请windbg高人帮忙分析下错误原因

[sunlight1234]

下面是windbg的结果,刚学不会用,请高手帮忙分析一下
Loading Dump File [D:\sunlight\xlib\sunlight\receiver 1\prcReceiver.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
Windows Server 2003 Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Debug session time: Thu Nov 6 10:45:51.000 2008 (GMT+9)
System Uptime: not available
Process Uptime: 0 days 0:02:46.000
...................................................................................................
Loading unloaded module list
..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(e24.56c): Unknown exception - code 40000015 (first/second chance not available)
eax=00000200 ebx=80070000 ecx=003a0038 edx=00000000 esi=00000374 edi=00000000
eip=7c9785ec esp=045a9328 ebp=045a9398 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
ntdll+0x285ec:
7c9785ec c3 ret
0:012> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

***** OS symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for comprcthd.dll
*** ERROR: Module load completed but symbols could not be loaded for comprcthd.dll
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image C:\WINDOWS\system32\rpcrt4.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rpcrt4.dll
*** ERROR: Module load completed but symbols could not be loaded for rpcrt4.dll
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** WARNING: Unable to verify timestamp for comsvcs.dll
*** ERROR: Module load completed but symbols could not be loaded for comsvcs.dll
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image C:\WINDOWS\system32\user32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for user32.dll
*** ERROR: Module load completed but symbols could not be loaded for user32.dll
*** WARNING: Unable to verify timestamp for msdaora.dll
*** ERROR: Module load completed but symbols could not be loaded for msdaora.dll
*** WARNING: Unable to verify timestamp for msvcrt.dll
*** ERROR: Module load completed but symbols could not be loaded for msvcrt.dll
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

[sunlight1234]

*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** WARNING: Unable to verify timestamp for faultrep.dll
*** ERROR: Module load completed but symbols could not be loaded for faultrep.dll
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

[sunlight1234]

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_IP:
msvcr80!terminate+4d
781346b4 e80c460000 call msvcr80!_dllonexit+0x89 (78138cc5)

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 781346b4 (msvcr80!terminate+0x0000004d)
ExceptionCode: 40000015
ExceptionFlags: 00000000
NumberParameters: 0

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: prcReceiver.exe

MODULE_NAME: msvcr80

FAULTING_MODULE: 7c950000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP: 45712238

ERROR_CODE: (NTSTATUS) 0x40000015 - {

FAULTING_THREAD: 0000056c

PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS

BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS

LAST_CONTROL_TRANSFER: from 0041f579 to 781346b4

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
045aec80 0041f579 78158eb7 045aff6c 045af1f0 msvcr80!terminate+0x4d
045aff78 781329bb 00181af8 a2afca3f 00000000 prcReceiver+0x1f579
045affb0 78132a47 00000000 7c824829 00bcd2d0 msvcr80!endthreadex+0x3b
045affec 00000000 781329e1 00bcd2d0 00000000 msvcr80!endthreadex+0xc7


FOLLOWUP_IP:
msvcr80!terminate+4d
781346b4 e80c460000 call msvcr80!_dllonexit+0x89 (78138cc5)

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: msvcr80!terminate+4d

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: msvcr80.dll

STACK_COMMAND: ~12s; .ecxr ; kb

BUCKET_ID: WRONG_SYMBOLS

FAILURE_BUCKET_ID: WRONG_SYMBOLS_40000015_msvcr80.dll!base_address

Followup: MachineOwner
---------

0:012> .exr
Numeric expression missing from '<EOL>'
0:012> .exr 0xffffffffffffffff
ExceptionAddress: 781346b4 (msvcr80!terminate+0x0000004d)
ExceptionCode: 40000015
ExceptionFlags: 00000000
NumberParameters: 0
0:012> lmvm msvcr80
start end module name
78130000 781cb000 msvcr80 (export symbols) msvcr80.dll
Loaded symbol image file: msvcr80.dll
Mapped memory image file: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\msvcr80.dll
Image path: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\msvcr80.dll
Image name: msvcr80.dll
Timestamp: Sat Dec 02 15:50:32 2006 (45712238)
CheckSum: 000A1D19
ImageSize: 0009B000
File version: 8.0.50727.762
Product version: 8.0.50727.762
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Visual Studio® 2005
InternalName: MSVCR80.DLL
OriginalFilename: MSVCR80.DLL
ProductVersion: 8.00.50727.762
FileVersion: 8.00.50727.762
FileDescription: Microsoft® C Runtime Library
LegalCopyright: © Microsoft Corporation. All rights reserved.

[WingForce]

其实，你需要的是prcReceiver.exe的符号，找到对应的prcReceiver.pdb指定一下就好了

[arong1234]

mini dump几乎是看不出有用的东西的，要用windbg，第一要full dump，第二必须有产生这个可执行文件的source code+pdb文件

[星羽]

http://download.csdn.net/source/519504
windbg简明教程

[帅得不敢出门]

up

[xiaonian_3654]

那你就不要理会了，呵呵

[过去的我]

右击“我的电脑”，高级-》启动和故障恢复-》写入调试信息，选“完全内存转储”

[sunlight1234]

full dump怎么才能得到?这个还是在系统重启的时候微软给的,第一次用这东西也第一次分析coredump,还希望大家不要吝惜自己的文字!先谢谢各位了

[sunlight1234]

谢啦,各位,虽然还没分析出原因,但windbg有点会用了。结贴

[Orange_ou]

跟我的差不多~~

[ltps123]

aaaaaa