崩溃分析 WinDbg

Qter

D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release

!analyze -v

https://zhuanlan.zhihu.com/p/43972006

下载，下载官方版本

[color=inherit !important]Download Debugging Tools for Windows - WinDbg - Windows drivers​docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools

配置

1.使用dump文件查找崩溃的位置

首先打开dump文件。

输入!analyze -v（原来写的!anaylze -v 感谢尚逸的提醒） 查看数据

输入!anaylze -v 查看数据

发现什么都没有

输入~*kbn 查看所有的线程

然后向上查找KERNELBASE!UnhandledExceptionFilter+0x25a 这个一个 未处理的异常

输入~*kbn 查看所有的线程

复制第三个参数00b8d9d0

输入 dd 00b8d9d0

输入 dd 00b8d9d0

然后输入 .exr 00b8db60(第二个参数)查看上下文 .cxr 00b8dbb0 （第三个参数）

.exr 00b8db60(第二个参数)查看上下文 .cxr 00b8dbb0 （第三个参数）

然后kbn

kbn

然后发现自己熟悉代码

双击崩溃位置，发现跳不过去

打开call stack

打开call stack

双击崩溃的位置

双击崩溃的位置

成功跳转代码

打开local

打开local

查看崩溃前的数据

查看崩溃前的数据

这里就可以找到错误的位置以及出问题的原因了。

2.调试程序，由于某些情况下，pdb与现在版本不一致（vs中修改了些的代码，或者vs抽风）vs无法附加进程，但是bug又是偶现的，好不容易出现一次又不能破坏现场。就可以直接使用windbg直接附加到进程进行调试程序。

附加到进程

此时程序会暂停

打开cpp文件

点击上面的小图标，可以打开调用堆栈等窗口。

选中你需要调试的代码F9添加断点，跟vs一致。

添加断点

F5或者输入g 继续运行

断点停止成功

可以看到当前运行的数据都可以看到了。

Qter

1. 
   
2. Microsoft (R) Windows Debugger Version 10.0.17763.132 X86
   
3. Copyright (c) Microsoft Corporation. All rights reserved.
   
4. 
   
5. 
   
6. Loading Dump File [D:\Backup\我的文档\Tencent Files\254452118\FileRecv\crashlogs (3)\crashlogs\6de356ec-1e38-4cdc-92ab-c8a495de857f\crashdump.dmp]
   
7. User Mini Dump File: Only registers, stack and portions of memory are available
   
8. 
   
9. Symbol search path is: srv*
   
10. Executable search path is:
    
11. Windows 10 Version 18363 MP (6 procs) Free x86 compatible
    
12. Product: WinNt, suite: SingleUserTS
    
13. 10.0.18362.329 (WinBuild.160101.0800)
    
14. Machine Name:
    
15. Debug session time: Wed Aug 31 03:47:35.000 2022 (UTC + 8:00)
    
16. System Uptime: not available
    
17. Process Uptime: 0 days 3:15:10.000
    
18. ................................................................
    
19. ................................................................
    
20. ................................................................
    
21. ..........
    
22. This dump file has an exception of interest stored in it.
    
23. The stored exception information can be accessed via .ecxr.
    
24. (12a84.117d4): Unknown exception - code 00000000 (first/second chance not available)
    
25. eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=000003e8
    
26. eip=77ab1e3c esp=0737f1f8 ebp=0737f268 iopl=0         nv up ei pl nz na po nc
    
27. cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    
28. ntdll!NtWaitForSingleObject+0xc:
    
29. 77ab1e3c c20c00          ret     0Ch
    
30. Error: Change all symbol paths attempts to access 'D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release' failed: 0x7b - 文件名、目录名或卷标语法不正确。
    
31. 
    
32. ************* Path validation summary **************
    
33. Response                         Time (ms)     Location
    
34. Error                                          D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release
    
35. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -
    
36. 0:013> .reload
    
37. ..*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -
    
38. ..............................................................
    
39. ................................................................
    
40. ................................................................
    
41. ..........
    
42. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for KERNELBASE.dll -
    
43. 
    
44. ************* Symbol Loading Error Summary **************
    
45. Module name            Error
    
46. ntdll                  The system cannot find the file specified
    
47. KERNELBASE             The system cannot find the file specified
    
48. 
    
