Basic Debugging of an Application Crash

re: Basic Debugging of an Application Crash

Greg — Tue, 29 May 2007 17:47:08 GMT

Great post... Thank you.

Link: Basic Debugging of an Application Crash

Matt Johnson's Technical Adventures — Tue, 29 May 2007 17:48:06 GMT

The Microsoft Performance Team has released a basic guide to debugging an application crash. This is

re: Basic Debugging of an Application Crash

Rahul Thomas — Wed, 30 May 2007 01:12:22 GMT

Hey Guys

Can you help me decipher the following file

There is a Watson/Bucket ID 15362174

AppName (P1) outlook.exe

AppVer (P2) 12.0.4518.1014

AppStamp (P3) 4542840f

AsmAndModName (P4) mscorlib

AsmVer (P5) 2.0.0.0

ModStamp (P6) 4536f11f

MethodDef (P7) 2336

Offset (P8) 23

ExceptionType (P9) system.formatexception

A Crash Dump Analysis shows the followng:

053fe6e4 052c5a38 Microsoft.BusinessSolutions.eCRM.BusinessLayer.BcmDataStore

053fe714 052c5dd8 System.Collections.Generic.GenericEqualityComparer`1[[System.Guid, mscorlib]]

053fe99c 052c5a38 Microsoft.BusinessSolutions.eCRM.BusinessLayer.BcmDataStore

053fe9cc 052c5dd8 System.Collections.Generic.GenericEqualityComparer`1[[System.Guid, mscorlib]]

053feb14 052c5a38 Microsoft.BusinessSolutions.eCRM.BusinessLayer.BcmDataStore

054078b4 790ea218 System.String Arg_COMException

054078c0 0538d53c System.String Error HRESULT E_FAIL has been returned from a call to a COM component.

054078c8 790e6324 System.String Format_BadDateTime

054078dc 790e4d18 System.String Word_At

054078f0 790e4d38 System.String StackTrace_InFileLineNumber

054083c8 0540d620 System.Collections.Hashtable+bucket[]

0540840c 0540e170 System.Collections.Hashtable+bucket[]

Thanks & Regards

Rahul Thomas

Capturing Application Crash Dumps

Ask the Performance Team — Fri, 15 Jun 2007 12:36:30 GMT

Following on from our posts on the Basic Troubleshooting Toolkit and Basic Debugging of an Application

Capturing Application Crash Dumps

Tue, 19 Jun 2007 23:59:28 GMT

Great article published by Microsoft Enterprise Platforms Windows Server Performance Team about capturing

top 10 windbg.exe usage articles

roy ashbrook — Mon, 25 Jun 2007 00:10:28 GMT

These are the articles (in no particular order) that I felt best showed a thorough use of the windbg

What a Heap of ... (Part Two)

Ask the Performance Team — Fri, 29 Jun 2007 13:14:50 GMT

On Tuesday, we talked about Heap - what it is and how it works. Today we're going to continue our look

re: Basic Debugging of an Application Crash

Rudi — Sat, 11 Aug 2007 03:15:56 GMT

Please please help:

I get Generic Host error all the time:

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(44c.21ec): Access violation - code c0000005 (first/second chance not available)

eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080 edi=00000000

eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

ntdll!KiFastSystemCallRet:

7c90eb94 c3 ret

0:074> !analize -v

No export analize found

0:074> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for advapi32.dll -

*** ERROR: Module load completed but symbols could not be loaded for svchost.exe

*** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for shsvcs.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for dhcpcsvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for schedsvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for rpcrt4.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ersvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for pchsvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for srvsvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for hidserv.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for wmisvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for wuaueng.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for wuauserv.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for userenv.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for authz.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for browser.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for wscsvc.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ncprov.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ncobjapi.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for tapisrv.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for rasmans.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for rastapi.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for unimdm.tsp -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for uniplat.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for kmddsp.tsp -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ndptsp.tsp -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for h323.tsp -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for hidphone.tsp -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for tapi32.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for rasppp.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ssdpapi.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for msvcrt.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for esent.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for w32time.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for mswsock.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for faultrep.dll -

FAULTING_IP:

00000000 ?? ???

