Windows中崩溃进程的可预测退出代码 [英] Predictable exit code of crashed process in Windows

问题描述

对于在Windows中正常退出的进程，进程的退出代码通常是 main 的返回值，或者是传递给 std :: exit 。 ％ERRORLEVEL％可用于查询退出代码，并可用于确定程序是否正确执行，还是有一些异常输入/失败指示一个特定的问题（应用程序特定）。

For a process exiting normally in Windows, the exit code of the process is generally either the return value from main, or the exit code passed to std::exit. %ERRORLEVEL% can then be used to query the exit code, and that can be used to determine whether the program executed either correctly, or there were some exceptional inputs/failures that indicate a particular problem (application specific).

但是，如果进程崩溃，我对退出代码感兴趣。以一个非常简单的示例程序：

However, I'm interested in the exit code if the process crashes. Take a very simple example program:

int main()
{
    int * a = nullptr;
    *a = 0xBAD;
    return 0;
}

当我编译这个并在Windows中运行时，

When I compile this and run in Windows, on the command line I get:

MyCrashProgram.exe -> crashes
echo %ERRORLEVEL%  -> -1073741819

退出代码始终为此编号。其中有几个问题：

The exit code is consistently this number. Which leads me to several questions:

• 退出代码 -1073741819 ，基于无效的写崩溃？


• 如果是，是否有某种方法可以根据退出代码确定崩溃类型？




• 这是否会随着所使用的Windows版本而变化（我使用的是Win10 TP）？
架构（例如x64 - 我使用的Win32）？

• Was the exit code -1073741819 somehow predicable, based on the invalid write crash?
• If so, is there some way to determine the type of crash, based on the exit code?
• Does this change with the compiler used (I used MSVC 2012)?
• Does this change with the version of Windows being used (I used Win10 TP)?
• Does this change with the architecture (eg. x64 - I used Win32)?

注意，我不感兴趣如何修改程序来捕获异常。

Note, I am not interested in how to modify the program to catch the exception. I am interested in classifying crashes that can happen in existing programs, that I may not be able to modify.

推荐答案

关于我们的评论 STATUS_ACCESS_VIOLATION ，让我转到 GetExceptionCode ：

The comment about STATUS_ACCESS_VIOLATION, led me to the documentation on GetExceptionCode:

返回值标识异常的类型。下表列出了由于常见编程错误而可能发生的异常代码。这些值在WinBase.h和WinNT.h中定义。

The return value identifies the type of exception. The following table identifies the exception codes that can occur due to common programming errors. These values are defined in WinBase.h and WinNT.h.

EXCEPTION_ACCESS_VIOLATION 映射到 STATUS_ACCESS_VIOLATION 下面的列表。列表中前缀为 STATUS 的所有异常都直接定义为以 EXCEPTION 为前缀的异常代码。遵循 RaiseException ，它解释了发生异常时尝试调试的过程，最后一步是：

EXCEPTION_ACCESS_VIOLATION maps to STATUS_ACCESS_VIOLATION in the list that follows. All exceptions in the list prefixed with STATUS are directly defined to exception codes prefixed with EXCEPTION. Following the documentation to RaiseException, it explains the process of attempting to debug the exception when it occurs, the final step being:

如果进程没有被调试，或者相关的调试器不处理异常，系统将根据异常类型提供默认处理。对于大多数异常，默认操作是调用ExitProcess函数。

If the process is not being debugged, or if the associated debugger does not handle the exception, the system provides default handling based on the exception type. For most exceptions, the default action is to call the ExitProcess function.

因此，为了回答我的问题：

So to answer my questions:

• 退出代码是predicatble，它映射到 EXCEPTION_STATUS_VIOLATION 。


• 其他类型的错误将映射到其他常见异常代码。但是，如果使用任意异常代码（未处理）调用RaiseException，则进程的退出代码可以是任何


• 退出代码取决于Windows SDK，而不是编译器，执行Windows版本或体系结构。虽然这在理论上可能会随着较新的Windows SDK而改变，但这对于向后兼容性而言极不可能。

• Yes, the exit code was predicatble, it maps to EXCEPTION_STATUS_VIOLATION.
• Other types of errors would map to other common exception codes. However, with a call to RaiseException with an arbitrary exception code (which was unhandled), the exit code of the process could be anything
• The exit code is dependent on the Windows SDK, not the compiler, executing Windows version or architecture. Although this could theoretically change with newer Windows SDKs, that is highly unlikely for backwards compatibility.

这篇关于Windows中崩溃进程的可预测退出代码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！