49. You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
    
50. You should also verify that your symbol search path (.sympath) is correct.
    
51. 0:013> !analyze -v
    
52. *******************************************************************************
    
53. *                                                                             *
    
54. *                        Exception Analysis                                   *
    
55. *                                                                             *
    
56. *******************************************************************************
    
57. 
    
58. *************************************************************************
    
59. ***                                                                   ***
    
60. ***                                                                   ***
    
61. ***    Either you specified an unqualified symbol, or your debugger   ***
    
62. ***    doesn't have full symbol information.  Unqualified symbol      ***
    
63. ***    resolution is turned off by default. Please either specify a   ***
    
64. ***    fully qualified symbol module!symbolname, or enable resolution ***
    
65. ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    
66. ***    enabling unqualified symbol resolution with network symbol     ***
    
67. ***    server shares in the symbol path may cause the debugger to     ***
    
68. ***    appear to hang for long periods of time when an incorrect      ***
    
69. ***    symbol name is typed or the network symbol server is down.     ***
    
70. ***                                                                   ***
    
71. ***    For some commands to work properly, your symbol path           ***
    
72. ***    must point to .pdb files that have full type information.      ***
    
73. ***                                                                   ***
    
74. ***    Certain .pdb files (such as the public OS symbols) do not      ***
    
75. ***    contain the required information.  Contact the group that      ***
    
76. ***    provided you with these symbols if you need this command to    ***
    
77. ***    work.                                                          ***
    
78. ***                                                                   ***
    
79. ***    Type referenced: $ntdllsym!_CONTEXT                            ***
    
80. ***                                                                   ***
    
81. *************************************************************************
    
82. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ucrtbase.dll -
    
83. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for log4cpp.dll -
    
84. *** WARNING: Unable to verify timestamp for mCloud.exe
    
85. *** ERROR: Module load completed but symbols could not be loaded for mCloud.exe
    
86. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for Qt5Core.dll -
    
87. *** WARNING: Unable to verify timestamp for cloud.dll
    
88. *** ERROR: Module load completed but symbols could not be loaded for cloud.dll
    
89. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for kernel32.dll -
    
90. ***** OS symbols are WRONG. Please fix symbols to do analysis.
    
91. 
    
92. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ole32.dll -
    
93. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for combase.dll -
    
94. *************************************************************************
    
95. ***                                                                   ***
    
96. ***                                                                   ***
    
97. ***    Either you specified an unqualified symbol, or your debugger   ***
    
98. ***    doesn't have full symbol information.  Unqualified symbol      ***
    
99. ***    resolution is turned off by default. Please either specify a   ***
    
100. ***    fully qualified symbol module!symbolname, or enable resolution ***
     
101. ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
     
102. ***    enabling unqualified symbol resolution with network symbol     ***
     
103. ***    server shares in the symbol path may cause the debugger to     ***
     
104. ***    appear to hang for long periods of time when an incorrect      ***
     
105. ***    symbol name is typed or the network symbol server is down.     ***
     
106. ***                                                                   ***
     
107. ***    For some commands to work properly, your symbol path           ***
     
108. ***    must point to .pdb files that have full type information.      ***
     
109. ***                                                                   ***
     
110. ***    Certain .pdb files (such as the public OS symbols) do not      ***
     
111. ***    contain the required information.  Contact the group that      ***
     
112. ***    provided you with these symbols if you need this command to    ***
     
113. ***    work.                                                          ***
     
114. ***                                                                   ***
     
115. ***    Type referenced: nt!_CONTEXT                                   ***
     
116. ***                                                                   ***
     
117. *************************************************************************
     
118. 
     
119. KEY_VALUES_STRING: 1
     
120. 
     
121. 
     
122. STACKHASH_ANALYSIS: 1
     
123. 
     
124. TIMELINE_ANALYSIS: 1
     
125. 
     
126. 
     
127. DUMP_CLASS: 2
     
128. 
     
129. DUMP_QUALIFIER: 400
     
130. 
     
131. CONTEXT:  (.ecxr)
     
132. eax=0737f228 ebx=00000000 ecx=00000000 edx=049f43b8 esi=642e4610 edi=049f43b8
     
133. eip=642e3842 esp=0737f4fc ebp=0737f878 iopl=0         nv up ei pl nz ac pe nc
     
134. cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000216
     
135. CrashRpt_r!Ordinal10+0x3842:
     
136. 642e3842 8b4508          mov     eax,dword ptr [ebp+8] ss:002b:0737f880=0737f884
     
137. Resetting default scope
     
138. 
     
