CreateForException @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:285
│  ╷ ╷ ╷ │ 284:    # Create a preliminary error report.
│  ╷ ╷ ╷ │ 285:    o0BugReport = cBugReport.foCreate(
│  ╷ ╷ ╷ ├─┐ cBugReport?.foCreate @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:332
│  ╷ ╷ ╷ ╷ │ 331:    );
│  ╷ ╷ ╷ ╷ │ 332:    fApplyBugTranslationsToBugReport(oCdbWrapper, oBugReport);
│  ╷ ╷ ╷ ╷ ├─┐ fApplyBugTranslationsToBugReport @ C:\BugIdn\modules\mBugId\mBugTranslations\fApplyBugTranslationsToBugReport.py:65
│  ╷ ╷ ╷ ╷ ╷ │ 64:    for oBugTranslation in aoBugTranslations:
│  ╷ ╷ ╷ ╷ ╷ │ 65:      if oBugTranslation.fbApplyToBugReport(oCdbWrapper, oBugReport):
│  ╷ ╷ ╷ ╷ ╷ ├─┐ cBugTranslation?.fbApplyToBugReport @ C:\BugIdn\modules\mBugId\mBugTranslations\cBugTranslation.py:141
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 140:    # If more top frames may be irrelevant, see if they are there and hide them:
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 141:    if (oSelf.bAdditionalIrrelevantNoneTopStackFrames or oSelf.rb0AdditionalIrrelevantStackFrameSymbols) and oBugReport.o0Stack:
│  ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ o0Stack @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:113
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 112:    if oSelf.__o0Stack is None:
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 113:      oSelf.__o0Stack = cStack.foCreate(oSelf.__oProcess, oSelf.__oWindowsAPIThread, oSelf.uStackFramesCount);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cStack?.foCreate @ C:\BugIdn\modules\mBugId\mStack\cStack.py:227
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 226:        o0Function, i0OffsetFromStartOfFunction
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 227:      ) = oProcess.ftxSplitSymbolOrAddress(sbCdbSymbolOrAddress);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cProcess_ftxSplitSymbolOrAddress @ C:\BugIdn\modules\mBugId\mProcess\cProcess_ftxSplitSymbolOrAddress.py:31
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 30:    sbModuleCdbId = sb0ModuleCdbIdOrAddress;
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 31:    o0Module = oModule = oProcess.fo0GetModuleForCdbId(sbModuleCdbId);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cProcess_fo0GetModuleForCdbId @ C:\BugIdn\modules\mBugId\mProcess\cProcess_fo0GetModuleForCdbId.py:30
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 29:  o0Module = oProcess.fo0GetModuleForStartAddress(uStartAddress);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 30:  assert o0Module is not None, \
│  ╒═══════════════════╛ ▲ Assertion failed: "cdb reports module 'b'ntdll'' to be at address 0x77980000 but there is no module there!?"
│  │ __fRun @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:66
│  │ 65:        cException, oException, oTraceBack = sys.exc_info();
│  │ 66:        if not oSelf.__oCdbWrapper.fbFireCallbacks("Internal exception", oSelf.__oThread, oException, oTraceBack):
│ ═╛ ▲ Application terminated because exception was not handled.
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Please report the above details at the below web-page so it can be addressed:
    https://github.com/SkyLined/BugId/issues/new
If you do not have a github account, or you want to report this issue
privately, you can also send an email to:
    BugId@skylined.nl

In your report, please copy ALL the information about the exception reported
above, as well as the stack trace and BugId version information. This makes
it easier to determine the cause of this issue and makes for faster fixes.

