WinDBG可以与从Visual Studio 2015保存的转储一起使用，但不能与任务管理器一起使用。显示异常代码“未找到”； [英] WinDBG works with Dump saved from Visual Studio 2015 but not Task Manager. Shows Exception Code "not found"
问题描述
我无法获得使用任务管理器（32或64位）或Process Explorer创建的转储文件，以在WinDBG或Visual Studio 2015中提供有用的结果，而直接从VS编写的转储在这两种方法中均表现出色。我需要任务管理器转储才能工作，以便可以分析最终用户发送的转储文件。
I cannot get dump files created with Task Manager (32 or 64 bit) or Process Explorer to give useful results in WinDBG or Visual Studio 2015, whereas the dump written directly from VS works brilliantly in both. I need Task Manager dumps to work so that I can analyse dump files sent by my end users.
我已将问题简化为在VS中创建的最简单的Win32应用程序2015 C ++，使用故意的NULL指针写入会导致异常。如果我在VS中运行程序并在发生异常时使用另存为，则可以在VS和WinDBG中使用转储文件来查看引起问题的代码。
I have reduced the problem to the simplest possible Win32 application, created in VS 2015 C++, with a deliberate NULL pointer write to cause an exception. If I run the program in VS and use Save Dump As when the exception occurs, then the dump file can be used in VS and WinDBG to see the code causing the problem. This is as expected.
但是，如果我在VS之外运行应用程序，则Windows将显示通常的对话框：
However, if I run the application outside of VS, then Windows shows the usual dialog:
Win32Project.exe停止工作…调试/关闭程序。
"Win32Project.exe has stopped working … Debug / Close Program".
在此对话框仍然处于活动状态时，我转到任务管理器32位并选择创建转储文件。但是将此转储文件加载到VS或WinDBG中并没有提供有用的信息。特别是，VS将异常代码显示为未找到。单击仅使用本机调试将导致显示处于中断模式的应用程序。见下文...
Whilst this dialog is still active I go to Task Manager 32bit and select Create Dump file. But loading this dump file into VS or WinDBG gives no useful information. In particular VS shows Exception Code as "not found". Clicking on "Debug with Native only" causes "The application is in break mode to be shown". See below…
我正在运行新的Win 10 64位PC。 DMP，PDB和EXE文件位于同一目录中，我在符号目录下进行了无休止的尝试
I am running a new Win 10 64bit PC. DMP, PDB and EXE files are in the same directory, and I have tried endlessly with symbol directories
加载.DMP文件后，Visual Studio 2015输出：
Visual Studio 2015 output after loading .DMP file:
Dump Summary
------------
Dump File: Win32Project1 (4).DMP : C:\Users\Rob\AppData\Local\Temp\Win32Project1 (4).DMP
Last Write Time: 24/08/2017 16:38:27
Process Name: Win32Project1.exe : C:\Temp\ConsoleAp2\Win32Project2\Debug\Win32Project1.exe
Process Architecture: x86
Exception Code: not found
Exception Information:
Heap Information: Present
System Information
------------------
OS Version: 10.0.15063
CLR Version(s):
Modules
-------
Module Name Module Path Module Version
----------- ----------- --------------
Win32Project1.exe C:\Temp\ConsoleAp2\Win32Project2\Debug\Win32Project1.exe 0.0.0.0
ntdll.dll C:\Windows\System32\ntdll.dll 10.0.15063.447
kernel32.dll C:\Windows\System32\kernel32.dll 10.0.15063.296
...
推荐答案
为什么会发生这种情况？
它在Visual Studio中有效，因为调试器已附加。在进程终止之前，将通知调试器有关异常的信息。调试器将在Windows错误报告对话框出现之前暂停该过程，并在原始异常仍处于活动状态时创建故障转储。
Why does that happen what you see?
It works in Visual Studio because the debugger is already attached. The debugger is informed about the exception before the process terminates. The debugger will halt the process before the Windows Error Reporting Dialog occurs and create a crash dump when the original exception is still active.
要了解有关异常处理过程的更多信息从程序传递到调试器（第一次机会），再传递到程序（捕获块），再次传递给调试器（第二次机会），最后传递给操作系统，谷歌使用术语异常分配。
To learn more about the process on how exceptions are passed from the program to the debugger (first chance), back to the program (catch block), to the debugger again (second chance) and finally to the OS, google for the term "exception dispatching".
它不适用于任务管理器，因为异常分派已经处于最后状态，即由操作系统处理。这使Windows通过使用断点来暂停程序。然后显示该对话框。现在创建崩溃转储时，为时已晚，很难从该崩溃转储中获取有用的信息。
It does not work with Task Manager, because exception dispatching is already in its last state, which is "get handled by the OS". This makes Windows halt the program by making use of a breakpoint. It then shows that dialog. When you create a crash dump now, it's too late and it's very hard to get useful information from that crash dump.
此处适用的机制称为Windows错误报告。如果您在Microsoft拥有帐户，则客户只需单击提交按钮。然后，您将从Microsoft获得一些信息。您问问题的方式使我假设您没有这样的帐户。
The mechanism that applies here is called Windows Error Reporting. If you had an account at Microsoft, your customer could simply click the "submit" button. You would then get some information from Microsoft. The way you ask the question makes me assume that you don't have such an account.
然后，使用称为 LocalDumps（MSDN）。这是一个注册表项，用于配置Windows以将故障转储保存到磁盘上。确保了解此类转储中的内容，以便正确配置它。如有疑问，请查看如何进行.NET 的良好崩溃转储，并使用相同的设置（全内存用户模式迷你转储）。
Then, use a feature called LocalDumps (MSDN). It's a Registry key to configure Windows to save a crash dump on disk. Make sure you understand what you need from such a dump in order to configure it correctly. In doubt, have a look at How do I take a good crash dump for .NET and use the same settings (full memory user mode mini dump). It will be good for C++ as well.
甚至有可能在显示对话框时激活此注册表项，但自2014年以来我再也没有确认过，因此不推荐使用。
It might even be possible to activate this Registry key while the dialog is shown but I have not confirmed this any more since 2014 and I can't recommend it.
通过使用空指针取消引用示例应用程序检查设置是否有效。为此，将可执行文件重命名为与实际程序相同的名称。
Check if your settings work by using your null pointer dereference sample application. To do so, rename your executable to the same name as your actual program.
将调试器附加到该进程，然后让应用程序继续。在对话框上按调试，然后确认显示调试器已连接的消息。再次抛出第二个异常，调试器将获得它，您可以进行故障转储。
Attach a debugger to the process, then let the application continue. Press "Debug" on the dialog and confirm the message that says "a debugger is already attached". The second chance exception is thrown again, the debugger will get it and you can take a crash dump.
如果需要截图，请参见关于它的我的文章
If you need screenshots, see my article about it
请注意，方法b）您可能会犯很多错误，这将导致不正确的结果。安全的方法是按照a）所述激活LocalDumps。
Note that in approach b) you can make many mistake which will lead to improper results. The safe way is to activate LocalDumps as described in a)
这篇关于WinDBG可以与从Visual Studio 2015保存的转储一起使用，但不能与任务管理器一起使用。显示异常代码“未找到”；的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