139. FAULTING_IP:
     
140. CrashRpt_r!Ordinal10+3842
     
141. 642e3842 8b4508          mov     eax,dword ptr [ebp+8]
     
142. 
     
143. EXCEPTION_RECORD:  (.exr -1)
     
144. ExceptionAddress: 642e3842 (CrashRpt_r!Ordinal10+0x00003842)
     
145.    ExceptionCode: 00000000
     
146.   ExceptionFlags: 00000000
     
147. NumberParameters: 0
     
148. 
     
149. WRONG_SYMBOLS_TIMESTAMP: 3dcfaabb
     
150. 
     
151. WRONG_SYMBOLS_SIZE: 19a000
     
152. 
     
153. FAULTING_MODULE: 77a40000 ntdll
     
154. 
     
155. DEBUG_FLR_IMAGE_TIMESTAMP:  3dcfaabb
     
156. 
     
157. ADDITIONAL_DEBUG_TEXT:  
     
158. You can run '.symfix; .reload' to try to fix the symbol path and load symbols. ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
     
159. 
     
160. ANALYSIS_SESSION_HOST:  CY-202010141JOS
     
161. 
     
162. ANALYSIS_SESSION_TIME:  08-31-2022 11:16:35.0154
     
163. 
     
164. ANALYSIS_VERSION: 10.0.17763.132 x86fre
     
165. 
     
166. STACK_TEXT:  
     
167. 0737f4fc 642e3842 CrashRpt_r!Ordinal10+0x3842
     
168. 0737f880 642e4683 CrashRpt_r!Ordinal10+0x4683
     
169. 0737f8bc 759aca3d ucrtbase!get_thread_local_invalid_parameter_handler+0x1dd
     
170. 0737f934 5baad3d0 log4cpp!log4cpp::FileAppender::_append+0x40
     
171. 0737f96c 5babb59e log4cpp!log4cpp::RollingFileAppender::_append+0xe
     
172. 0737f97c 5baa5053 log4cpp!log4cpp::AppenderSkeleton::doAppend+0x33
     
173. 0737f990 5baaa640 log4cpp!log4cpp::Category::callAppenders+0x30
     
174. 0737f9a8 5baaa2dd log4cpp!log4cpp::Category::_logUnconditionally2+0x3d
     
175. 0737fa2c 5baaa333 log4cpp!log4cpp::Category::_logUnconditionally+0x33
     
176. 0737fa60 5baaa7dc log4cpp!log4cpp::Category::crit+0x2c
     
177. 0737fa78 010738a7 mCloud+0x738a7
     
178. 0737faa4 590ee045 Qt5Core!qt_message_output+0x165
     
179. 0737fadc 590edef3 Qt5Core!qt_message_output+0x13
     
180. 0737fb20 5a41f7f3 cloud+0x14f7f3
     
181. 0737fcc0 5a4200e2 cloud+0x1500e2
     
182. 0737fe48 5a41e0ca cloud+0x14e0ca
     
183. 0737fe54 590f70c8 Qt5Core!QThreadPoolPrivate::reset+0x1a8
     
184. 0737feac 590f397c Qt5Core!QThread::start+0x31c
     
185. 0737fed0 76646359 kernel32!BaseThreadInitThunk+0x19
     
186. 0737fee0 77aa7c14 ntdll!RtlGetAppContainerNamedObjectPath+0xe4
     
187. 0737ff3c 77aa7be4 ntdll!RtlGetAppContainerNamedObjectPath+0xb4
     
188. 
     
189. 
     
190. THREAD_SHA1_HASH_MOD_FUNC:  0656e6cd7b900dce72263212cadce02ceba0688f
     
191. 
     
192. THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  abd1bc3fa942986f8e3a974a7ab793f393427bb3
     
193. 
     
194. THREAD_SHA1_HASH_MOD:  237449150da3ad0618a4e5609051d68d97612dcf
     
195. 
     
196. FOLLOWUP_IP:
     
197. CrashRpt_r!Ordinal10+3842
     
198. 642e3842 8b4508          mov     eax,dword ptr [ebp+8]
     
199. 
     
200. FAULT_INSTR_CODE:  8d08458b
     
201. 
     
202. SYMBOL_STACK_INDEX:  0
     
203. 
     
