Windbg offline debugging. Net program entry

Under what circumstances must some complex debuggers be designed? There are probably the following:

1. Program crash
2. Program memory leakage
3. Program Suspension
4. High cpu consumption by programs

Memory leakage occurs. net Memory Profiler is easier to find problems than windbg (of course, due to the Memory leakage of managed code, it is difficult to do many unmanaged tasks ). for more information, see. net Memory Profiler analysis. net program memory leakage

CPU monitoring tools also include ANT Profiler and other tools.

However, there are always some bugs that are difficult to reproduce, especially on non-development machines. It is more convenient to catch a dump at this time.

The following uses a demo as an example to describe how to use windbg to analyze program crashes and hangs.

 

 

Exception Best Practices

In my experience, many codes reflect the following: I don't know what an exception is, when an exception is thrown, where an exception is caught, or when a log exists. I don't even see any stack information.

How to write the correct code is the root cause of the problem. The time-consuming tool for convenient debugging is still a lot.

I haven't used windbg for a long time because the. NET program debugging is too simple.

 

Recommended for usage exceptions

Http://www.codeproject.com/Articles/9538/Exception-Handling-Best-Practices-in-NET

 

Install windbg

After the download and installation, configure the symbol path

 

Capture Dump

When the program crashes, an error dialog box or the like will pop up. As long as the process has not exited, that is, we say "No Fly"

Use Windows Task Manager to create a dump file

 

Windows xp does not seem to have this function, but it does not matter. You can use Process Explorer

 

How can a program "fly", you have to use ADPlus under Windbg to monitor a process and automatically save dump when the process crashes.

For example:

Adplus-quiet-crash-p 432-o d: \ debug

Another method is that the program calls the windows api to generate a dump.

 

The following is a simple Winform program:

 

Test 1: Find abnormal sources

An exception occurred when you click button to trigger btnException_Click and capture dump.

First, load the component extension. If the client machine is different from your machine, copy the. net framework file of the client machine:

For example:

>. Load "E: \ dmp \ v4.0.30319 \ SOS. dll"

Yes! Pe print detailed exception information:

0: 000>! Pe
Exception object: 017ed918
Exception type: System. NullReferenceException
Message: Object reference not set to an instance of an object.
InnerException: <none>
StackTrace (generated ):
Sp ip Function
0012EC78 002A0680 MemLeakProfileDemo! MemLeakProfileDemo. Form1.btnException _ Click (System. Object, System. EventArgs) + 0x10
0012EC80 592a00007 System_Windows_Forms_ni! System. Windows. Forms. Control. OnClick (System. EventArgs) + 0x7f
0012EC94 592a6calcium System_Windows_Forms_ni! System. Windows. Forms. Button. OnClick (System. EventArgs) + 0xa2
0012 ECAC 5988A4E0 System_Windows_Forms_ni! System. Windows. Forms. Button. OnMouseUp (System. Windows. Forms. MouseEventArgs) + 0xac
0012ECC8 59853E11 System_Windows_Forms_ni! System. Windows. Forms. Control. WmMouseUp (System. Windows. Forms. Message ByRef, System. Windows. Forms. MouseButtons, Int32) + 0x2d1
0012ED5C 59BF6A8F System_Windows_Forms_ni! System. Windows. Forms. Control. WndProc (System. Windows. Forms. Message ByRef) + 0x8fc6ef
0012EDB4 59BFE3F1 System_Windows_Forms_ni! System. Windows. Forms. ButtonBase. WndProc (System. Windows. Forms. Message ByRef) + 0x8ec9dd
0012EDF8 593119F8 System_Windows_Forms_ni! System. Windows. Forms. Button. WndProc (System. Windows. Forms. Message ByRef) + 0x20
0012EE04 592FA393 System_Windows_Forms_ni! System. Windows. Forms. Control + ControlNativeWindow. OnMessage (System. Windows. Forms. Message ByRef) + 0x13
0012EE0C 592FA311 System_Windows_Forms_ni! System. Windows. Forms. Control + ControlNativeWindow. WndProc (System. Windows. Forms. Message ByRef) + 0x31
0012EE20 592FA256 System_Windows_Forms_ni! System. Windows. Forms. NativeWindow. Callback (IntPtr, Int32, IntPtr, IntPtr) + 0x96

StackTraceString: <none>
HResult: 80004003.

Or use it! An error occurred while checking analyze-v. the stack information is clear.

