简单分析minidump

转载自:http://91dengdeng.cn/2019/05/07/%E7%AE%80%E5%8D%95%E5%88%86%E6%9E%90minidump-1/

 

简单分析minidump(1)

有了前几节的准备工作,我们的程序已经可以自动捕获异常了,那么我们开始通过windbg来分析dump解决实际问题。先从简单入手,一个index过大导致数组越界引发的崩溃

1、使用windbg 打开dump,设置pdb、系统pdb。

2、设置完成后,执行命令”.ecxr”。 因为是程序自动截获异常,所以dump中已保存了异常的上下文,直接使用”.ecxr” 切换即可。

1
2
3
4
5
6
0:135> .ecxr
eax=0dea0048 ebx=0016ae18 ecx=7ff22000 edx=004b38e8 esi=0aba40b8 edi=0016ae10
eip=004448cd esp=0ba9ebfc ebp=0ba9ec08 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
CheckSvr!CalcKubIndexByGameID+0x1d:
004448cd ?? ???

 

3、“kv”。打印异常上下文的栈信息

1
2
3
4
5
6
7
8
9
10
0:135> kv
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
0ba9ec08 0040d9c4 0dea0048 af7220ac 0016ae10 CheckSvr!CalcKubIndexByGameID+0x1d (FPO: [Non-Fpo]) (CONV: cdecl) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\checksvr\main.cpp @ 1082]
0ba9fcd4 0040bcb4 0db37c10 0db41a88 0aae48c0 CheckSvr!CSockServer::OnRefreshResultExFromKub+0x1ce4 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\checksvr\cmpaqpro.cpp @ 1081]
0ba9feb4 0045ca88 0db37c10 0db41a88 0aae48c0 CheckSvr!CSockServer::OnRefreshResultEx+0x134 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\checksvr\cmpaqpro.cpp @ 419]
0ba9ff2c 00477674 0db37c10 0db41a88 0016ae18 CheckSvr!CSockServer::OnRequest+0xd38 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\checksvr\socksvr.cpp @ 1931]
0ba9ff54 0047e7db 00000000 0aae5e68 0a9c23a0 CheckSvr!CIocpWorker::DoWorkLoop+0xa4
0ba9ff6c 0047e7ab 0ba9ffac 0050c01d 0016ae10 CheckSvr!CBaseWorker::WorkerThreadProc+0x2b
0ba9ff74 0050c01d 0016ae10 876c3023 00000000 CheckSvr!CBaseWorker::WorkerThreadFunc+0xb

 

4、异常函数为CalcKubIndexByGameID, 入参的值为0dea0048。 回到代码查看CalcKubIndexByGameID的实现,

1
2
3
4
int CalcKubIndexByGameID(int nGameID )
{ 
       return g_kub[nGameID];
}

明显nGameID 过大导致访问数组越界。 然后排查代码,发现nGameID未使用默认值,某些条件下使用了随机值导致。

 

简单分析minidump(2)

有了前几节的准备工作,我们的程序已经可以自动捕获异常了,那么我们开始通过windbg来分析dump解决实际问题。先从简单入手,CString大小写转化导致的异常(提取码ffk6)。

步骤1

使用windbg打开minidump,设置好应用程序的pdb, 执行命令 “.ecxr” 、”kv” ,打印如下栈信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
0:121> .ecxr
eax=0e16eea8 ebx=00160768 ecx=00000000 edx=00000001 esi=0e16ef38 edi=0e16ef48
eip=7c80bef7 esp=0e16eea4 ebp=0e16eef8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
Unable to load image C:\WINDOWS\system32\kernel32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for kernel32.dll
*** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
kernel32+0xbef7:
7c80bef7 ??              ???
*** ERROR: Module load completed but symbols could not be loaded for mfc120.dll
0:121> kv
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
0e16eea0 1028bc8c e06d7363 00000001 00000000 kernel32+0xbef7
*** WARNING: Unable to verify timestamp for msvcr120.dll
*** ERROR: Module load completed but symbols could not be loaded for msvcr120.dll
0e16eef8 005a9339 e06d7363 00000001 00000003 mfc120+0x28bc8c
0e16ef38 101eee11 0e16ef48 1028bc8c 1029b540 msvcr120+0x19339
0e16ef4c 100566d4 00160760 0b139848 004a67d2 mfc120+0x1eee11
*** WARNING: Unable to verify timestamp for BlockSvr.exe
0e16ef8c 004dc703 0b224248 ec476e15 00000002 mfc120+0x566d4
0e16fea0 004c2bcf 0b139e10 0b167c20 001dfe60 BlockSvr!CSockServer::OnLogonUserV2+0x723 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\blocksvr\user.cpp @ 11713]
0e16ff2c 005041e4 0b139e10 0b167c20 00160768 BlockSvr!CSockServer::OnRequest+0x90f (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\blocksvr\socksvr.cpp @ 424]
0e16ff54 0050c04b 00000000 0b088970 0b2ec408 BlockSvr!CIocpWorker::DoWorkLoop+0xa4
0e16ff6c 0050c01b 0e16ffac 005bc01d 00160760 BlockSvr!CBaseWorker::WorkerThreadProc+0x2b
0e16ff74 005bc01d 00160760 9835355e 00000000 BlockSvr!CBaseWorker::WorkerThreadFunc+0xb
0e16ffac 005bc001 00000000 0e16ffec 7c82482f msvcr120+0x2c01d
0e16ffb8 7c82482f 0b2ec408 00000000 00000000 msvcr120+0x2c001
0e16ffec 00000000 005bbfb4 0b2ec408 00000000 kernel32+0x2482f

