windbg怎么分析w3wp的dmp文件

KLL 2017-12-07 02:44:11

在本地部署了个mvc网站，写个除数为0的错误。运行网站。
用Procdump生成一个dmp文件。

用windbg分析如下：



Microsoft (R) Windows Debugger Version 10.0.15063.468 X86

Copyright (c) Microsoft Corporation. All rights reserved.





Loading Dump File [C:\Users\liusong\Downloads\Procdump\w3wp.exe_171207_121219.dmp]

User Mini Dump File with Full Memory: Only application data is available



Comment: '

*** procdump  -ma 4880

*** Manual dump'



************* Symbol Path validation summary **************

Response                         Time (ms)     Location

Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols

OK                                             D:\Test\bin

Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols;D:\Test\bin

Executable search path is: 

Windows 10 Version 14393 MP (4 procs) Free x64

Product: WinNt, suite: SingleUserTS

10.0.14393.206 (rs1_release.160915-0644)

Machine Name:

Debug session time: Thu Dec  7 12:12:19.000 2017 (UTC + 8:00)

System Uptime: 2 days 2:38:35.517

Process Uptime: 0 days 0:25:57.000

................................................................

................................................................

.........................

ntdll!NtWaitForSingleObject+0x14:

00007ffa`40cb6154 c3              ret

0:000> .loadby sos clr

The call to LoadLibrary(C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sos) failed, Win32 error 0n193

    "%1 不是有效的 Win32 应用程序。"

Please check your debugger configuration and/or network access.

0:000> .load C:\Windows\Microsoft.NET\Framework\v4.0.30319\sos

0:000> .load C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr

0:000> !analyze -v

*******************************************************************************

*                                                                             *

*                        Exception Analysis                                   *

*                                                                             *

*******************************************************************************



GetUrlPageData2 (WinHttp) failed: 12002.



DUMP_CLASS: 2



DUMP_QUALIFIER: 400



FAULTING_IP: 

+0

00000000`00000000 ??              ???



EXCEPTION_RECORD:  (.exr -1)

ExceptionAddress: 0000000000000000

   ExceptionCode: 80000003 (Break instruction exception)

  ExceptionFlags: 00000000

NumberParameters: 0



FAULTING_THREAD:  000031c4



BUGCHECK_STR:  BREAKPOINT



DEFAULT_BUCKET_ID:  BREAKPOINT



PROCESS_NAME:  w3wp.exe



ERROR_CODE: (NTSTATUS) 0x80000003 - <Unable to get error code text>



EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - <Unable to get error code text>



EXCEPTION_CODE_STR:  80000003



WATSON_BKT_PROCSTAMP:  57899b8a



WATSON_BKT_PROCVER:  6.2.14393.0



PROCESS_VER_PRODUCT:  Internet Information Services



WATSON_BKT_MODULE:  unknown



WATSON_BKT_MODVER:  0.0.0.0



WATSON_BKT_MODOFFSET:  0



WATSON_BKT_MODSTAMP:  bbbbbbb4



BUILD_VERSION_STRING:  10.0.14393.1198 (rs1_release_sec.170427-1353)



MODLIST_WITH_TSCHKSUM_HASH:  aa7c3fcc62462293ebdff5e848f9c4558c1572d7



MODLIST_SHA1_HASH:  0f28da2b76dcd88a60097f0657c27a231b232b66



NTGLOBALFLAG:  0



PROCESS_BAM_CURRENT_THROTTLED: 0



PROCESS_BAM_PREVIOUS_THROTTLED: 0



APPLICATION_VERIFIER_FLAGS:  0



PRODUCT_TYPE:  1



SUITE_MASK:  272



DUMP_FLAGS:  8000c07



DUMP_TYPE:  3



MISSING_CLR_SYMBOL: 0



ANALYSIS_SESSION_HOST:  LIUSONG



ANALYSIS_SESSION_TIME:  12-07-2017 14:42:09.0508



ANALYSIS_VERSION: 10.0.15063.468 x86fre



MANAGED_CODE: 1



MANAGED_ENGINE_MODULE:  clr



MANAGED_BITNESS_MISMATCH: 

Managed code needs matching platform for proper analysis. Use 'x64' debugger.



