среда, 3 марта 2010 г.

Windbg 6.12.2.633 is included in WDK 7.1.0.

It was a pity to read that WinDbg 6.12.2.633 is included only in WDK 7.1, so you can not download it separately without downloading WDK 7.1.0, can you?

But, let's back to the topic:
New in Windbg, as Microsoft says (visit WinDbg page ):

1.
Several bug fixes in extensions to only use public symbols
2.
General BugCheck Analysis Updates including:
Bug Check 0x9F Update – Added logic to diagnose bugcheck 0x9F minidumps using new data in Windows 7 added to the 0x9F minidumps by the Kernel and Networking Teams.
Data includes:
- All Kernel ExWorkerThreads that process Power IRPs
- IRPs Associated with any ExWorkerThread
- IRPs Associated with PnP Completion Queue
- All Kernel Power IRPs
- Device Stacks for all IRPS
- NT_TRIAGE_POWER Structure
- NT_TRIAGE_PNP structure
BugCheck 0xFE Update - Add logic to diagnose bugcheck 0xFE minidumps using new to Windows 7 callback data added by the USB team.
3.
Fixed user-mode minidump generation problem.
4.
Fixed buffer overrun in schannel transport.
5.
Fixed several kernel debugger transport issues.
6.
Fixed problem with debugger reporting incorrect FPO information.
7.
Allowed stack dumps deeper than 65535 if specified explicitly.
8.
Changed ".outmask /a" and ".outmask /d" to be set only instead of or/xor.
9.
The old ADPlus.vbs is being replaced by ADPlus.exe which requires the .Net Framework 2.0. For those cases where the .Net Framework isn't available we are still shipping the older version renamed to adplus_old.vbs. For detailed documentation of the new ADPlus.exe as well as for its new companion ADPlusManager.exe please see adplus.doc located in the same folder as adplus.exe.
It'd be great if someone could tell me how to download only windbg 6.12.2.633 installation file without downloading a whole WDK 7.1.0 package .

вторник, 2 марта 2010 г.

Crash dump analysis checklist . ( © www.dumpanalysis.org )

Here's  a link contains useful steps in dump analysis.

http://www.dumpanalysis.org/blog/index.php/2007/06/20/crash-dump-analysis-checklist/

I've copied posts to my webpage.

all copyrights are by dumpanalysis.org :-)


General:
• Symbol servers (.symfix)
• Internal database(s) search
• Google or Microsoft search for suspected components as this could be a known issue. Sometimes a simple search immediately points to the fix on a vendor’s site
• The tool used to save a dump (to flag false positive, incomplete or inconsistent dumps)
• OS/SP version (version)
• Language
• Debug time
• System uptime
• Computer name (dS srv!srvcomputername or !envvar COMPUTERNAME)
• List of loaded and unloaded modules (lmv or !dlls)
• Hardware configuration (!sysinfo)
.kframes 100
Application crash or hang:
• Default analysis (!analyze -v or !analyze -v -hang for hangs)
• Critical sections (!locks and !locks -v, !cs -s -l -o) for both crashes and hangs
• Component timestamps, duplication and paths. DLL Hell? (lmv and !dlls)
• Do any newer components exist?
• Process threads (~*kv or !uniqstack)
• Process uptime
• Your components on the full raw stack of the problem thread
• Your components on the full raw stack of the main application thread
• Process size
• Number of threads
• Gflags value (!gflag)
• Time consumed by thread (!runaway)
• Environment (!peb)
• Import table (!dh)
• Hooked functions (!chkimg)
• Exception handlers (!exchain)
• Computer name (!envvar COMPUTERNAME)
System hang:
• Default analysis (!analyze -v -hang)
• ERESOURCE contention (!locks)
• Processes and virtual memory including session space (!vm 4)
• Important services are present and not hanging (for example, terminal or IMA services for Citrix environments)
• Pools (!poolused)
• Waiting threads (!stacks)
• Critical system queues (!exqueue f)
• I/O (!irpfind)
• The list of all thread stack traces (!process 0 ff for W2K3/XP/Vista, ListProcessStacks script for W2K)
• LPC/ALPC chain for suspected threads (!lpc message or !alpc /m after search for “Waiting for reply to LPC” or “Waiting for reply to ALPC” in !process 0 ff output)
• Mutants (search for “Mutants - owning thread” in !process 0 ff output)
• Critical sections for suspected processes (!ntsdexts.locks, !cs -l -o -s)
• Sessions, session processes (!session, !sprocess)
• Processes (size, handle table size) (!process 0 0)
• Running threads (!running)
• Ready threads (!ready)
• DPC queues (!dpcs)
• The list of APCs (!apc)
• Internal queued spinlocks (!qlocks)
• Computer name (dS srv!srvcomputername)
• File cache, VACB (!filecache)
BSOD:
• Default analysis (!analyze -v)
• Pool address (!pool)
• Component timestamps (lmv)
• Processes and virtual memory (!vm 4)
• Current threads on other processors
• Raw stack
• Bugcheck description (including ln exception address for corrupt or truncated dumps)
• Bugcheck callback data (!bugdump for systems prior to Windows XP SP1)
• Bugcheck secondary callback data (.enumtag)
• Computer name (dS srv!srvcomputername)
• Hardware configuration (!sysinfo)