WINDBG find the problem exception stack, stack trace unhandledexceptionfilter

UnhandledExceptionFilterA function call does not have an exception handler definition to handle the exception that is thrown. The function usually passes the exception to the Ntdll.dll file, which will catch and attempt to process it.

In some cases where the memory snapshot of the process exists, you can see that a thread that holds the lock point is called by a thread UnhandledExceptionFilterFunction. In these cases, you can follow the steps in this article to identify the DLL that caused the exception. Windbg.exe Opening a dump fileDownload and install the debug program. To download the debugger, visit the following Microsoft Web site: Microsoft Debugging Tools
Http://www.microsoft.com/whdc/devtools/ddk/default.mspx (http://www.microsoft.com/whdc/devtools/ddk/ default.mspx) go to the WinDbg directory and use the tool CDB to generate the dump file: CDB-PV-PN process name-C ". dump/m c:/file name. dmp;q", for example: CDB-PV-PN explorer.exe-c ". Dump /M c:/explorer.dmp;q Open the Installation location folder for the debugger, and then double-click Windbg.exeTo start the debugger. In filemenu, click turn on crash dumps(or press CTRL + D), and then select the dump file that you want to view. ' The exception stack uses Windbg.exe in Windbg.exe, which opens the. dmp file, the process. Make sure that you point to the symbol path in the correct location. For more information about how to do this, visit the following Microsoft Web site: How to get symbols
Http://www.microsoft.com/whdc/devtools/ddk/default.mspx (http://www.microsoft.com/whdc/devtools/ddk/ default.mspx) at the command prompt, type ~*KB to list all the threads in the process. Identifies the thread that made the function call kernel32! UnhandledExceptionFilter。 It looks similar to the following:

  Id:f0f0f0f0.a1c   suspend:1 Teb 7ff72000 unfrozen
ChildEBP RetAddr  Args to Child              
09a8f334 77eb9b46 0000244c 00000001 00000000 ntdll! ZWWAITFORSINGLEOBJECT+0XB [I386/usrstubs.asm @ 2004]

[D:/nt/private/windows/base/client/thread.c @ 1753]
09a8ffec 00000000 787bf0b8 0216fe94 00000000 kernel32! basethreadstart+0x65 [d:/nt/private/windows/base/client/support.c @ 453]

Switch to the thread (in this example, the thread is "~ 120s"). Displays the first parameter of the memory content at the specified position kernel32! UnhandledExceptionFilterBy using DD first parameter。 This points to exception_pointersStructure

09a8f66c  
09a8f67c  
09a8f68c  
09a8f69c  
09a8f6ac  
09a8f6bc  
09a8f6cc  
09A8F6DC  00000001 61746164 7073612e 09a8f71c

The first DWORD value indicates an exception record. To obtain information about the type of exception, run the following at a command prompt: . EXR first DWORD from step 6

EXCEPTIONADDRESS:78011F32 (msvcrt!strnicmp+0x00000092)
   
  

   
   
Attempt to read from address 00000000

The second DWORD value is the context record. To get context information, run the following at a command prompt: . CXR second DWORD from step 6

Eip=78011f32 esp=09a8fa20 ebp=09a8fa2c iopl=0         
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             

78011f32 8a06             mov     Al,[esi]

Run KVcommand to get the actual exception of the call stack. This can help you identify actual problems that may not have been handled correctly in the process

0:120> KV
ChildEBP RetAddr Args to Child
Warning:stack unwind information not available. Following frames may wrong.
09A8FA2C 780119ab 09a8fad4 00000000 09a8faa8 msvcrt!strnicmp+0x92
09a8fa40 7801197c 09a8fad4 00000000 6d7044fd msvcrt!stricmp+0x3c
09A8FA80 6e5a6ef6 09a8fad4 2193d68d 00e5e298 msvcrt!stricmp+0xd
09a8fa94 6d7043bf 09a8fad4 09a8faa8 0000001c iisrtl! Clkrhashtable::findkey+0x59 (FPO: [2,0,1])
09A8FAAC 749fc22d 09a8fad4 01d553b0 0000001c isatq! cdirmonitor::findentry+0x1e
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/infocomm/atq/dirmon.cpp @ 884]
09A8FAC4 749FD1CB 09a8fad4 09a8fb10 525c3a46 asp! registeraspdirmonitorentry+0x6e
(FPO: [EBP 0x09a8fb08] [2,0,4]) [D:/nt/private/inet/iis/svcs/cmp/asp/aspdmon.cpp @ 534]
09a8fb08 749fcdd6 00000000 09A8FCBC 018d1f28 asp! ctemplatecachemanager::registertemplateforchangenotification+0x8a
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/cmp/asp/cachemgr.cpp @ 621]
09a8fb3c 74a08bfe 00000000 000000fa 74a30958 asp! ctemplatecachemanager::load+0x382
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/cmp/asp/cachemgr.cpp @ 364]
09a8fc68 74a0d4c9 04c12518 018d1f28 09A8FCBC asp! loadtemplate+0x42
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/cmp/asp/exec.cpp @ 1037]
09A8FCC0 74a2c3e5 00000000 0637ee38 09a8fd58 asp! Chitobj::viperasynccallback+0x3e8
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/cmp/asp/hitobj.cpp @ 2414]
09A8FCD8 787c048a 00000000 77aa1b03 01e91ed8 asp! cviperasyncrequest::oncall+0x3f
(FPO: [Non-fpo]) [D:/nt/private/inet/iis/svcs/cmp/asp/viperint.cpp @ 194]
09a8fce0 77aa1b03 01e91ed8 77a536d8 00000000 comsvcs! Staactivityworkhelper+0xa
(FPO: [1,0,0])
09a8fd24 77aa1927 000752f8 000864dc 787c0480 ole32! enterforcallback+0x6a
(FPO: [Non-fpo]) [D:/nt/private/ole32/com/dcomrem/crossctx.cxx @ 1759]
09a8fe50 77aa17ea 000864dc 787c0480 01e91ed8 ole32! switchforcallback+0x12b
(FPO: [Non-fpo]) [D:/nt/private/ole32/com/dcomrem/crossctx.cxx @ 1644]
09a8fe78 77aa60c1 000864dc 787c0480 01e91ed8 ole32! performcallback+0x50
(FPO: [Non-fpo]) [D:/nt/private/ole32/com/dcomrem/crossctx.cxx @ 1559]
09a8fed4 77aa5fa6 04f2b4c0 787c0480 01e91ed8 ole32! Cobjectcontext::internalcontextcallback+0xf5
(FPO: [Non-fpo]) [D:/nt/private/ole32/com/dcomrem/context.cxx @ 3866]
09A8FEF4 787bd3c3 04f2b4c0 787c0480 01e91ed8 ole32! Cobjectcontext::D ocallback+0x1a
(FPO: [Non-fpo]) [D:/nt/private/ole32/com/dcomrem/context.cxx @ 3746]
09a8ff24 787bf373 0216fb3c 00000007 09a8ffec comsvcs! Staactivitywork::D owork+0x73
(FPO: [0,4,2])
09A8FFB4 77e8758a 0216fe94 0216fb3c 00000007 comsvcs! Stathread::stathreadworker+0x2bb
(FPO: [EBP 0X09A8FFEC] [1,31,4])
09a8ffec 00000000 787bf0b8 0216fe94 00000000 kernel32! basethreadstart+0x52
(FPO: [Non-fpo]) [D:/nt/private/windows/base/client/support.c @ 451]