MANAGED_ANALYSIS_PROVIDER:  SOS



THREAD_ATTRIBUTES: 

OS_LOCALE:  CHS



PROBLEM_CLASSES: 



    ID:     [0n300]

    Type:   [@APPLICATION_FAULT_STRING]

    Class:  Primary

    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)

            BUCKET_ID

    Name:   Omit

    Data:   Add

            String: [BREAKPOINT]

    PID:    [Unspecified]

    TID:    [Unspecified]

    Frame:  [0]



PRIMARY_PROBLEM_CLASS:  BREAKPOINT



LAST_CONTROL_TRANSFER:  from 00007ffa3db03acf to 00007ffa40cb6154



STACK_TEXT:  

000000a6`659ef518 00007ffa`3db03acf : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0x14

000000a6`659ef520 00007ffa`335f18ac : 00000252`17a4a050 000000a6`659ef660 00007ff7`00000000 00000000`0000019c : KERNELBASE!WaitForSingleObjectEx+0x8f

000000a6`659ef5c0 00007ff7`99c1156e : 00000000`fffffffe 00000252`17a464d0 00000252`17a464d0 00007ffa`335f0000 : w3wphost!AppHostInitialize+0x14c

000000a6`659ef600 00007ff7`99c12dcd : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000000 : w3wp!wmain+0x412

000000a6`659ef7a0 00007ffa`3f108364 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : w3wp!ParseCommandLine+0xbf5

000000a6`659ef7e0 00007ffa`40c770d1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14

000000a6`659ef810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21





STACK_COMMAND:  ~0s; .ecxr ; kb



THREAD_SHA1_HASH_MOD_FUNC:  41d56e133237190ef22c271920c9563b76bfe10c



THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  c868be340dffc58f997c0a77ce61c3525c79ba8c



THREAD_SHA1_HASH_MOD:  a3e17772a8c13642c326be5b40e28468a6a5b22b



FOLLOWUP_IP: 

w3wphost!AppHostInitialize+14c

00007ffa`335f18ac f605a11d010003  test    byte ptr [w3wphost!g_dwDebugFlags (00007ffa`33603654)],3



FAULT_INSTR_CODE:  1da105f6



SYMBOL_STACK_INDEX:  2



SYMBOL_NAME:  w3wphost!AppHostInitialize+14c



FOLLOWUP_NAME:  MachineOwner



MODULE_NAME: w3wphost



IMAGE_NAME:  w3wphost.dll



DEBUG_FLR_IMAGE_TIMESTAMP:  57899bca



BUCKET_ID:  BREAKPOINT_w3wphost!AppHostInitialize+14c



FAILURE_EXCEPTION_CODE:  80000003



FAILURE_IMAGE_NAME:  w3wphost.dll



BUCKET_ID_IMAGE_STR:  w3wphost.dll



FAILURE_MODULE_NAME:  w3wphost



BUCKET_ID_MODULE_STR:  w3wphost



FAILURE_FUNCTION_NAME:  AppHostInitialize



BUCKET_ID_FUNCTION_STR:  AppHostInitialize



BUCKET_ID_OFFSET:  14c



BUCKET_ID_MODTIMEDATESTAMP:  57899bca



BUCKET_ID_MODCHECKSUM:  181ae



BUCKET_ID_MODVER_STR:  6.2.14393.0



BUCKET_ID_PREFIX_STR:  BREAKPOINT_



FAILURE_PROBLEM_CLASS:  BREAKPOINT



FAILURE_SYMBOL_NAME:  w3wphost.dll!AppHostInitialize



FAILURE_BUCKET_ID:  BREAKPOINT_80000003_w3wphost.dll!AppHostInitialize



WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/w3wp.exe/6.2.14393.0/57899b8a/unknown/0.0.0.0/bbbbbbb4/80000003/00000000.htm?Retriage=1



TARGET_TIME:  2017-12-07T04:12:19.000Z



OSBUILD:  14393



OSSERVICEPACK:  1198



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



OSPLATFORM_TYPE:  x64



OSNAME:  Windows 10



OSEDITION:  Windows 10 WinNt SingleUserTS



USER_LCID:  0



OSBUILD_TIMESTAMP:  2017-04-28 07:48:56



BUILDDATESTAMP_STR:  170427-1353



BUILDLAB_STR:  rs1_release_sec



BUILDOSVER_STR:  10.0.14393.1198



ANALYSIS_SESSION_ELAPSED_TIME:  67c2



ANALYSIS_SOURCE:  UM



FAILURE_ID_HASH_STRING:  um:breakpoint_80000003_w3wphost.dll!apphostinitialize



FAILURE_ID_HASH:  {c8bd1ff0-1550-3c6c-7435-bfa31a670998}



Followup:     MachineOwner

---------