If you can reproduce the issue, it would help a lot if you can run BugId in
verbose mode by adding the --verbose command-line argument.
as in: BugId -v --isa=x86 --n0ApplicationMaxRunTimeInSeconds=10 C:\asdf\foo.exe -- C:\temp\foo.bar


  ____________________________________________________________________________
                              __             ╷                   ╷
   ││▌║█▐▐║▌▌█│║║│      _,siSP**YSis,_      ─╒╦╦══╦╗            ─╒╦╦╕    ╔╦╕
   ││▌║█▐▐║▌▌█│║║│    ,SP*'`    . `'*YS,      ║╠══╬╣ ╔╗ ╔╗ ╔╦═╦╗  ║║  ╔╦═╬╣
   ╵2808197631337╵   dS'  _    |    _ 'Sb    ╘╩╩══╩╝ ╚╩═╩╝ ╚╩═╬╣ ╘╩╩╛ ╚╩═╩╝
                    dP     \,-` `-<` `  Y;                 ╚╩═╩╝    ╮╷╭
      ╮╷╭          ,S`  \+' \      \    `Sissssssssssssssssssss,   :O()
     :O()          (S   (   | --====)   :SSSSSSSSSSSSSSSSSSSSSSD    ╯╵╰
      ╯╵╰  ╮╷╭     'S,  /+, /      /    ,S?********************'
           ()O:     Yb    _/'-_ _-<._.  dP
           ╯╵╰       YS,       |      ,SP         https://bugid.skylined.nl
  ____________________`Sbs,_    ' _,sdS`______________________________________
                        `'*YSissiSY*'`
                              ``
┌───[ Version information ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ ▲ BugId version: 2025-05-23 12:35 (in trial period).
│ ▲ mBugId version: 2025-05-23 12:34 (in trial period).
│ √ mConsole version: 2025-05-23 10:58.
│ √ mDateTime version: 2025-05-23 10:57.
│ √ mDebugOutput version: 2025-05-23 10:58.
│ √ mFileSystemItem version: 2025-05-23 10:58.
│ √ mHumanReadable version: 2025-05-23 10:57.
│ √ mMultiThreading version: 2025-05-23 10:58.
│ √ mNotProvided version: 2025-05-23 10:57.
│ √ mProductDetails version: 2025-05-23 10:58.
│ √ mRegistry version: 2025-05-23 10:58.
│ √ mWindowsAPI version: 2025-05-23 10:58.
│ √ mWindowsSDK version: 2025-05-23 10:58.
│ • Platform OS: Windows-10-10.0.19045-SP0 on AMD64 processor.
│ • Python version: 3.11.1, 64 bit.
│ • cdb.exe (x86) version: 10.0.17763.132.
│ • cdb.exe (x64) version: 10.0.17763.132.
│ (Underlined modules are covered by a license installed on this system.)
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Thank you in advance for helping to improve BugId!
√ A copy of the error report can be found in C:\bi\Internal error reports\2025-05-26 07։08։39.849824 BugId error report #34.txt.

If you think these are distinct, please let me know, and I can file it as a separate issue instead.

[SkyLined]

Ok, so what's going on is that cdb says ntdll was loaded at address 0x77980000. But when BugId I asked Windows for a list of loaded modules, the list did not include a module at that address. So one of these two is lying, or there is some weird debugging-x86-on-x64 stuff going on (the later happens a lot).

Can you change some of the code to get more information and reproduce this issue again?

Please change the assert on lines 30-33 of the file C:\BugIdn\modules\mBugId\mProcess\cProcess_fo0GetModuleForCdbId.py to this:

  assert o0Module is not None, \
      "cdb reports module '%s' to be at address 0x%x but there is no module there!?\nKnown modules:\n%s" % (
        sbCdbId,
        uStartAddress,
        "\n".join(
          "* %s" % str(oModule) for oModule in
          oProcess.doModule_by_uStartAddress.values()
        ),
      );

This should add the list of known modules to the error, which might help explain what is going on.