the case of the _except_handler functionIn some cases there is no unhandledexceptionfilter in the stack, and only the _except_handler function, which is the SEH exception handler function. Function prototype: exception_disposition __cdecl _except_handler (
struct _exception_record *exceptionrecord,
void * Establisherframe,
struct _context *contextrecord,
void * Dispatchercontext);
The first parameter of this function is a pointer to the EXCEPTION_RECORD structure. This structure is defined in WINNT.H, as follows:
typedef struct _EXCEPTION_RECORD {
DWORD Exceptioncode;
DWORD ExceptionFlags;
struct _exception_record *exceptionrecord;
PVOID exceptionaddress;
DWORD numberparameters;
DWORD Exceptioninformation[exception_maximum_parameters];
} Exception_record;
The second argument to the _except_handler function is a pointer to the Establisher frame structure.
The third argument to the _except_handler callback function is a pointer to the CONTEXT structure.
typedef struct _CONTEXT
{
DWORD Contextflags;
DWORD Dr0;
DWORD Dr1;
DWORD DR2;
DWORD Dr3;
DWORD DR6;
DWORD Dr7;
Floating_save_area Floatsave;
DWORD Seggs;
DWORD Segfs;
DWORD seges;
DWORD Segds;
DWORD Edi;
DWORD Esi;
DWORD EBX;
DWORD EDX;
DWORD Ecx;
DWORD Eax;
DWORD EBP;
DWORD Eip;
DWORD Segcs;
DWORD EFlags;
DWORD Esp;
DWORD SEGSS;
} CONTEXT;
The fourth parameter of the _except_handler callback function is called Dispatchercontext. When parsing the dump file, type ~*KB at the command prompt to list all threads in the process. Identifies the thread that made the function call Kernel32!_except_handler。 It looks similar to the following:

9 id:918.117c suspend:2 teb:7ffd8000 unfrozen

085df400 7c9232a8 085df4ec 085DFFDC 085df50c kernel32!_except_handler3+0x61
085df424 7c92327a 085df4ec 085DFFDC 085df50c ntdll! Executehandler2+0x26
085df4d4 7c92e48a 00000000 085df50c 085df4ec ntdll! executehandler+0x24

Switch to the thread (in this example, the thread is "~ 9s"). kernel32!!_except_handlerThe first parameter, a DWORD value, represents the exception record. To obtain information about the type of exception, run the following at a command prompt: . EXR first DWORD from step 5

0:009>. EXR 085DF4EC
EXCEPTIONADDRESS:7C812AFB (kernel32! raiseexception+0x00000053)
exceptioncode:e06d7363 (c + + EH exception)
exceptionflags:00000001
Numberparameters:3
Parameter[0]: 19930520
PARAMETER[1]: 085df874
PARAMETER[2]: 006c010c

kernel32!!_except_handlerThe third parameter, the DWORD value, is the context record. To get context information, run the following at a command prompt: . CXR second DWORD from step 6

EAX=085DF7DC ebx=00005d34 ecx=00000000 edx=01240608 esi=085df864 edi=00100000
EIP=7C812AFB Esp=085df7d8 ebp=085df82c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
kernel32! RAISEEXCEPTION+0X53:
7C812AFB 5e pop ESI

Run KVcommand to get the actual exception of the call stack. This can help you identify actual problems that may not have been handled correctly in the process

0:009> kv 
 ChildEBP retaddr Args to child 
 Warning:stack unwind information not AVA Ilable. Following frames may wrong. 
 09a8fa2c 780119ab 09a8fad4 00000000 09a8faa8 msvcrt!strnicmp+0x92 
 09a8fa40 7801197c 09a8fad4 00000000 6D7044FD msvcrt!stricmp+0x3c 
 09a8fa80 6e5a6ef6 09a8fad4 2193d68d 00e5e298 msvcrt!stricmp+0xd