分析崩溃转储文件[重复]

Question

我想要帮助我如何有效地创建并分析一个正在经历随机崩溃的 c++ 应用程序的转储文件。如何在应用程序自动崩溃时创建转储文件？我尝试按照 Windows 提供的本教程进行操作： https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps

但我不确定这是否适用于我的情况。 此外，使用 winbdbg，我尝试打开一个由任务管理器简单创建的转储文件，以防应用程序使用的内存超出预期。结果：

For analysis of this file, run !analyze -v
wow64cpu!CpupSyscallStub+0xc:
00000000`77291cbc c3              ret
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for RFPrj.exe

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 1

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on RTX2LBSAPW1V

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 105

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 72

    Key  : Analysis.System
    Value: CreateObject

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 2236962

    Key  : Timeline.Process.Start.DeltaSec
    Value: 27699


NTGLOBALFLAG:  2000100

APPLICATION_VERIFIER_FLAGS:  80001005

APPLICATION_VERIFIER_LOADED: 1

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 0000000000000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00007ac8

PROCESS_NAME:  RFPrj.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE_STR:  80000003

STACK_TEXT:  
00000000`00ffe848 00000000`77291b99 : 00000023`77311cec 00000000`012f0023 00000000`00000000 00000000`012f6e6c : wow64cpu!CpupSyscallStub+0xc
00000000`00ffe850 00000000`77291199 : 00000000`012ff688 00007ffc`7d00d0c4 00000000`00ffe920 00007ffc`7d00c5e7 : wow64cpu!Thunk2ArgNSpNSpReloadState+0xc
00000000`00ffe900 00007ffc`7d00cfda : 00000000`0106d000 00000000`00820110 00000000`00000000 00000000`00fff180 : wow64cpu!BTCpuSimulate+0x9
00000000`00ffe940 00007ffc`7d00cea0 : 00000000`00000000 00000000`02c2eed8 00000000`00000000 00000000`00000000 : wow64!RunCpuSimulation+0xa
00000000`00ffe970 00007ffc`7f48538d : 00000000`00000010 00000000`00000010 00007ffc`7f4dd120 00000000`0106c000 : wow64!Wow64LdrpInitialize+0x120
00000000`00ffec20 00007ffc`7f47383f : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : ntdll!LdrpInitializeProcess+0x1789
00000000`00fff060 00007ffc`7f427cb3 : 00000000`00000000 00007ffc`7f3b0000 00000000`00000000 00000000`0106e000 : ntdll!_LdrpInitialize+0x4bb73
00000000`00fff100 00007ffc`7f427c5e : 00000000`00fff180 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrpInitialize+0x3b
00000000`00fff130 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe


SYMBOL_NAME:  wow64cpu!CpupSyscallStub+c

MODULE_NAME: wow64cpu

IMAGE_NAME:  wow64cpu.dll

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb

FAILURE_BUCKET_ID:  BREAKPOINT_AVRF_80000003_wow64cpu.dll!CpupSyscallStub

OS_VERSION:  10.0.17763.1

BUILDLAB_STR:  rs5_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {19b8a07b-d2f7-3179-d96e-5eb594405f99}

Followup:     MachineOwner

---

无法从中获得任何有用的数据。不确定我的问题是否是我如何创建转储，即，这是否仅在我在崩溃时获得转储时才有效。 有没有很好的演练或教程？

我有以下工具可用：windbg、vs2019。

Answer 1

您可以配置 WER 以创建和存储转储文件。
下面是一个演练（os windows 10 64 bit）

DumpFile 存储在其默认路径 %LOCALAPPDATA%\CrashDumps
我已经清除了演示文件夹

:\>ls %localappdata%\CrashDumps

编译为 32 位二进制文​​件的崩溃应用的简单代码

:\>ls
complink.bat  except.cpp

:\>cat complink.bat
cl /Zi /W4 /Gs- /analyze:autolog- /Od except.cpp /link /release /subsystem:windows /entry:main
:\>cat except.cpp
int main (void)
{
        int a =0;
        int b = 3;
        return b/a;
}
:\>complink.bat

:\>cl /Zi /W4 /Gs- /analyze:autolog- /Od except.cpp /link /release /subsystem:windows /entry:main
Microsoft (R) C/C++ Optimizing Compiler Version 19.16.27045 for x86
Copyright (C) Microsoft Corporation.  All rights reserved.

except.cpp
Microsoft (R) Incremental Linker Version 14.16.27045.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:except.exe
/debug
/release
/subsystem:windows
/entry:main
except.obj

执行此操作会崩溃，但不会创建转储，因为 WER 未配置为创建转储文件

:\>except.exe

:\>ls %localappdata%\CrashDumps

配置 WER 以创建转储文件（常规注意事项适用于编辑注册表）

:\>reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
The operation completed successfully. 

现在执行应用程序会崩溃，还会写一个可以在windbg中加载的转储文件

:\>ls %localappdata%\CrashDumps
except.exe.1600.dmp

:\>file %localappdata%\CrashDumps\except.exe.1600.dmp
C:\Users\xxxx\AppData\Local\CrashDumps\except.exe.1600.dmp: Mini DuMP crash report, 12 streams, Fri Jan  7 19:23:33 2022, 0x121 type