怎么分析hopper log和dump文件？

[hufubin]

哪位大侠对分析hopper产生的data abort和dump文件比较熟悉。我分析hopper log的时候，发现一些data abort,通过PC地址找到相应的MAP文件的某个函数之后，发现报错的是Windows Mobile的自身组件的函数报错，这种情况下，应该如何分析和定位问题呢？

[儿大不由爷]

ms的东西也可能有问题

[ProgrammerNO1]

发现报错的是Windows Mobile的自身组件的函数报错

贴出来看看

[ppc_2008]

也很有可能是系统的问题啊

[Hinagi]

dota abort先看看pc和RA是不是你自己的exe或者dll,如果不是的话就看call stack里面的
比如下面这个data abort, 根据PC和RA的值是找不到我们程序的offset的,但是下面的call stack立面就有我们自己程序的MyProgram.exe根据那个偏移量来定位自己的代码,顺序是从下向上

000d632e 8031f6b0 82f1e79c Data Abort: Thread=82f1e79c Proc=8031f6b0 'MyProgram.exe'
000d632e 8031f6b0 82f1e79c AKY=00000801 PC=03f6c5d0(coredll.dll+0x000225d0) RA=03f6c4b8(coredll.dll+0x000224b8) BVA=18000010 FSR=00000007
000d632e 8031f6b0 82f1e79c [Exception]
000d632e 8031f6b0 82f1e79c * Exception Info :
000d632e 8031f6b0 82f1e79c EXCEPTION_ACCESS_VIOLATION, CONTINUABLE, Record=0, Addr=03F6C5D0, NumParameters=2
000d632e 8031f6b0 82f1e79c ExceptionInformation Data-
000d632e 8031f6b0 82f1e79c [1]: 00000000
000d632e 8031f6b0 82f1e79c [2]: 18000010
000d632e 8031f6b0 82f1e79c * Registers Info :
000d632e 8031f6b0 82f1e79c R0 = 198F0000, R1 = 00000000, R2 = 018F12F0, R3 = 000012E8
000d632e 8031f6b0 82f1e79c R4 = 198F12E8, R5 = 00000000, R6 = 198F0000, R7 = 018F12F0
000d632e 8031f6b0 82f1e79c R8 = 00000000, R9 = 00000020, R10= 00000004, R11= 1971F94C
000d632e 8031f6b0 82f1e79c R12= 00000000, SP = 1971F8BC, LR = 03F6C4B8, PC = 03F6C5D0
000d632e 8031f6b0 82f1e79c CPSR=60000010
000d632e 8031f6b0 82f1e79c * Thread Info :
000d632e 8031f6b0 82f1e79c Thread = 82F1E79C
000d632e 8031f6b0 82f1e79c ThreadId = C4B95CA6
000d632e 8031f6b0 82f1e79c Curr Proc = 8031F6B0 (MyProgram.exe)
000d632e 8031f6b0 82f1e79c Owner Proc = 8031F6B0 (MyProgram.exe)
000d632e 8031f6b0 82f1e79c Start PC = 000C5670 (MyProgram.exe+000B5670)
000d632e 8031f6b0 82f1e79c Access Key = 00000801
000d632e 8031f6b0 82f1e79c Base Prio = 251
000d632e 8031f6b0 82f1e79c Curr Prio = 251
000d632e 8031f6b0 82f1e79c Stack Base = 19710000
000d632e 8031f6b0 82f1e79c Stack Size = 65536
000d632e 8031f6b0 82f1e79c State Info = 0000
000d632e 8031f6b0 82f1e79c Wait State = 00
000d632e 8031f6b0 82f1e79c * Call Stack Extended Information:
000d632e 8031f6b0 82f1e79c [###]: [RetAdr] [FrmPtr] [CurPrc] [Param0] [Param1] [Param2] [Param3]
000d632e 8031f6b0 82f1e79c [ 1]: 03F6C5D0 1971F8BC C4B95CCA 198F0000 00000000 018F12F0 000012E8 (coredll.dll+000225D0)
000d632e 8031f6b0 82f1e79c [ 2]: 03F6B8A8 1971F8D8 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (coredll.dll+000218A8)
000d632e 8031f6b0 82f1e79c [ 3]: 03F51B88 1971F8E0 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (coredll.dll+00007B88)
000d632e 8031f6b0 82f1e79c [ 4]: 18054E24 1971F8E4 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+00044E24) // MApp:MAppWinParserObj.obj
000d632e 8031f6b0 82f1e79c [ 5]: 1805F714 1971F94C C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+0004F714) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 6]: 18021370 1971F97C C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+00011370) // m根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 7]: 18022964 1971FB84 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+00012964) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 8]: 18018300 1971FC14 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+00008300)
000d632e 8031f6b0 82f1e79c [ 9]: 1803BB34 1971FC4C C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+0002BB34) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 10]: 1803CF08 1971FC60 C4B95CCA 198F0000 00000000 018F12F0 000012E8 (MyProgram.exe+0002CF08) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 11]: 03F61748 1971FC88 038A683A 198F0000 00000000 018F12F0 000012E8 (coredll.dll+00017748)
000d632e 8031f6b0 82f1e79c [ 12]: 0C027108 1971FC90 038A683A 00104BA8 00000000 018F12F0 000012E8 (gwes.exe+00017108)
000d632e 8031f6b0 82f1e79c [ 13]: 0C027BFC 1971FCB8 038A683A 00000000 00000000 00000000 C4B95CCA (gwes.exe+00017BFC)
000d632e 8031f6b0 82f1e79c [ 14]: 0C0219D8 1971FD30 038A683A 00000000 00000000 00000000 C4B95CCA (gwes.exe+000119D8)
000d632e 8031f6b0 82f1e79c [ 15]: 03F607B4 1971FD68 C4B95CCA 00000000 00000000 00000000 C4B95CCA (coredll.dll+000167B4)
000d632e 8031f6b0 82f1e79c [ 16]: 1802A1E8 1971FD7C C4B95CCA 00000000 00000000 00000000 C4B95CCA (MyProgram.exe+0001A1E8) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 17]: 18014250 1971FDC0 C4B95CCA 00000000 00000000 00000000 C4B95CCA (AudioRecorder.exe+00004250)
000d632e 8031f6b0 82f1e79c [ 18]: 1802A530 1971FDE8 C4B95CCA 00000000 00000000 00000000 C4B95CCA (MyProgram.exe+0001A530) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 19]: 180C56A4 1971FE14 C4B95CCA 00000000 00000000 00000000 C4B95CCA (MyProgram.exe+000B56A4) // 根据000B56A4查找map 定位代码
000d632e 8031f6b0 82f1e79c [ 20]: 03F67728 1971FE34 C4B95CCA 00000000 00000000 00000000 C4B95CCA (coredll.dll+0001D728)

[Hinagi]

当然有的data abort在call stack里面也米有自己的exe,那个时候就是系统的错误了(当然也有可能是因为你的程序错误导致的系统错误,这种情况很多,比如有很多时候log里面显示的就是先有你程序的data abort然后紧跟着一个gwes的exception)