Windbg解决一个闪退

问题描述 ：一个外部的程序与主程序交互，登录之后即闪退

1.找到了问题的版本

2.设置symbol search path:

3.启动指定的exe,并填写启动参数

4.运行程序Crash时，windbg会自动捕获异常

ModLoad: 18d30000 18d81000   D:\接收文件\gtja1106\lang.dll

(33f8.2a50): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=00000000 ebx=00000000 ecx=74c03190 edx=169ffe38 esi=00000045 edi=01cb39e8

eip=08446af7 esp=0046d6e8 ebp=0046d730 iopl=0         nv up ei pl zr na pe nc

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246

*** WARNING: Unable to verify checksum for D:\接收文件gtja1106\gtjawt\bin\RichEZ_emb.dll

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for D:\接收文件\gtja1106\gtjawt\bin\RichEZ_emb.dll -

RichEZ_emb+0x66af7:

08446af7 83bbb401000000  cmp     dword ptr [ebx+1B4h],0 ds:002b:000001b4=????????

 

5.用kb显示堆栈，

0:000> kb

*** ERROR: Module load completed but symbols could not be loaded for dzh2.exe

ChildEBP RetAddr  Args to Child             

WARNING: Stack unwind information not available. Following frames may be wrong.

0046d730 01918a53 0046d750 00000045 00000000 RichEZ_emb+0x66af7

0046f754 01918d15 01d19620 0fbbfcd2 0fbbf890 dzh2+0x598a53

0046f780 018e12cf 0fbb2c38 00000000 01a47d0b dzh2+0x598d15

0046fc38 782486fc 02186fc8 008d4d8d 00000000 dzh2+0x5612cf

0046fc4c 01ba004e 01380000 00000000 008d4d8d mfc100!AfxWinMain+0x49 [f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp @ 37]

0046fce0 74c0338a 7efde000 0046fd2c 77679f72 dzh2+0x82004e

0046fcec 77679f72 7efde000 687e2751 00000000 kernel32!BaseThreadInitThunk+0xe

0046fd2c 77679f45 01ba01d8 7efde000 00000000 ntdll!__RtlUserThreadStart+0x70

0046fd44 00000000 01ba01d8 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b

 

6.发现dzh2的关键堆栈的未显示出来，lm一下，发现dzh2未找到pdb文件

0:000> lm

start    end        module name

005d0000 005d9000   DllInject   (deferred)            

00c00000 00c1f000   DZH2OB     (deferred)            

01380000 02571000   dzh2       (no symbols)          

04220000 04230000   Dogskin    (deferred)        

 

7.检查一下symbol search path，将pdb文件拷入，.reload ,之后再后，符号已加载

0:000> .reload

Reloading current modules

................................................................

................................................................

.......................

*** WARNING: Unable to verify checksum for D:\接收文件\卓家斌\gtja1106\gtjawt\bin\RichEZ_emb.dll

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for D:\接收文件\卓家斌\gtja1106\gtjawt\bin\RichEZ_emb.dll -

0:000> lm

start    end        module name

005d0000 005d9000   DllInject   (deferred)            

00c00000 00c1f000   DZH2OB     (deferred)            

01380000 02571000   dzh2       (deferred)            

 

8.用kb 再看一下堆栈，位置确定

0:000> kb

ChildEBP RetAddr  Args to Child             

WARNING: Stack unwind information not available. Following frames may be wrong.

0046d730 01918a53 0046d750 00000045 00000000 RichEZ_emb+0x66af7

0046f754 01918d15 01d19620 0fbbfcd2 0fbbf890 dzh2!COrderBar::SendWtRequest+0x94 [d:\buildroom\dzh2-sp114-job1\dzh2\orderbar.cpp @ 777]

0046f768 0190784c 01ecea98 01e90260 0fbb2c38 dzh2!COrderBar::OpenOrderSystem+0x68 [d:\buildroom\dzh2-sp114-job1\dzh2\orderbar.cpp @ 88]

0046f780 018e12cf 0fbb2c38 00000000 01a47d0b dzh2!CMoveStatusBar::ShowOrderBar+0x99 [d:\buildroom\dzh2-sp114-job1\dzh2\movetool2.cpp @ 2995]

0046f78c 01a47d0b aaa307ec 01ecea98 01ecea98 dzh2!CMainFrame::OpenOrderBar+0x3a [d:\buildroom\dzh2-sp114-job1\dzh2\mainfrm1.cpp @ 2107]

0046fc38 782486fc 02186fc8 008d4d8d 00000000 dzh2!CSuperStkApp::InitInstance+0x1611 [d:\buildroom\dzh2-sp114-job1\dzh2\superstk.cpp @ 1665]

0046fc4c 01ba004e 01380000 00000000 008d4d8d mfc100!AfxWinMain+0x49 [f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp @ 37]

0046fce0 74c0338a 7efde000 0046fd2c 77679f72 dzh2!__tmainCRTStartup+0x150 [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 547]

 

9.打开源码，找到对应的位置

memcpy(buff,pCopyDataStruct->lpData,sLen);

原因是pCopyDataStruct->lpData是空指针

 

总结：

1.需要找到匹配的pdb文件。

2.设置windbg自动捕获异常，执行命令行 windbg.exe -I