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 00000000

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000000

Attempt to read from address 00000000

DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR

PROCESS_NAME: svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

FAILED_INSTRUCTION_ADDRESS:

00000000 ?? ???

LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000

STACK_TEXT:

WARNING: Frame IP not in any known module. Following frames may be wrong.

00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0

00a5ffb4 7c80b683 02d9b088 00000000 00000000 ole32!StringFromGUID2+0x5da

00a5ffec 00000000 774fe429 02d9b088 00000000 kernel32!GetModuleFileNameA+0x1b4

FOLLOWUP_IP:

ole32!StringFromGUID2+5da

774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ole32

IMAGE_NAME: ole32.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93

FAULTING_THREAD: 000021ec

PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR

BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR

SYMBOL_NAME: ole32!StringFromGUID2+5da

STACK_COMMAND: ~74s; .ecxr ; kb

FAILURE_BUCKET_ID: APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da

BUCKET_ID: APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da

Followup: MachineOwner

---------

0:074> lmvm ole32

start end module name

774e0000 7761d000 ole32 (export symbols) ole32.dll

Loaded symbol image file: ole32.dll

Mapped memory image file: D:\WINDOWS\system32\ole32.dll

Image path: D:\WINDOWS\system32\ole32.dll

Image name: ole32.dll

Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)

CheckSum: 0013DC6B

ImageSize: 0013D000

File version: 5.1.2600.2726

Product version: 5.1.2600.2726

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 2.0 Dll

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: OLE32.DLL

OriginalFilename: OLE32.DLL

ProductVersion: 5.1.2600.2726

FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)

FileDescription: Microsoft OLE for Windows

re: Basic Debugging of an Application Crash

CC Hameed — Sun, 12 Aug 2007 12:55:03 GMT

Rahul & Rudi -

For both of your situations, you should open up a case with Microsoft Support.

- CC Hameed

re: Basic Debugging of an Application Crash

Dhiraj Ramakrishnan — Sat, 18 Aug 2007 05:29:56 GMT

This was great help. Wonderful article.

Erasing drwtsn32.log

fx — Sat, 08 Sep 2007 13:22:50 GMT

I'd like to know what would happen if we delete the drwtsn32.log. Mine is actually 2.7Go (hum...it crashes sometimes) and I'm not able to visualize it anymore. SO the question is : may I delete this file.

Thank you so much for your reply,

Troubleshooting Server Hangs - Part One

Ask the Performance Team — Tue, 25 Sep 2007 17:04:24 GMT

Following on from our post on troubleshooting a basic application crash , it's time to start troubleshooting

re: Basic Debugging of an Application Crash

Clark — Mon, 22 Jun 2009 12:43:00 GMT

This is awesomely helpful for a Windbg newbie!

Thank you!

re: Basic Debugging of an Application Crash

qwertylesh — Wed, 12 Aug 2009 15:07:42 GMT

Hi MS Performance Team,

Your article does not mention (or ive missed it) an alternate path for the log or crash dump file for Vista users. Since all the user account paths are modified, the default path mentioned in the article only leads to a dynamic shortcut which disallows access without permissions modification.

I tried looking myself and will keep doing so, the closest path I can find is Drive:\Users\Name\AppData\Local\Microsoft\Windows\WER

However, still could not find more information or a crash dump (for my crashed application)

If you know please let me know it will be of great assistance to me.

qwertylesh

re: Basic Debugging of an Application Crash

molotov — Sat, 15 Aug 2009 02:44:59 GMT

Hi qwertylesh,

For Vista SP1+, check this out:

WER Settings @

http://msdn.microsoft.com/en-us/library/bb513638%28VS.85%29.aspx

re: Basic Debugging of an Application Crash

qwertylesh — Thu, 29 Oct 2009 13:08:51 GMT

Hi molotov

thank you immensely for the reply, many months ago albeit (sorry for such a late reply).

Next time I need to find the dump path, i'll check the LocalDump string as mentioned in the url you have provided. :)

kind regards.

qwertylesh