posted by Shayan_Anique

posted by windev

[31:29] - Episode review and next week... Kernel debugging

can you show ho to debug manual crash dump (http://msdn.microsoft.com/en-us/library/windows/hardware/ff545499%28v=vs.85%29.aspx) when the PC freezes?

posted by MagicAndre1981

posted by Philip Saunders

Kernel - I think Chad mentions CtrlScrollScroll and CrashOnNMI in next week's episode, and I think I might have in #1 too... If it was missed, email the show (defragtools@microsoft.com) and I'll go over them in the next kernel debugging video shoot.

If you question is more about kernel hang debugging vs. crash debugging, we'll cover that ~6 episodes from now.

@Philip Saunders: ProcDump v5.1 is still going through the signing process. I'll ping Mark to see if it can be expedited.

[UPDATE: 16th Nov. 2012 -- ProcDump v5.1 is now available]

posted by windev

windev wrote

@MagicAndre1981:

Kernel - I think Chad mentions CtrlScrollScroll and CrashOnNMI in next week's episode, and I think I might have in #1 too... If it was missed, email the show (defragtools@microsoft.com) and I'll go over them in the next kernel debugging video shoot.

If you question is more about kernel hang debugging vs. crash debugging, we'll cover that ~6 episodes from now.

I think you mentioned it in a show where you've explained IRQLs.

I really think it is nice to have a full step through a hang dump of the kernel. I really want to know how to start doing this.

posted by MagicAndre1981

posted by windev

windev wrote

We will do that for user and kernel..

great You should do examples of hanging (... is not responding) Explorer and Internet Explorer.

posted by MagicAndre1981

posted by BrianHartung

posted by Cyberbrad

http://naveensrinivasan.com/2010/07/26/script-to-load-sos-within-windbg-based-on-net-framework-version/

The script in question is:

!for_each_module .if(($sicmp( "@#ModuleName" , "mscorwks") = 0) ) {.loadby sos mscorwks} .elsif ($sicmp( "@#ModuleName" , "clr") = 0) {.loadby sos clr}

It probably would be best to have this saved to disk and just load it in the debugger, but I simply coppy and past from commonly used list of commands / scripts.

posted by DakotaGeek

!clrstack just lists the managed frames. !dumpstack lists the managed and native frames (it's the closest to 'k').

posted by windev

HRESULT Execute(IDebugClient* pDebugClient, PCSTR szCommand, BOOL bPrivate)
{
    HRESULT hr = E_FAIL;
    // Make our own client
    IDebugClient* pDebugCreated;
    if (SUCCEEDED(hr = pDebugClient->CreateClient(&pDebugCreated)))
    {
        IDebugControl* pDebugControl;
        if (SUCCEEDED(hr = pDebugCreated->QueryInterface(__uuidof(IDebugControl), (void **)&pDebugControl)))
        {
            if (bPrivate)
            {
                hr = pDebugControl->Execute(DEBUG_OUTCTL_THIS_CLIENT | DEBUG_OUTCTL_NOT_LOGGED, szCommand, DEBUG_EXECUTE_NOT_LOGGED | DEBUG_EXECUTE_NO_REPEAT);
            }
            else
            {
                hr = pDebugControl->Execute(DEBUG_OUTCTL_ALL_CLIENTS, szCommand, DEBUG_EXECUTE_NO_REPEAT);
            }
            pDebugControl->Release();
        }
        pDebugCreated->Release();
    }
    return hr;
}

HRESULT loadsos(IDebugClient* pDebugClient, PCSTR args)
{
    UNREFERENCED_PARAMETER(args);
    HRESULT hr = S_OK;
    IDebugSymbols* pDebugSymbols;
    hr = pDebugClient->QueryInterface(__uuidof(IDebugSymbols), (void **)&pDebugSymbols);
    if (SUCCEEDED(hr))
    {
        ULONG nIndex = 0xFFFF;

        // .NET 2.0
        hr = pDebugSymbols->GetModuleByModuleName("mscorwks", 0, &nIndex, NULL);
        if ((hr == S_OK) && (nIndex !=0xFFFF))
        {
            hr = Execute(pDebugClient, ".loadby sos mscorwks", TRUE);
            hr = Execute(pDebugClient, ".cordll -l", TRUE);
            goto CleanUp;
        }

        // .NET 4.0
        hr = pDebugSymbols->GetModuleByModuleName("clr", 0, &nIndex, NULL);
        if ((hr == S_OK) && (nIndex !=0xFFFF))
        {
            hr = Execute(pDebugClient, ".loadby sos clr", TRUE);
            hr = Execute(pDebugClient, ".cordll -l", TRUE);
            goto CleanUp;
        }

        // Silverlight
        hr = pDebugSymbols->GetModuleByModuleName("coreclr", 0, &nIndex, NULL);
        if ((hr == S_OK) && (nIndex !=0xFFFF))
        {
            hr = Execute(pDebugClient, ".loadby sos coreclr", TRUE);
            hr = Execute(pDebugClient, ".cordll -l", TRUE);
            goto CleanUp;
        }
CleanUp:
        pDebugSymbols->Release();
    }
    return hr;
}
extern "C" HRESULT CALLBACK
DebugExtensionInitialize(PULONG Version, PULONG Flags)
{
    *Version = DEBUG_EXTENSION_VERSION(EXT_MAJOR_VER, EXT_MINOR_VER);
    *Flags = 0;  // Reserved for future use.

    HRESULT hr = S_OK;
    IDebugClient* pDebugClient;
    hr = DebugCreate(__uuidof(IDebugClient), (void **)&pDebugClient);
    if (hr == S_OK)
    {
        // Load SOS and do .cordll
        loadsos(pDebugClient, NULL);
        pDebugClient->Release();
    }
    return hr;
}

posted by windev

posted by dcrearer

Does the .prefer_dml 1 registry command only work on dump files?

posted by dcrearer

@dcrearer: You can only do .ecxr if an exception context record has been added to dump by the dump creator. A hang dump (for example) won't have one.  In this case, you only have the context of when the dump was taken.

@dcrearer: .prefer_dml 1 works in all scenarios.  It isn't dependant on live vs. dump, or user vs. kernel.  If you launch windbg via the .dmp association, then yes, the -c ".prefer_dml 1" will be executed from the command key. For manual, make a shortcut to windbg with the -c ".prefer_dml 1" added to the command line.

posted by windev

posted by dcrearer

I did some searching and it looks like RegGetValue() is only available on Win XP x64, Vista, and newer, so that might be the problem (MSDN link below).  It worked fine on the Win 7 x86 and x64 PCs I tried it on.  Did you update the code used to read the EulaAccepted value out of "HKEY_CURRENT_USER\Software\Sysinternals\ProcDump"?

RegGetValue function (Windows)

http://msdn.microsoft.com/en-us/library/windows/desktop/ms724868%28v=vs.85%29.aspx

posted by Cyberbrad

posted by windev

posted by Cyberbrad

posted by Jeff Rivett

posted by windev

posted by windev

posted by windev

posted by Evginnie