windbg

Use WinDbg to Write Contents of Managed Byte[] to File

由 戏子无情 提交于 2020-01-10 10:00:10
问题 I have a crash dump from a production server that shows an OutOfMemoryException. The exception itself is not relevant here. I happened to run a !dso to view the stack objects: 0:042> !dso OS Thread Id: 0x1014 (42) ESP/REG Object Name 246eeb24 109a21bc System.UnhandledExceptionEventHandler 246eeb2c 39083998 System.Runtime.Remoting.Proxies.__TransparentProxy 246eeb34 39083b5c System.UnhandledExceptionEventArgs 246eeb48 39073280 System.Byte[] 246eec10 2e720050 System.OutOfMemoryException [snip]

How to use WinDbg to analyze the crash dump for VC++ application?

由 家住魔仙堡 提交于 2020-01-08 18:18:56
问题 How do I use WinDbg for analyzing a dump file? 回答1: Here are some general steps that will get you on your way: First, you must change your compiler's settings so that it creates PDB files, even for release builds. Later versions of the Visual C++ compiler do this by default, but in many versions of Visual C++ you must do this yourself. Create program database files, and then keep an archive of those files along with each build of your application. It is critical that every build of your

How to use WinDbg to analyze the crash dump for VC++ application?

由 ε祈祈猫儿з 提交于 2020-01-08 18:18:14
问题 How do I use WinDbg for analyzing a dump file? 回答1: Here are some general steps that will get you on your way: First, you must change your compiler's settings so that it creates PDB files, even for release builds. Later versions of the Visual C++ compiler do this by default, but in many versions of Visual C++ you must do this yourself. Create program database files, and then keep an archive of those files along with each build of your application. It is critical that every build of your

windbg的初始化脚本

由 …衆ロ難τιáo~ 提交于 2020-01-08 12:24:57
每次启动windbg时，我都会运行一些命令，我突然意识到，也许是时候将这些命令放到脚本中，让windbg自动执行它了。 首先，创建一个包含要运行的所有命令的文件。 对于本例，让我创建一个名为“dbg-prep.wds”的文件 C:\Users\ilhoye\Desktop\WinDbg> type dbg-prep.cmd .symfix .reload .load mex .load kdexts aS !pr !process 一旦我们有了这个，我们就可以用'-c'选项启动windbg。‘-c'是windbg启动时要执行的命令，但对于我们的情况，我们希望执行几个命令，这就是为什么我首先创建了一个脚本。 为此，我们仍然使用'-c'选项，但现在我们希望提供如下文件路径。 windbg.exe -c "$$><F\脚本\dbg-prep.wds“ 请注意'-c'选项需要像上面那样引用。 当然，输入所有这些都很麻烦，因此最好为此创建一个快捷方式。在脚本里可以添加任何你想要做的事情和命令。 来源： https://www.cnblogs.com/yilang/p/12165779.html

请右击Windbg的DML

由 大憨熊 提交于 2020-01-08 09:57:03
你们都知道并喜欢DML，那些出现在WinDbg输出中的超链接，允许你们在思考崩溃代码的含义时漫无目的地点击。 但是，你知道DML在WinDbg的Windows10版本中甚至更好吗？已添加对游戏更改功能的支持：右键单击！ 是的，您现在可以右键单击DML输出并打开一个新的选项菜单： 此菜单中包括在新窗口中打开链接的功能，同时弹出一个命令浏览器窗口，显示您的输出： 然后，您可以停靠或浮动此窗口，以便在继续分析时方便地获得输出（当然，命令浏览器已经存在一段时间了，但这只会使它更容易！）。 更好的是，您还可以获得特定于命令的菜单项。我最喜欢的例子是x命令。 如果右键单击某个条目，则可以选择在指定函数上设置断点。 不幸的是，这只在你有私人符号的情况下有效，但这有多酷？! 我找不到任何关于如何添加自己的右键菜单项的文档，所以我做了一些spelunging。右键单击某个项后，我对WinDbg进程的内存中的每个字符串执行了转储。在搜索输出时，我找到了要查找的内容： <link cmd=”u fffff80061909850″><altlink name=”Set Breakpoint [bp]” cmd=”bp fffff80061909850″>OsrIsolate!IsolNetworkCleanup</link> altlink标签是实现这一点的诀窍。在使用它的过程中

Removing type information from symbols partly

由 守給你的承諾、 提交于 2020-01-07 01:48:09
问题 As we learned recently, Microsoft has stripped type information from symbols in some versions of ntdll . Imagine I have the source code of a library and I would like to publish public symbols, but remove some type definitions from that PDB, how would I technically achieve this, especially without breaking the PDB identity information (timestamp and checksum)? I could not find a compiler switch in the online documentation that would allow me to pass a list of types to be excluded. Note that I

How to disable explicitly named exceptions in cdb in one command?

由 两盒软妹~` 提交于 2020-01-06 13:14:21
问题 The sx family of commands accept either the name of the exception/event, like av, the exception code or *. The thing is that * catches all the unnamed exceptions. What if I want to execute a command when any exception happens, be it explicitly named or not? For instance, sxe -c "bla-bla-bla" -c2 "ku-ku-ku" av sxe -c "bla-bla-bla" -c2 "ku-ku-ku" dz sxe -c "bla-bla-bla" -c2 "ku-ku-ku" * Instructs the debugger to: execute bla-bla-bla command on the first chance Access Violation execute ku-ku-ku

How to disable explicitly named exceptions in cdb in one command?

由 浪子不回头ぞ 提交于 2020-01-06 13:14:01
问题 The sx family of commands accept either the name of the exception/event, like av, the exception code or *. The thing is that * catches all the unnamed exceptions. What if I want to execute a command when any exception happens, be it explicitly named or not? For instance, sxe -c "bla-bla-bla" -c2 "ku-ku-ku" av sxe -c "bla-bla-bla" -c2 "ku-ku-ku" dz sxe -c "bla-bla-bla" -c2 "ku-ku-ku" * Instructs the debugger to: execute bla-bla-bla command on the first chance Access Violation execute ku-ku-ku

How to escape quotation marks in WinDbg's startup command line opening a dump

由 独自空忆成欢 提交于 2020-01-04 20:41:10
问题 Following this answer, I'm trying to set up a .dmp shell command in the Registry using the -c "..." switch to execute commands whenever I open a dump file. While this works for any commands not using quotation marks, I'd now like to use a command which needs quotation marks. How can I escape the quotation marks to that they are not seen as the end of the -c "..." switch? I tried: escaping with a backslash \" escaping by doubling the quotation marks "" Details are : Registry key: HKEY_CLASSES

WinDbg, display Symbol Server paths of loaded modules (even if the symbols did not load)?

由 给你一囗甜甜゛ 提交于 2020-01-04 09:27:53
问题 Is there a way from WinDbg, without using the DbgEng API, to display the symbol server paths (i.e. PdbSig70 and PdbAge) for all loaded modules? I know that lml does this for the modules whose symbols have loaded. I would like to know these paths for the symbols that did not load so as to diagnose the problem. Anyone know if this is possible without having to utilize the DbgEng API? edited: I also realize that you can use !sym noisy to get error messages about symbols loading. While this does
订阅 windbg