crash-dumps

Iterating through !DumpHeap output to read value at memory offset

我与影子孤独终老i 提交于 2019-12-01 23:17:05
问题 I'm trying to come up with a WinDbg command line expression that takes the output of the !DumpHeap command and for each address, reads a 64-bit value from offset 0x08 after the address. I think this is possible (not sure about it) but every attempt I made so far fails with some error. I searched a lot but most WinDbg articles show simple examples which I can try but my attempts fail. I have a process dump of an ASP.NET worker process. The process has some memory growth but there's no clear

How to catch unhandled exception from .Net application with procdump (or similar)?

冷暖自知 提交于 2019-12-01 22:14:31
The long (boring) story Currently i have an application that leads to an exception on only one pc. After some digging around i could encapsulate the problem with a small sample application, but the true reason is still hiding. Due to the fact that on this pc is no Visual Studio installed nor we are able to do so i searched for another solution to find the true reason. In a first approach i stripped down my small application more and more by just carefully reading the exception message, compare to the code and try & error to come to the concrete line of problem. But that wouldn't help to get

iPhone Crash with “No Backtrace”

馋奶兔 提交于 2019-12-01 21:11:18
My iPhone app was recently rejected from the App Store "because it crashes on launch". However, I cannot reproduce this crash. The app works perfectly on both the simulator and a device with the same hardware and software Apple tested it on (iPhone 3.1 running iOS 4). The crash logs they sent me say "No Backtrace Available", so I have nowhere to look in my code. Here's an example: Incident Identifier: [...] CrashReporter Key: [...] Hardware Model: iPhone3,1 Process: [MyApp] [1172] Path: /var/mobile/Applications/[...]-3F1B-4504-A572-[...]/[MyApp].app/[MyApp] Identifier: [MyApp] Version: ??? (??

Iterating through !DumpHeap output to read value at memory offset

江枫思渺然 提交于 2019-12-01 20:53:16
I'm trying to come up with a WinDbg command line expression that takes the output of the !DumpHeap command and for each address, reads a 64-bit value from offset 0x08 after the address. I think this is possible (not sure about it) but every attempt I made so far fails with some error. I searched a lot but most WinDbg articles show simple examples which I can try but my attempts fail. I have a process dump of an ASP.NET worker process. The process has some memory growth but there's no clear offender so I'm trying to list a number of objects that appear many times in memory. I'm using sos.dll

Reading objects from memory with MDbgEng

元气小坏坏 提交于 2019-12-01 08:59:04
问题 I wanted to help out @mark in a question where he is asking for an API to dump many objects from a .NET crash dump file. So I wrote the following code using mdbgeng , but unfortunately it fails with a NotImplementedException when trying to enumerate the objects in memory. using System; using System.Runtime.InteropServices; using Microsoft.Samples.Debugging.CorDebug; using Microsoft.Samples.Debugging.CorDebug.Utility; using Microsoft.Samples.Debugging.MdbgEngine; using Microsoft.Samples

Is WinDbg supposed to be so excruciatingly slow?

泄露秘密 提交于 2019-12-01 07:38:04
I'm trying to analyze some mini crash dumps. I'm using Windows 10 Pro Build 1607 and WinDbg 10.0.14321.1024. I have my symbol file path set to SRV*C:\SymCache*https://msdl.microsoft.com/download/symbols Basically, whenever I load up a minidump (all < 1 MB .dmp files), it takes WinDbg forever to actually analyze them. I understand the first run can take long, but it took mine almost 12 hours before it would let me enter a command. I assumed that, since the symbols were cached, it wouldn't take long at all to re-open the same .dmp. This is not the case. It loads up, goes pretty much

Get the right .net native symbols for Windbg

早过忘川 提交于 2019-12-01 06:58:30
I'm doing some crash dump debugging, where I am looking a dump taken from a production server. The machine I'm running WinDbg on must have a slightly different version of the .NET runtime installed -- I'm getting errors loading the native images of .NET system assemblies (so can't load for example System.Data.Linq ). What is the best way to ensure that my debug machine has access to all the right symbols? Edit Added output of lmv for Thomas Weller 000007fb`68660000 000007fb`68993000 System_Data_Linq_ni C (pdb symbols) C:\Program Files\Debugging Tools for Windows (x64)\sym\System.Data.Linq.pdb

Get the right .net native symbols for Windbg

本秂侑毒 提交于 2019-12-01 04:30:22
问题 I'm doing some crash dump debugging, where I am looking a dump taken from a production server. The machine I'm running WinDbg on must have a slightly different version of the .NET runtime installed -- I'm getting errors loading the native images of .NET system assemblies (so can't load for example System.Data.Linq ). What is the best way to ensure that my debug machine has access to all the right symbols? Edit Added output of lmv for Thomas Weller 000007fb`68660000 000007fb`68993000 System

How can I know the CLR version of a crash dump?

只谈情不闲聊 提交于 2019-12-01 03:58:41
I have a minidump crashed from a .NET application. Is there any way to know the CLR version (e.g. version of mscorwks.dll) of the fault machine (which generates the crash dump) using either Windbg or some other tool? In WinDbg: the easiest way is to use the !eeversion command, but if you want additional info you can use the lm command with the v verbose option for the runtime module mscorwks . If you're on .NET 4 the runtime is called clr , so in that case you need to change the command accordingly. 0:026> lm vm mscorwks start end module name 79e70000 7a3ff000 mscorwks T (no symbols) Loaded

Where are crash dumps in Windows 10 Mobile Creators update?

。_饼干妹妹 提交于 2019-12-01 00:34:35
In Win 10 Mobile was setting for developers where I could set the count of crash dumps must be saved on a device. After installing Creators Update that setting disappeared and crash dumps are not saving anymore. Is it possibble to save crash dumps on a device with Creators Update ? It's necessary for me. I know about app insights, but it's not variant - I need a full dump with native symbols. Microsoft changed this since Windows 10 Mobile Creators update v1703. After activating Device Portal use your development PC and open the Device portal Url that is shown on the phone. Now the updated