[maxcoderrrr]

Here is an updated output:

───────────────────────────────
→ Command line: C:\temp\foo.exe C:\temp\foo.bar
+ Main process 1728/0x6C0 (foo.exe, x86, IL:2): Attached ("C:\temp\foo.exe" C:\temp\foo.bar).
┌───[ Fatal builtins.AssertionError Exception in thread 7912/0x1EE8 (cThread#21F67EE4990{main = __fRun, #7912, running}) ]─────────────────────────────────────────────────────────
│ cdb reports module 'b'ntdll'' to be at address 0x77980000 but there is no module there!?
│ Known modules:
│ * Module <cdb id not cached> (C:\temp\foo.exe) at 0x40`0000
│ * Module <cdb id not cached> (C:\WINDOWS\SYSTEM32\ntdll.dll) at 0x7FF8`C013`0000
│ * Module <cdb id not cached> (C:\WINDOWS\System32\verifier.dll) at 0x57`0000
│ * Module <cdb id not cached> (C:\WINDOWS\System32\wow64.dll) at 0x7FF8`BF08`0000
│ * Module <cdb id not cached> (C:\WINDOWS\System32\wow64win.dll) at 0x7FF8`BFAB`0000
│ * Module <cdb id not cached> (C:\WINDOWS\System32\wow64cpu.dll) at 0x7797`0000
│ 
│ Local variables:
│   asbLoadedModulesInCdbForDebugging = [b'start    end        module name', b'00400000 0046d000   foo    C (export symbols)       foo.exe', b'77980000 77b24000   ntdll      (pdb symbols)          C:\\ProgramData\\dbg\\sym\\wntdll.pdb\\6771C2E71C152DBA302EC8C50FE2E9261\\wntdll.pdb']#1
│   asLoadedModulesByStartAddressForDebugging = ['4194304: foo.exe (C:\\foo\\foo.exe)', '140706351087616: ntdll.dll (C:\\WINDOWS\\SYSTEM32\\ntdll.dll)', '5701632: verifier.dll (C:\\WINDOWS\\System32\\verifier.dll)', '140706333589504: wow64.dll (C:\\WINDOWS\\System32\\wow64.dll)', '140706344271872: wow64win.dll (C:\\WINDOWS\\System32\\wow64win.dll)', '2006384640: wow64cpu.dll (C:\\WINDOWS\\System32\\wow64cpu.dll)']#1
│   o0Module = None
│   oModule = <instance mBugId.mModule.cModule:cModule (Cannot get any symbol for Module <cdb id not cached> (C:\WINDOWS\System32\wow64cpu.dll) at 0x7797`0000) #1>
│   oProcess = <mBugId.mProcess.cProcess.cProcess object at 0x0000021F67F1F510 #1>
│   sbCdbId = b'ntdll'
│   u0StartAddress = 2006450176
│   uStartAddress = 2006450176
│ 
│ Stack for thread 7912/0x1EE8 (cThread#21F67EE4990{main = __fRun, #7912, running}):
│ ─┐ __fRun @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:58
│  │ 57:      try:
│  │ 58:        oSelf.__fActivity(*oSelf.__axActivityArguments);
│  ├─┐ cCdbWrapper_fCdbStdInOutHelperThread @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_fCdbStdInOutHelperThread.py:55
│  ╷ │ 54:    oCdbWrapper.fbFireCallbacks("Log message", "Main loop #%d" % uMainLoopCounter);
│  ╷ │ 55:    (bEventIsFatal, bEventHasBeenHandled) = oCdbWrapper.ftbHandleLastCdbEvent(asbOutputWhileRunningApplication);
│  ╷ ├─┐ cCdbWrapper_ftbHandleLastCdbEvent @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_ftbHandleLastCdbEvent.py:218
│  ╷ ╷ │ 217:    oCdbWrapper.o0ReservedMemoryVirtualAllocation = None;
│  ╷ ╷ │ 218:  o0BugReport = cBugReport.fo0CreateForException(
│  ╷ ╷ ├─┐ cBugReport?.fo0CreateForException @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:285
│  ╷ ╷ ╷ │ 284:    # Create a preliminary error report.
│  ╷ ╷ ╷ │ 285:    o0BugReport = cBugReport.foCreate(
│  ╷ ╷ ╷ ├─┐ cBugReport?.foCreate @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:332
│  ╷ ╷ ╷ ╷ │ 331:    );
│  ╷ ╷ ╷ ╷ │ 332:    fApplyBugTranslationsToBugReport(oCdbWrapper, oBugReport);
│  ╷ ╷ ╷ ╷ ├─┐ fApplyBugTranslationsToBugReport @ C:\BugIdn\modules\mBugId\mBugTranslations\fApplyBugTranslationsToBugReport.py:65