204. FOLLOWUP_NAME:  MachineOwner
     
205. 
     
206. STACK_COMMAND:  .ecxr ; kb ; ** Pseudo Context ** Pseudo ** Value: 148f6550 ** ; kb
     
207. 
     
208. BUGCHECK_STR:  3DCFAABB
     
209. 
     
210. EXCEPTION_CODE: (NTSTATUS) 0x3dcfaabb - <Unable to get error code text>
     
211. 
     
212. EXCEPTION_CODE_STR:  3DCFAABB
     
213. 
     
214. EXCEPTION_STR:  WRONG_SYMBOLS
     
215. 
     
216. PROCESS_NAME:  ntdll.wrong.symbols.dll
     
217. 
     
218. IMAGE_NAME:  ntdll.wrong.symbols.dll
     
219. 
     
220. MODULE_NAME: ntdll_wrong_symbols
     
221. 
     
222. SYMBOL_NAME:  ntdll_wrong_symbols!3DCFAABB19A000
     
223. 
     
224. BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.329_(WinBuild.160101.0800)_TIMESTAMP_021111-130355
     
225. 
     
226. DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.329_(WinBuild.160101.0800)_TIMESTAMP_021111-130355
     
227. 
     
228. PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
     
229. 
     
230. FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.329_(WinBuild.160101.0800)_TIMESTAMP_021111-130355_3DCFAABB_ntdll.wrong.symbols.dll!3DCFAABB19A000
     
231. 
     
232. FAILURE_EXCEPTION_CODE:  3DCFAABB
     
233. 
     
234. FAILURE_IMAGE_NAME:  ntdll.wrong.symbols.dll
     
235. 
     
236. BUCKET_ID_IMAGE_STR:  ntdll.wrong.symbols.dll
     
237. 
     
238. FAILURE_MODULE_NAME:  ntdll_wrong_symbols
     
239. 
     
240. BUCKET_ID_MODULE_STR:  ntdll_wrong_symbols
     
241. 
     
242. FAILURE_FUNCTION_NAME:  3DCFAABB19A000
     
243. 
     
244. BUCKET_ID_FUNCTION_STR:  3DCFAABB19A000
     
245. 
     
246. BUCKET_ID_OFFSET:  0
     
247. 
     
248. BUCKET_ID_MODTIMEDATESTAMP:  0
     
249. 
     
250. BUCKET_ID_MODCHECKSUM:  0
     
251. 
     
252. BUCKET_ID_MODVER_STR:  0.0.0.0
     
253. 
     
254. BUCKET_ID_PREFIX_STR:  WRONG_SYMBOLS_X86_10.0.18362.329_(WinBuild.160101.0800)_TIMESTAMP_021111-130355
     
255. 
     
256. FAILURE_PROBLEM_CLASS:  WRONG_SYMBOLS
     
257. 
     
258. FAILURE_SYMBOL_NAME:  ntdll.wrong.symbols.dll!3DCFAABB19A000
     
259. 
     
260. TARGET_TIME:  2022-08-30T19:47:35.000Z
     
261. 
     
262. OSBUILD:  18363
     
263. 
     
264. OSSERVICEPACK:  778
     
265. 
     
266. SERVICEPACK_NUMBER: 0
     
267. 
     
268. OS_REVISION: 0
     
269. 
     
270. SUITE_MASK:  256
     
271. 
     
272. PRODUCT_TYPE:  1
     
273. 
     
274. OSPLATFORM_TYPE:  x86
     
275. 
     
276. OSNAME:  Windows 10
     
277. 
     
278. OSEDITION:  Windows 10 WinNt SingleUserTS
     
279. 
     
280. OS_LOCALE:  
     
281. 
     
282. USER_LCID:  0
     
283. 
     
284. OSBUILD_TIMESTAMP:  1982-04-09 08:25:11
     
285. 
     
286. BUILDDATESTAMP_STR:  160101.0800
     
287. 
     
288. BUILDLAB_STR:  WinBuild
     
289. 
     
290. BUILDOSVER_STR:  10.0.18362.329
     
291. 
     
292. ANALYSIS_SESSION_ELAPSED_TIME:  15c
     
293. 
     
294. ANALYSIS_SOURCE:  UM
     
295. 
     
296. FAILURE_ID_HASH_STRING:  um:wrong_symbols_x86_10.0.18362.329_(winbuild.160101.0800)_timestamp_021111-130355_3dcfaabb_ntdll.wrong.symbols.dll!3dcfaabb19a000
     
297. 
     