步骤2

显示了应用程序的代码行号,但我们希望看到更仔细点,就需要加载windows的系统符号文件

1
e:\mylocalsymbols;SRV*e:\mylocalsymbols*http://msdl.microsoft.com/download/symbols

步骤3

设置后,重新“kv” 查看堆栈信息,显示如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
0:121> kv
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
0e16eef8 005a9339 e06d7363 00000001 00000003 kernel32!RaiseException+0x53 (FPO: [Non-Fpo])
0e16ef38 101eee11 0e16ef48 1028bc8c 1029b540 msvcr120!_CxxThrowException+0x5b (FPO: [Non-Fpo]) (CONV: stdcall) [f:\dd\vctools\crt\crtw32\eh\throw.cpp @ 152]
0e16ef4c 100566d4 00160760 0b139848 004a67d2 mfc120!AfxThrowInvalidArgException+0x19 (FPO: [Non-Fpo]) (CONV: stdcall) [f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp @ 228]
*** WARNING: Unable to verify timestamp for BlockSvr.exe
0e16ef58 004a67d2 ec477f39 00000000 49bf1ce1 mfc120!ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >::MakeLower+0x23 (FPO: [0,0,0]) (CONV: thiscall) [f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h @ 1796]
0e16ef8c 004dc703 0b224248 ec476e15 00000002 BlockSvr!IsTempLogonToken+0x52 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\blocksvr\main.cpp @ 2277]
0e16fea0 004c2bcf 0b139e10 0b167c20 001dfe60 BlockSvr!CSockServer::OnLogonUserV2+0x723 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\blocksvr\user.cpp @ 11713]
0e16ff2c 005041e4 0b139e10 0b167c20 00160768 BlockSvr!CSockServer::OnRequest+0x90f (FPO: [Non-Fpo]) (CONV: thiscall) [d:\program files (x86)\jenkins\workspace\publish_gamechannel\blocksvr\socksvr.cpp @ 424]
0e16ff54 0050c04b 00000000 0b088970 0b2ec408 BlockSvr!CIocpWorker::DoWorkLoop+0xa4
0e16ff6c 0050c01b 0e16ffac 005bc01d 00160760 BlockSvr!CBaseWorker::WorkerThreadProc+0x2b
0e16ff74 005bc01d 00160760 9835355e 00000000 BlockSvr!CBaseWorker::WorkerThreadFunc+0xb
0e16ffac 005bc001 00000000 0e16ffec 7c82482f msvcr120!_callthreadstartex+0x1b (FPO: [Non-Fpo]) (CONV: cdecl) [f:\dd\vctools\crt\crtw32\startup\threadex.c @ 376]
0e16ffb8 7c82482f 0b2ec408 00000000 00000000 msvcr120!_threadstartex+0x7c (FPO: [Non-Fpo]) (CONV: stdcall) [f:\dd\vctools\crt\crtw32\startup\threadex.c @ 354]
0e16ffec 00000000 005bbfb4 0b2ec408 00000000 kernel32!BaseThreadStart+0x34 (FPO: [Non-Fpo])

结论

可以看到是由于CString 触发了_CxxThrowException。 服务从VC6版本切换到VS2013,CString 的MakeLower 函数检查变的更加严格,部分特殊用户名在VC6中正确转化,但是在vs2013中会抛出异常,将大小写转化函数替换为CharLower ,问题解决

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值