│  ╷ ╷ ╷ ╷ ╷ │ 64:    for oBugTranslation in aoBugTranslations:
│  ╷ ╷ ╷ ╷ ╷ │ 65:      if oBugTranslation.fbApplyToBugReport(oCdbWrapper, oBugReport):
│  ╷ ╷ ╷ ╷ ╷ ├─┐ cBugTranslation?.fbApplyToBugReport @ C:\BugIdn\modules\mBugId\mBugTranslations\cBugTranslation.py:141
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 140:    # If more top frames may be irrelevant, see if they are there and hide them:
│  ╷ ╷ ╷ ╷ ╷ ╷ │ 141:    if (oSelf.bAdditionalIrrelevantNoneTopStackFrames or oSelf.rb0AdditionalIrrelevantStackFrameSymbols) and oBugReport.o0Stack:
│  ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ o0Stack @ C:\BugIdn\modules\mBugId\mBugReport\cBugReport.py:113
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 112:    if oSelf.__o0Stack is None:
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 113:      oSelf.__o0Stack = cStack.foCreate(oSelf.__oProcess, oSelf.__oWindowsAPIThread, oSelf.uStackFramesCount);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cStack?.foCreate @ C:\BugIdn\modules\mBugId\mStack\cStack.py:227
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 226:        o0Function, i0OffsetFromStartOfFunction
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 227:      ) = oProcess.ftxSplitSymbolOrAddress(sbCdbSymbolOrAddress);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cProcess_ftxSplitSymbolOrAddress @ C:\BugIdn\modules\mBugId\mProcess\cProcess_ftxSplitSymbolOrAddress.py:31
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 30:    sbModuleCdbId = sb0ModuleCdbIdOrAddress;
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 31:    o0Module = oModule = oProcess.fo0GetModuleForCdbId(sbModuleCdbId);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ├─┐ cProcess_fo0GetModuleForCdbId @ C:\BugIdn\modules\mBugId\mProcess\cProcess_fo0GetModuleForCdbId.py:30
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 29:  o0Module = oProcess.fo0GetModuleForStartAddress(uStartAddress);
│  ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ ╷ │ 30:  assert o0Module is not None, \
│  ╒═══════════════════╛ ▲ Assertion failed: "cdb reports module 'b'ntdll'' to be at address 0x77980000 but there is no module there!?\nKnown modules:\n* Module <cdb id not cached> (C:\\temp\\foo.exe) at 0x40`0000\n* Module <cdb id not cached> (C:\\WINDOWS\\SYSTEM32\\ntdll.dll) at 0x7FF8`C013`0000\n* Module <cdb id not cached> (C:\\WINDOWS\\System32\\verifier.dll) at 0x57`0000\n* Module <cdb id not cached> (C:\\WINDOWS\\System32\\wow64.dll) at 0x7FF8`BF08`0000\n* Module <cdb id not cached> (C:\\WINDOWS\\System32\\wow64win.dll) at 0x7FF8`BFAB`0000\n* Module <cdb id not cached> (C:\\WINDOWS\\System32\\wow64cpu.dll) at 0x7797`0000"
│  │ __fRun @ C:\BugIdn\modules\mBugId\cCdbWrapper\cCdbWrapper_cHelperThread.py:66
│  │ 65:        cException, oException, oTraceBack = sys.exc_info();
│  │ 66:        if not oSelf.__oCdbWrapper.fbFireCallbacks("Internal exception", oSelf.__oThread, oException, oTraceBack):
│ ═╛ ▲ Application terminated because exception was not handled.
└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Please report the above details at the below web-page so it can be addressed:
    https://github.com/SkyLined/BugId/issues/new
If you do not have a github account, or you want to report this issue
privately, you can also send an email to:
    BugId@skylined.nl