298. FAILURE_ID_HASH:  {78ced7a0-5a1c-f23b-6dc7-e64309912087}
     
299. 
     
300. Followup:     MachineOwner
     
301. ---------
     
302. 
     

复制代码

Qter

1. 
   
2. Microsoft (R) Windows Debugger Version 10.0.17763.132 X86
   
3. Copyright (c) Microsoft Corporation. All rights reserved.
   
4. 
   
5. 
   
6. Loading Dump File [D:\问题\libcef\60f70e3a-f32c-4e4c-b34e-85e2e6bc31a8\crashdump.dmp]
   
7. User Mini Dump File: Only registers, stack and portions of memory are available
   
8. 
   
9. Error: Change all symbol paths attempts to access 'D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release' failed: 0x7b - 文件名、目录名或卷标语法不正确。
   
10. 
    
11. ************* Path validation summary **************
    
12. Response                         Time (ms)     Location
    
13. Error                                          D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release
    
14. Symbol search path is: D:\\release\\Package\\mCloudWin(V7.1.2)A001\\pdb:E:\\gitcode\\712\\mCloud_ClientWin712\\dll\\release
    
15. Executable search path is:
    
16. Windows 10 Version 18362 MP (12 procs) Free x86 compatible
    
17. Product: WinNt, suite: SingleUserTS
    
18. 10.0.18362.1110 (WinBuild.160101.0800)
    
19. Machine Name:
    
20. Debug session time: Tue Aug 23 17:31:21.000 2022 (UTC + 8:00)
    
21. System Uptime: not available
    
22. Process Uptime: 3 days 3:37:23.000
    
23. ................................................................
    
24. ................................................................
    
25. .........................................................
    
26. This dump file has an exception of interest stored in it.
    
27. The stored exception information can be accessed via .ecxr.
    
28. (42b4.1e54): Unknown exception - code e0000008 (first/second chance not available)
    
29. *** WARNING: Unable to verify timestamp for ntdll.dll
    
30. *** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
    
31. Unable to load image C:\Windows\System32\KERNELBASE.dll, Win32 error 0n2
    
32. *** WARNING: Unable to verify timestamp for KERNELBASE.dll
    
33. *** ERROR: Module load completed but symbols could not be loaded for KERNELBASE.dll
    
34. eax=00000000 ebx=129de91c ecx=00000000 edx=00000000 esi=00000000 edi=00000408
    
35. eip=77c52f3c esp=129de0e0 ebp=129de150 iopl=0         nv up ei pl nz ac po nc
    
36. cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212
    
37. ntdll+0x72f3c:
    
38. 77c52f3c c20c00          ret     0Ch
    
39. 0:047> !analyze -v
    
40. *******************************************************************************
    
41. *                                                                             *
    
42. *                        Exception Analysis                                   *
    
43. *                                                                             *
    
44. *******************************************************************************
    
45. 
    
46. *************************************************************************
    
47. ***                                                                   ***
    
48. ***                                                                   ***
    
49. ***    Either you specified an unqualified symbol, or your debugger   ***
    
50. ***    doesn't have full symbol information.  Unqualified symbol      ***
    
51. ***    resolution is turned off by default. Please either specify a   ***
    
52. ***    fully qualified symbol module!symbolname, or enable resolution ***
    
53. ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    
54. ***    enabling unqualified symbol resolution with network symbol     ***
    
55. ***    server shares in the symbol path may cause the debugger to     ***
    
56. ***    appear to hang for long periods of time when an incorrect      ***
    
57. ***    symbol name is typed or the network symbol server is down.     ***
    
58. ***                                                                   ***
    
59. ***    For some commands to work properly, your symbol path           ***
    
60. ***    must point to .pdb files that have full type information.      ***
    
61. ***                                                                   ***
    
62. ***    Certain .pdb files (such as the public OS symbols) do not      ***
    
63. ***    contain the required information.  Contact the group that      ***
    
64. ***    provided you with these symbols if you need this command to    ***
    
65. ***    work.                                                          ***
    
66. ***                                                                   ***
    
67. ***    Type referenced: $ntdllsym!_CONTEXT                            ***
    
68. ***                                                                   ***
    
69. *************************************************************************
    
70. *** WARNING: Unable to verify timestamp for kernel32.dll
    
71. *** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
    
72. ***** OS symbols are WRONG. Please fix symbols to do analysis.
    
