Postmortem Debugging in Software

Encode QR Code JIS X 0510 in Software Postmortem Debugging
13
Quick Response Code Generation In Visual C#.NET
Using Barcode printer for VS .NET Control to generate, create QR Code ISO/IEC18004 image in .NET framework applications.
Postmortem Debugging
Draw QR-Code In .NET
Using Barcode encoder for ASP.NET Control to generate, create QR Code ISO/IEC18004 image in ASP.NET applications.
Task List
QR Code JIS X 0510 Printer In VS .NET
Using Barcode creator for VS .NET Control to generate, create Quick Response Code image in Visual Studio .NET applications.
The task list contains a list of processes running on the system at the point of failure The list is very similar to the output of the familiar tlistexe command
Denso QR Bar Code Drawer In VB.NET
Using Barcode generation for VS .NET Control to generate, create QR Code image in VS .NET applications.
Module List
UPC-A Supplement 5 Generator In Visual Studio .NET
Using Barcode encoder for ASP.NET Control to generate, create UPC Code image in ASP.NET applications.
The module list section contains all the modules (including the address range each module occupies) that were loaded into the faulting process s address space at the point of failure For our sample run, the module list consists of
Making Bar Code In Visual Studio .NET
Using Barcode printer for Visual Studio .NET Control to generate, create barcode image in VS .NET applications.
* > Module List < * (0000000001000000 - 0000000001003000: (0000000076390000 - 00000000763ad000: (0000000077b40000 - 0000000077b62000: (0000000077c00000 - 0000000077c08000: (0000000077c10000 - 0000000077c68000: (0000000077d40000 - 0000000077dd0000: (0000000077dd0000 - 0000000077e6b000: (0000000077e70000 - 0000000077f01000: (0000000077f10000 - 0000000077f57000: (0000000077f60000 - 0000000077fd6000: (000000007c800000 - 000000007c8f4000: (000000007c900000 - 000000007c9b0000: C:\AWDBIN\WinXPx86chk\ awdscenario1exe C:\WINDOWS\system32\IMM32DLL C:\WINDOWS\system32\Apphelpdll C:\WINDOWS\system32\VERSIONdll C:\WINDOWS\system32\msvcrtdll C:\WINDOWS\system32\USER32dll C:\WINDOWS\system32\ADVAPI32dll C:\WINDOWS\system32\RPCRT4dll C:\WINDOWS\system32\GDI32dll C:\WINDOWS\system32\SHLWAPIdll C:\WINDOWS\system32\kernel32dll C:\WINDOWS\system32\ntdlldll
Create Barcode In Visual C#
Using Barcode generation for VS .NET Control to generate, create barcode image in .NET applications.
State Dump for Thread ID X
ECC200 Drawer In C#.NET
Using Barcode generator for .NET Control to generate, create ECC200 image in Visual Studio .NET applications.
The state dump for the faulty thread includes the processor register state, as well as the unassembly of code prior to and after the faulting instruction Additionally, the assembly code in this section has one annotation, FAULT ->, that helps pinpoint the exact location of the failure
Generate EAN-13 In .NET
Using Barcode drawer for ASP.NET Control to generate, create GTIN - 13 image in ASP.NET applications.
* > State Dump for Thread Id 0xb6c < * eax=00000000 ebx=7ffdf000 ecx=77c418bf edx=77c61b78 esi=01c709ea edi=fcead396 eip=0100127e esp=0007ff1c ebp=0007ff44 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 function: awdscenario1!wmain 01001259 8b4dfc 0100125c 51
Code128 Encoder In .NET Framework
Using Barcode creation for ASP.NET Control to generate, create Code 128B image in ASP.NET applications.
mov push
Code-39 Generation In .NET
Using Barcode maker for ASP.NET Control to generate, create Code-39 image in ASP.NET applications.
ecx,[ebp-0x4] ecx
Barcode Decoder In Visual Studio .NET
Using Barcode recognizer for .NET framework Control to read, scan read, scan image in VS .NET applications.
Windows Error Reporting
Generate EAN13 In .NET Framework
Using Barcode generation for Visual Studio .NET Control to generate, create EAN13 image in VS .NET applications.
0100125d 01001262 01001265 01001266 0100126b 01001271 01001274 0100127b FAULT ->0100127e 01001281 01001283 01001288 0100128e 01001291 01001296 0100129c 0100129f 010012a5 010012a7
Painting Barcode In VB.NET
Using Barcode maker for .NET Control to generate, create barcode image in .NET applications.
e84e000000 8b55fc 52 68c0100001 ff1544100001 83c408 c745fc00000000 8b45fc c60000 eb0e 68a4100001 ff1544100001 83c404 688c100001 ff1544100001 83c404 ff154c100001 33c0 8be5
GS1 - 13 Encoder In Java
Using Barcode encoder for Java Control to generate, create EAN-13 Supplement 5 image in Java applications.
call awdscenario1!StringCchCopyA (010012b0) mov edx,[ebp-0x4] push edx push 0x10010c0 call dword ptr [awdscenario1!_imp__printf (01001044)] add esp,0x8 mov dword ptr [ebp-0x4],0x0 mov eax,[ebp-0x4] mov byte ptr [eax],0x0 ds:0023:00000000= jmp awdscenario1!wmain+0xd1 (01001291) push 0x10010a4 call dword ptr [awdscenario1!_imp__printf (01001044)] add esp,0x4 push 0x100108c call dword ptr [awdscenario1!_imp__printf (01001044)] add esp,0x4 call dword ptr [awdscenario1!_imp___getch (0100104c)] xor eax,eax mov esp,ebp
Encode Bar Code In Java
Using Barcode creation for Java Control to generate, create barcode image in Java applications.
