转载自:http://www.pianshen.com/article/441457919/
资料:https://download.csdn.net/download/ma_hong_kai/10757143(资源链接)
大牛博客: http://www.dbgtech.net/blog/
参考文章:
(https://blog.csdn.net/hustd10/article/details/52075324?_t_t_t=0.588712443805665)
(https://blog.csdn.net/bcbobo21cn/article/details/60468969)
百度网盘:链接: https://pan.baidu.com/s/1WpSD0oZ35uovEa7gSkW68g
(http://www.dbgtech.net/windbghelp/index.html
https://blog.csdn.net/u010059658/article/details/51030054)
当你空有资料,练习好多命令,苦于没法入门,就来看这个。上有资料
符号路径下载:(第一次 .reload 时间比较长)
SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
点击红色框中的蓝色的(或者直接看下面的 读 00 00 00 a2 的 时候出错)
FAULTING_IP : 错误的IP(IP就是EIP,即出错的指令地址,指出发生错误时所执行的指令)
EXCEPTION_RECORD:异常记录(很重要的信息,记录崩溃的信息。可以看到异常地址,异常代码以及具体的异常原因“尝试读取地址00000000”。)
ExceptionAdddress: 异常地址; 中断地址
ExceptionCode: 异常码
AccessViolation:非法访问
ExceptionFlag:异常标志(1,表示不可继续的异常 0,表示可继续的异常)
DEFAULT_BUCKET_ID:指出错误的类型(比如NULL_POINTER_READ、DRIVER_FAULT、NULL_CLASS_PTR_DEREFERENCE )
BUCKET_ID:当前故障属于的特定类型的故障
读取地址 00 00 00 a2 (第二个参数)的时候出错。
二、STACK_TEXT(从后往前看)
栈文本信息:(STACK_TEXT: //反映了错误前堆栈中函数调用情况,)
最后一列容易理解,是模块+函数,那前面还有5列数字,表示什么呢?
第一列表示函数调用时的EBP,
第二列表示函数的返回地址,
后三列则是函数的参数
STACK_COMMAND: ~2s; .ecxr ; kb (kb 显示调用前三项栈 .excer 结合当前例外显示例外环境记录(寄存器))
FOLLOWUP_IP: //反汇编了发生错误指令的代码
EstLog!_output_l+98f [f:\dd\vctools\crt_bld\self_x86\crt\src\output.c @ 1643]
0037ddb7 803800 cmp byte ptr [eax],0]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: estlog!_output_l+98f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: EstLog
IMAGE_NAME: EstLog.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5bd9773b
FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_c0000005_EstLog.exe!_output_l
BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_estlog!_output_l+98f
完整文章:
0:002> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
Failed calling InternetOpenUrl, GLE=12029
FAULTING_IP:
EstLog!_output_l+98f [f:\dd\vctools\crt_bld\self_x86\crt\src\output.c @ 1643]
0037ddb7 803800 cmp byte ptr [eax],0
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0037ddb7 (EstLog!_output_l+0x0000098f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 000000a2
Attempt to read from address 000000a2
PROCESS_NAME: EstLog.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 000000a2
READ_ADDRESS: 000000a2
FOLLOWUP_IP:
EstLog!_output_l+98f [f:\dd\vctools\crt_bld\self_x86\crt\src\output.c @ 1643]
0037ddb7 803800 cmp byte ptr [eax],0
MOD_LIST: <ANALYSIS/>
FAULTING_THREAD: 0000081c
BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ
PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_DEREFERENCE
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 0038276a to 0037ddb7
STACK_TEXT:
0262ede4 0038276a 0262ee08 003ad2e4 00000000 EstLog!_output_l+0x98f [f:\dd\vctools\crt_bld\self_x86\crt\src\output.c @ 1643]
0262ee28 003827aa 0262ee68 00000800 003ad2e4 EstLog!_vsnprintf_l+0x8b [f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c @ 138]
0262ee44 002b3ef3 0262ee68 00000800 003ad2e4 EstLog!_vsnprintf+0x18 [f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c @ 190]
0262f6bc 002d989d 003ad2e4 000000a2 000000a2 EstLog!LogPrint::PrintLogA+0x73 [d:\Âíºì¿\code\sipÏÖÍø\src\estlog_new\util\logprint.cpp @ 120]
0262f7d4 002d882f 020b5f78 020b1e98 020adc88 EstLog!LogData::RenameFile+0x12d [d:\Âíºì¿\code\sipÏÖÍø\src\estlog_new\data\data.cpp @ 537]
0262f808 002d8c91 020b7260 8a0147f0 020b8fc8 EstLog!BaseData::RenameUFiles+0x13f [d:\Âíºì¿\code\sipÏÖÍø\src\estlog_new\data\data.cpp @ 159]
0262f950 002d90ab 020b1e98 0262f994 003741f6 EstLog!BaseData::TryToUpLoad+0x131 [d:\Âíºì¿\code\sipÏÖÍø\src\estlog_new\data\data.cpp @ 320]
0262f95c 003741f6 020b1e98 8a014734 00000000 EstLog!BaseData::TaskThread+0x1b [d:\Âíºì¿\code\sipÏÖÍø\src\estlog_new\data\data.cpp @ 385]
0262f994 0037429e 00000000 0262f9ac 767433ca EstLog!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0262f9a0 767433ca 020b8fc8 0262f9ec 77599ed2 EstLog!_threadstartex+0x82 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0262f9ac 77599ed2 020b8fc8 75067f38 00000000 kernel32!BaseThreadInitThunk+0xe
0262f9ec 77599ea5 0037421c 020b8fc8 00000000 ntdll!__RtlUserThreadStart+0x70
0262fa04 00000000 0037421c 020b8fc8 00000000 ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND: ~2s; .ecxr ; kb
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: estlog!_output_l+98f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: EstLog
IMAGE_NAME: EstLog.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5bd9773b
FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_c0000005_EstLog.exe!_output_l
BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_estlog!_output_l+98f
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/EstLog_exe/0_0_0_0/5bd9773b/EstLog_exe/0_0_0_0/5bd9773b/c0000005/000dddb7.htm?Retriage=1
Followup: MachineOwner
---------