73. 
    
74. Unable to load image C:\Windows\System32\ole32.dll, Win32 error 0n2
    
75. *** WARNING: Unable to verify timestamp for ole32.dll
    
76. *** ERROR: Module load completed but symbols could not be loaded for ole32.dll
    
77. Unable to load image C:\Windows\System32\combase.dll, Win32 error 0n2
    
78. *** WARNING: Unable to verify timestamp for combase.dll
    
79. *** ERROR: Module load completed but symbols could not be loaded for combase.dll
    
80. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for CrashRpt_r.dll -
    
81. *** WARNING: Unable to verify timestamp for SogouPY.ime
    
82. *** ERROR: Module load completed but symbols could not be loaded for SogouPY.ime
    
83. *** WARNING: Unable to verify timestamp for PicFace.dll
    
84. *** ERROR: Module load completed but symbols could not be loaded for PicFace.dll
    
85. *************************************************************************
    
86. ***                                                                   ***
    
87. ***                                                                   ***
    
88. ***    Either you specified an unqualified symbol, or your debugger   ***
    
89. ***    doesn't have full symbol information.  Unqualified symbol      ***
    
90. ***    resolution is turned off by default. Please either specify a   ***
    
91. ***    fully qualified symbol module!symbolname, or enable resolution ***
    
92. ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    
93. ***    enabling unqualified symbol resolution with network symbol     ***
    
94. ***    server shares in the symbol path may cause the debugger to     ***
    
95. ***    appear to hang for long periods of time when an incorrect      ***
    
96. ***    symbol name is typed or the network symbol server is down.     ***
    
97. ***                                                                   ***
    
98. ***    For some commands to work properly, your symbol path           ***
    
99. ***    must point to .pdb files that have full type information.      ***
    
100. ***                                                                   ***
     
101. ***    Certain .pdb files (such as the public OS symbols) do not      ***
     
102. ***    contain the required information.  Contact the group that      ***
     
103. ***    provided you with these symbols if you need this command to    ***
     
104. ***    work.                                                          ***
     
105. ***                                                                   ***
     
106. ***    Type referenced: nt!_CONTEXT                                   ***
     
107. ***                                                                   ***
     
108. *************************************************************************
     
109. 
     
110. KEY_VALUES_STRING: 1
     
111. 
     
112. 
     
113. STACKHASH_ANALYSIS: 1
     
114. 
     
115. TIMELINE_ANALYSIS: 1
     
116. 
     
117. 
     
118. DUMP_CLASS: 2
     
119. 
     
120. DUMP_QUALIFIER: 400
     
121. 
     
122. CONTEXT:  (.ecxr)
     
123. eax=129def88 ebx=00000170 ecx=00000001 edx=00000000 esi=00000000 edi=6933802c
     
124. eip=75ba46d2 esp=129def88 ebp=129defe4 iopl=0         nv up ei pl nz ac pe nc
     
125. cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000216
     
126. KERNELBASE+0x1146d2:
     
127. 75ba46d2 8b4c2454        mov     ecx,dword ptr [esp+54h] ss:002b:129defdc=b8f7255a
     
128. Resetting default scope
     
129. 
     
130. FAULTING_IP:
     
131. KERNELBASE+1146d2
     
132. 75ba46d2 8b4c2454        mov     ecx,dword ptr [esp+54h]
     
133. 
     
134. EXCEPTION_RECORD:  (.exr -1)
     
135. ExceptionAddress: 75ba46d2 (KERNELBASE+0x001146d2)
     
136.    ExceptionCode: e0000008
     
137.   ExceptionFlags: 00000001
     
138. NumberParameters: 1
     
139.    Parameter[0]: 00000170
     
140. 
     
141. BUGCHECK_STR:  E94AEEF6
     
142. 
     
143. WRONG_SYMBOLS_TIMESTAMP: e94aeef6
     
144. 
     
145. WRONG_SYMBOLS_SIZE: 19a000
     
146. 
     
147. FAULTING_MODULE: 77be0000 ntdll
     
148. 
     
149. DEBUG_FLR_IMAGE_TIMESTAMP:  e94aeef6
     
150. 
     
151. ADDITIONAL_DEBUG_TEXT:  
     
152. You can run '.symfix; .reload' to try to fix the symbol path and load symbols. ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
     
153. 
     