13 POSTMORTEM DEBUGGING
Generate USS Code 39 In C#.NET
Using Barcode encoder for .NET framework Control to generate, create Code 3 of 9 image in Visual Studio .NET applications.
Stack Back Trace
Paint Code 128 Code Set B In .NET
Using Barcode generator for VS .NET Control to generate, create Code128 image in Visual Studio .NET applications.
The stack back trace section contains the stack trace of the faulting thread Please note that the stack back trace might (and most likely will) contain the incorrect frames, as symbolic information is typically not available For example, frame 3 in the following shows an incorrect frame for a function in kernel32dll The fact that incorrect frames are reported is not an issue, however, because the correct symbols can be loaded when analyzing the fault postmortem using the debuggers
Bar Code Generator In VS .NET
Using Barcode generator for .NET framework Control to generate, create bar code image in Visual Studio .NET applications.
* > Stack Back Trace < * *** ERROR: Symbol file could not be found Defaulted to export symbols for C:\WINDOWS\system32\kernel32dll WARNING: Stack unwind information not available Following frames may be wrong ChildEBP RetAddr Args to Child 0006ff44 01001495 00000001 00262430 00264260 awdscenario1!wmain+0xbe (FPO: [Non-Fpo]) 0006ffc0 7c816fd7 20c88c32 01c7a3a2 7ffd7000 awdscenario1!wmainCRTStartup+0x12f (FPO: [Non-Fpo]) 0007fff0 00000000 0100131d 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49
Bar Code Generation In Visual C#
Using Barcode drawer for .NET Control to generate, create barcode image in VS .NET applications.
13
Postmortem Debugging
Raw Stack Dump
The raw stack dump section contains a raw dump of the stack at the point of failure
* > Raw Stack Dump < * 000000000007ff1c 1a 00 00 000000000007ff2c 1a 00 00 000000000007ff3c a4 10 00 000000000007ff4c 01 00 00 000000000007ff5c 54 10 00 000000000007ff6c 00 00 00 000000000007ff7c a4 5b 64 000000000007ff8c 00 00 00 000000000007ff9c 00 00 00 000000000007ffac 40 fb 07 000000000007ffbc 00 00 00 000000000007ffcc 8f f3 c6 000000000007ffdc 40 fb 07 000000000007ffec 00 00 00 000000000007fffc 00 00 00 000000000008000c 98 24 00 000000000008001c 00 00 00 000000000008002c 34 00 00 000000000008003c 00 00 00 000000000008004c 02 00 00 00 00 01 00 01 00 2d 00 00 00 00 01 00 00 00 00 00 00 00 00 00 c0 00 70 94 9c 8f 05 28 e0 f0 00 ff 00 41 c4 14 14 00 00 00 45 00 3b ff ff f3 00 45 ff ff c0 ff 00 63 00 00 01 00 00 00 03 00 03 07 07 c6 00 03 07 07 fd ff 00 74 00 00 00 00 00 00 00 00 00 00 00 01 c0 00 00 00 7f ff 00 78 00 00 00 00 00 a5 a5 c0 28 98 58 00 01 00 2e d7 05 a8 00 20 00 01 01 00 00 10 10 ff 45 ff 10 c0 00 00 15 6f 00 9a 00 00 00 00 00 00 00 00 00 07 03 07 00 fd 00 00 00 81 00 83 00 00 00 00 00 00 00 01 01 00 00 00 01 7f 00 00 01 7c c0 7c 00 00 00 00 00 00 00 bf bf 48 50 a0 5c 00 70 7c c0 a4 c8 e0 1d 01 20 06 00 00 00 10 10 14 10 ff 10 dc 3b ff 10 5b ff 6f 13 00 00 00 00 00 00 00 00 00 00 07 00 31 03 07 00 64 07 81 00 00 00 00 00 00 00 01 01 01 01 00 01 e4 00 00 01 2d 00 7c 01 00 00 00 00 00 00 E H p;(EP T X\ [d-1 p; (E| @ o|[d @|o| Actx $ 4
In addition to the wealth of information logged in the Dr Watson log file, the dump file is perhaps the most important piece of information in the postmortem analysis process The dump file is located in the same directory as the log file and is named userdmp (unless the configuration has changed) Let s use the dump file for our awdscenario1exe run and load it in the debugger (remember to use the z switch)
This dump file has an exception of interest stored in it The stored exception information can be accessed via ecxr (bb0b6c): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=7ffdf000 ecx=77c418bf edx=77c61b78 esi=01c709ea edi=fcead396 eip=0100127e esp=0007ff1c ebp=0007ff44 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 awdscenario1!wmain+0xbe: 0100127e c60000 mov byte ptr [eax],0 ds:0023:00000000= 0:000> kb