Or we can try again! Dumpheap looked at the information in the managed heap. At this time, I only care about the MemLeakProfileDemo namespace object, that is, the object I use in my own code. Or use it! Dso prints the object of the current stack

0: 000>! Dumpheap-type MemLeakProfileDemo
Address MT Size
017cd058 00226410 352
017d30e8 00226ba4 12
017d310c 00226c34 12
Total 0 objects
Statistics:
MT Count TotalSize Class Name
00226c34 1 12 MemLeakProfileDemo. FoolBrother
00226ba4 1 12 MemLeakProfileDemo. Fool
00226410 1 352 MemLeakProfileDemo. Form1
Total 3 objects

 

There is only one Fool object. MT (Method Table) is 00226ba4, and its address is 017d30e8.

Run the do command to view the address information:

0: 000>! Do 017d30e8
Name: MemLeakProfileDemo. Fool
MethodTable: 00226ba4
EEClass: 002b054c
Size: 12 (0xc) bytes
File: C: \ Users \ jhwang \ Documents \ Visual Studio 2010 \ Projects \ MemLeakProfileDemo \ bin \ Release \ MemLeakProfileDemo.exe
Fields:
MT Field Offset Type VT Attr Value Name
00212990 400000c 4... yte [], mscorlib] 0 instance 017d30f4 list

Check its fields. list is required! Dumpvc

0: 000>! Dumpvc 00212990 400000c
Name: System. Collections. Generic. IList '1 [[System. Byte [], mscorlib]
Method: 00212990
EEClass: 631323c4
Size: 0 (0x0) bytes
File: C: \ Windows \ Microsoft. Net \ assembly \ GAC_32 \ mscorlib \ v4.0 _ 4.0.0.0 _ b77a5c561934e089 \ mscorlib. dll
Fields:

This list is empty.

 

Test 2: Find the reason for thread Suspension

Click another button to trigger btnHang_Click and close the window. Because this thread does not exit correctly, the process will not exit and it will be frozen there. Capture dump and open. load sos.

View the current thread:

0: 000>! Threads
ThreadCount: 3
UnstartedThread: 0
BackgroundThread: 2
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
PreEmptive GC Alloc Lock
Id osid ThreadOBJ State GC Context Domain Count APT Exception
0 1 1e68 003fe898 2016220 Enabled 019dd3f0: 019ddfe8 003f8410 0 STA
2 2 11e4 00409cc8 b220 Enabled restart :00000000 003f8410 0 MTA (Finalizer)
5 3 14b4 00445430 200b020 Enabled 019c2014: 019c3fe8 003f8410 0 MTA

What is STA and MTA? I don't know. This is often used in normal program. cs.

     [STAThread]         static void Main()

This estimate is not what we want to see. The second MTA thread looks like GC and so on. It must be the third thread. Switch to this thread and check the stack.

0: 003> ~ 5S
Eax = 001363c8 ebx = 00000001 ecx = 000003e8 edx = 019c1458 esi = 0455ef50 edi = 00000000

Eip = 776b7094 esp = 0455ef0c ebp = 0455ef74 iopl = 0 nv up ei pl nz na pe nc

Cs = 001b ss = 0023 ds = 0023 es = 0023 fs = 003b gs = 0000 efl = 00000206

Ntdll! KiFastSystemCallRet:

776b7094 c3 ret

0: 005>! Clrstack

OS Thread Id: 0x14b4 (5)

Child sp ip Call Site

0455f034 776b7094 [HelperMethodFrame: 0455f034] System. Threading. Thread. SleepInternal (Int32)

0455f080 001a06ed MemLeakProfileDemo. Form1.DoWork () [C: \ Users \ jhwang \ Documents \ Visual Studio 2010 \ Projects \ MemLeakProfileDemo \ Form1.cs @ 80]

0455f088 6338b30b System. Threading. ThreadHelper. ThreadStart_Context (System. Object)

0455f098 63318004 System. Threading. ExecutionContext. Run (System. Threading. ExecutionContext, System. Threading. ContextCallback, System. Object, Boolean)

0455f0bc 63317f44 System. Threading. ExecutionContext. Run (System. Threading. ExecutionContext, System. Threading. ContextCallback, System. Object)

0455f0d8 6338b298 System. Threading. ThreadHelper. ThreadStart ()

0455f2fc 69a1219b [GCFrame: 0455f2fc]

0455f5c0 69a1219b [DebuggerU2MCatchHandlerFrame: 0455f5c0]

Compare code. Everything Else.

Summary: There are a lot of sos commands and few have been used, except for sos. in addition to the dll extension, there are debugging extensions such as sosex and PssCor4 on the Internet. A little understanding of windbg can also make our life easier.

source code: downoad