154. ANALYSIS_SESSION_HOST:  CY-202010141JOS
     
155. 
     
156. ANALYSIS_SESSION_TIME:  08-31-2022 10:56:05.0916
     
157. 
     
158. ANALYSIS_VERSION: 10.0.17763.132 x86fre
     
159. 
     
160. STACK_TEXT:  
     
161. 129def88 75ba46d2 KERNELBASE+0x1146d2
     
162. 129defec 65a74cfd libcef!cef_string_utf16_to_upper+0x426fd
     
163. 129df008 664c1511 libcef!cef_time_delta+0x23e16
     
164. 129df014 65abb104 libcef!cef_string_utf16_to_upper+0x88b04
     
165. 129df02c 65a5d31e libcef!cef_string_utf16_to_upper+0x2ad1e
     
166. 129df03c 6472e6d4 libcef!cef_string_multimap_size+0x3fdc0b
     
167. 129df05c 64741dce libcef!cef_string_multimap_size+0x411305
     
168. 129df090 64730fe8 libcef!cef_string_multimap_size+0x40051f
     
169. 129df264 6473629e libcef!cef_string_multimap_size+0x4057d5
     
170. 129df288 65af1af1 libcef!cef_string_utf16_to_upper+0xbf4f1
     
171. 129df2c4 640cfcad libcef!cef_zip_reader_create+0x27f19
     
172. 129df2d8 64425db3 libcef!cef_string_multimap_size+0xf52ea
     
173. 129df334 646368ca libcef!cef_string_multimap_size+0x305e01
     
174. 129df3d8 65e34eb1 libcef!cef_string_utf16_to_upper+0x4028b1
     
175. 129df46c 65d882de libcef!cef_string_utf16_to_upper+0x355cde
     
176. 129df4e8 65d884c8 libcef!cef_string_utf16_to_upper+0x355ec8
     
177. 129df570 65d8a4b7 libcef!cef_string_utf16_to_upper+0x357eb7
     
178. 129df590 648ad33b libcef!cef_string_multimap_size+0x57c872
     
179. 129df5ac 65a87aa7 libcef!cef_string_utf16_to_upper+0x554a7
     
180. 129df618 664d9895 libcef!cef_time_delta+0x3c19a
     
181. 129df6ec 664d9630 libcef!cef_time_delta+0x3bf35
     
182. 129df74c 664c7438 libcef!cef_time_delta+0x29d3d
     
183. 129df78c 664da06a libcef!cef_time_delta+0x3c96f
     
184. 129df7b4 65a764f6 libcef!cef_string_utf16_to_upper+0x43ef6
     
185. 129df804 65a7636f libcef!cef_string_utf16_to_upper+0x43d6f
     
186. 129df814 65a9592b libcef!cef_string_utf16_to_upper+0x6332b
     
187. 129df81c 65a95a93 libcef!cef_string_utf16_to_upper+0x63493
     
188. 129df868 65a93d75 libcef!cef_string_utf16_to_upper+0x61775
     
189. 129df88c 75f86359 kernel32+0x16359
     
190. 129df89c 77c48944 ntdll+0x68944
     
191. 129df8f8 77c48914 ntdll+0x68914
     
192. 
     
193. 
     
194. THREAD_SHA1_HASH_MOD_FUNC:  c3ed4354ce909c6ff0339885e25cf45198b1767a
     
195. 
     
196. THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  a5bed8ebe0fcb2ddbff57df9a5982ba1aac112c8
     
197. 
     
198. THREAD_SHA1_HASH_MOD:  f948376e29c6ced390fd2053430ccfa5ea9a3883
     
199. 
     
200. FOLLOWUP_IP:
     
201. KERNELBASE+1146d2
     
202. 75ba46d2 8b4c2454        mov     ecx,dword ptr [esp+54h]
     
203. 
     
204. FAULT_INSTR_CODE:  54244c8b
     
205. 
     
206. SYMBOL_STACK_INDEX:  0
     
207. 
     
208. FOLLOWUP_NAME:  MachineOwner
     
209. 
     
210. STACK_COMMAND:  .ecxr ; kb ; ** Pseudo Context ** Pseudo ** Value: 11f9c5d8 ** ; kb
     
211. 
     
212. EXCEPTION_CODE: (NTSTATUS) 0xe94aeef6 - <Unable to get error code text>
     
213. 
     
