Help needed:Analyze the dump file in WinDbg

2

I failed to analyze the dump file using Windbg. Any help would be greatly appreciated. Here are my WinDbg settings: Symbol Path: C:\symbols;srv*c:\mss*http://msdl.microsoft.com/download/symbols (C:\symbols contains my own exe and dll symbols, map,pdb etc etc) Image Path: C:\symbols Source Path: W:\

loading crash dump(second chance) shows:

WARNING: Unable to verify checksum for nbsm.dll GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.microsoft.com/StageOne/nbsm_sm_exe/8_0_0_0/4e5649f3/KERNELBASE_dll/6_1_7600_16385/4a5bdbdf/e06d7363/0000b727.htm?Retriage=1

FAULTING_IP: +3a22faf00cadf58 00000000 ?? ???

EXCEPTION_RECORD: fffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 000000007507b727 (KERNELBASE!RaiseException+0x0000000000000058) ExceptionCode: e06d7363 (C++ EH exception) ExceptionFlags: 00000009 NumberParameters: 3

  Parameter[0]: 0000000019930520

   Parameter[1]: `0000000001aafb10`
   Parameter[2]: 000000000040c958

DEFAULT_BUCKET_ID: STACKIMMUNE

PROCESS_NAME: nbsm_sm.exe

ERROR_CODE: (NTSTATUS) 0xe06d7363 -

EXCEPTION_CODE: (NTSTATUS) 0xe06d7363 -

EXCEPTION_PARAMETER1: 0000000019930520

EXCEPTION_PARAMETER2: 0000000001aafb10

EXCEPTION_PARAMETER3: 000000000040c958

MOD_LIST:

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER: from 000000007324dbf9 to 000000007507b727

FAULTING_THREAD: ffffffffffffffff

PRIMARY_PROBLEM_CLASS: STACKIMMUNE

BUGCHECK_STR: APPLICATION_FAULT_STACKIMMUNE_ZEROED_STACK

STACK_TEXT: 0000000000000000 0000000000000000 nbsm_sm.exe+0x0

STACK_COMMAND: .cxr 01AAF6E8 ; kb ; ** Pseudo Context ** ; kb

SYMBOL_NAME: nbsm_sm.exe

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nbsm_sm

IMAGE_NAME: nbsm_sm.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4e5649f3

FAILURE_BUCKET_ID: STACKIMMUNE_e06d7363_nbsm_sm.exe!Unknown

BUCKET_ID: X64_APPLICATION_FAULT_STACKIMMUNE_ZEROED_STACK_nbsm_sm.exe

FOLLOWUP_IP: nbsm_sm!__ImageBase+0

00400000 4d              dec     ebp

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/nbsm_sm_exe/8_0_0_0/4e5649f3/KERNELBASE_dll/6_1_7600_16385/4a5bdbdf/e06d7363/0000b727.htm?Retriage=1

========================

Any ideas?

Thanks in advance! Sandeep

crash-dumps
asked on Stack Overflow Sep 21, 2011 by sandy • edited Sep 21, 2011 by chown

2 Answers

1

If this crash dump has come from a user and it is either reproducible on their system or happens relatively often then you could ask them to download procdump and run a command such as this:

procdump -e 1 -w nbsm_sm.exe c:\dumpfiles

This will create a dumpfile on the first chance exception which may give you more useful information than you have at the moment. Sometimes the dump from a second chance exception is just produced too late to be useful.

answered on Stack Overflow Oct 13, 2011 by the_mandrill
0

You can try to run 'kb' in WinDbg to see the actual stack trace. If you don't see any valuable information, assuming you are developing a native/managed C++ application, you can turn on stack checks (/GS on the cl command line) and re-run the program.

answered on Stack Overflow Oct 13, 2011 by Thierry Franzetti

User contributions licensed under CC BY-SA 3.0