In your report, please copy ALL the information about the exception reported
above, as well as the stack trace and BugId version information. This makes
it easier to determine the cause of this issue and makes for faster fixes.

If you can reproduce the issue, it would help a lot if you can run BugId in
verbose mode by adding the --verbose command-line argument.
as in: BugId -v --isa=x86 --n0ApplicationMaxRunTimeInSeconds=10 C:\temp\foo.exe -- C:\temp\foo.bar


  ____________________________________________________________________________
                              __             ╷                   ╷
   ││▌║█▐▐║▌▌█│║║│      _,siSP**YSis,_      ─╒╦╦══╦╗            ─╒╦╦╕    ╔╦╕
   ││▌║█▐▐║▌▌█│║║│    ,SP*'`    . `'*YS,      ║╠══╬╣ ╔╗ ╔╗ ╔╦═╦╗  ║║  ╔╦═╬╣
   ╵2808197631337╵   dS'  _    |    _ 'Sb    ╘╩╩══╩╝ ╚╩═╩╝ ╚╩═╬╣ ╘╩╩╛ ╚╩═╩╝
                    dP     \,-` `-<` `  Y;                 ╚╩═╩╝    ╮╷╭
      ╮╷╭          ,S`  \+' \      \    `Sissssssssssssssssssss,   :O()
     :O()          (S   (   | --====)   :SSSSSSSSSSSSSSSSSSSSSSD    ╯╵╰
      ╯╵╰  ╮╷╭     'S,  /+, /      /    ,S?********************'
           ()O:     Yb    _/'-_ _-<._.  dP
           ╯╵╰       YS,       |      ,SP         https://bugid.skylined.nl
  ____________________`Sbs,_    ' _,sdS`______________________________________
                        `'*YSissiSY*'`
                              ``
┌───[ Version information ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ ▲ BugId version: 2025-05-23 12:35 (in trial period).
│ ▲ mBugId version: 2025-05-23 12:34 (in trial period).
│ √ mConsole version: 2025-05-23 10:58.
│ √ mDateTime version: 2025-05-23 10:57.
│ √ mDebugOutput version: 2025-05-23 10:58.
│ √ mFileSystemItem version: 2025-05-23 10:58.
│ √ mHumanReadable version: 2025-05-23 10:57.
│ √ mMultiThreading version: 2025-05-23 10:58.
│ √ mNotProvided version: 2025-05-23 10:57.
│ √ mProductDetails version: 2025-05-23 10:58.
│ √ mRegistry version: 2025-05-23 10:58.
│ √ mWindowsAPI version: 2025-05-23 10:58.
│ √ mWindowsSDK version: 2025-05-23 10:58.
│ • Platform OS: Windows-10-10.0.19045-SP0 on AMD64 processor.
│ • Python version: 3.11.1, 64 bit.
│ • cdb.exe (x86) version: 10.0.17763.132.
│ • cdb.exe (x64) version: 10.0.17763.132.
│ (Underlined modules are covered by a license installed on this system.)
└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

ntdll seems to be reported at 0x77980000, but shows as being loaded at 0x7FF8C0130000. Interestingly, it is not deterministic. I've ran it around 1000 times, and it reproduced in about 15 cases. I assume it might be related to x86/x64 as you mentioned, but haven't had a chance yet to look into it in more detail.