214. EXCEPTION_CODE_STR:  E94AEEF6
     
215. 
     
216. EXCEPTION_STR:  WRONG_SYMBOLS
     
217. 
     
218. PROCESS_NAME:  ntdll.wrong.symbols.dll
     
219. 
     
220. IMAGE_NAME:  ntdll.wrong.symbols.dll
     
221. 
     
222. MODULE_NAME: ntdll_wrong_symbols
     
223. 
     
224. SYMBOL_NAME:  ntdll_wrong_symbols!E94AEEF619A000
     
225. 
     
226. BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.1110_(WinBuild.160101.0800)_TIMESTAMP_940110-224926
     
227. 
     
228. DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.1110_(WinBuild.160101.0800)_TIMESTAMP_940110-224926
     
229. 
     
230. PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
     
231. 
     
232. FAILURE_EXCEPTION_CODE:  E94AEEF6
     
233. 
     
234. FAILURE_IMAGE_NAME:  ntdll.wrong.symbols.dll
     
235. 
     
236. BUCKET_ID_IMAGE_STR:  ntdll.wrong.symbols.dll
     
237. 
     
238. FAILURE_MODULE_NAME:  ntdll_wrong_symbols
     
239. 
     
240. BUCKET_ID_MODULE_STR:  ntdll_wrong_symbols
     
241. 
     
242. FAILURE_FUNCTION_NAME:  E94AEEF619A000
     
243. 
     
244. BUCKET_ID_FUNCTION_STR:  E94AEEF619A000
     
245. 
     
246. BUCKET_ID_OFFSET:  0
     
247. 
     
248. BUCKET_ID_MODTIMEDATESTAMP:  0
     
249. 
     
250. BUCKET_ID_MODCHECKSUM:  0
     
251. 
     
252. BUCKET_ID_MODVER_STR:  0.0.0.0
     
253. 
     
254. BUCKET_ID_PREFIX_STR:  WRONG_SYMBOLS_X86_10.0.18362.1110_(WinBuild.160101.0800)_TIMESTAMP_940110-224926
     
255. 
     
256. FAILURE_PROBLEM_CLASS:  WRONG_SYMBOLS
     
257. 
     
258. FAILURE_SYMBOL_NAME:  ntdll.wrong.symbols.dll!E94AEEF619A000
     
259. 
     
260. FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X86_10.0.18362.1110_(WinBuild.160101.0800)_TIMESTAMP_940110-224926_E94AEEF6_ntdll.wrong.symbols.dll!E94AEEF619A000
     
261. 
     
262. TARGET_TIME:  2022-08-23T09:31:21.000Z
     
263. 
     
264. OSBUILD:  18362
     
265. 
     
266. OSSERVICEPACK:  1110
     
267. 
     
268. SERVICEPACK_NUMBER: 0
     
269. 
     
270. OS_REVISION: 0
     
271. 
     
272. SUITE_MASK:  256
     
273. 
     
274. PRODUCT_TYPE:  1
     
275. 
     
276. OSPLATFORM_TYPE:  x86
     
277. 
     
278. OSNAME:  Windows 10
     
279. 
     
280. OSEDITION:  Windows 10 WinNt SingleUserTS
     
281. 
     
282. OS_LOCALE:  
     
283. 
     
284. USER_LCID:  0
     
285. 
     
286. OSBUILD_TIMESTAMP:  2017-09-12 07:43:03
     
287. 
     
288. BUILDDATESTAMP_STR:  160101.0800
     
289. 
     
290. BUILDLAB_STR:  WinBuild
     
291. 
     
292. BUILDOSVER_STR:  10.0.18362.1110
     
293. 
     
294. ANALYSIS_SESSION_ELAPSED_TIME:  b7
     
295. 
     
296. ANALYSIS_SOURCE:  UM
     
297. 
     
298. FAILURE_ID_HASH_STRING:  um:wrong_symbols_x86_10.0.18362.1110_(winbuild.160101.0800)_timestamp_940110-224926_e94aeef6_ntdll.wrong.symbols.dll!e94aeef619a000
     
299. 
     
300. FAILURE_ID_HASH:  {ff4692e3-d0ff-92f5-0605-0bb0d3e3994d}
     
301. 
     
302. Followup:     MachineOwner
     
303. ---------
     
304. 
     

复制代码