How can I find out WinDbg? (re: seemingly simple temporal process)

Question

I am trying to determine why a process is hanging, and I will learn about various tools such as Process Explorer , Process Monitor, and WinDbg .

In any case, I try to use WinDbg and after attaching to my process, the debugger says the following:

(1e9c.1128): Break instruction exception - code 80000003 (first chance) eax=7ffda000 ebx=00000000 ecx=00000000 edx=77c5c964 esi=00000000 edi=00000000 eip=77c18b2e esp=0543ff5c ebp=0543ff88 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!DbgBreakPoint: 77c18b2e cc int 3 

If I run !analyze -v , it will display the following:

 FAULTING_IP: ntdll!DbgBreakPoint+0 77c18b2e cc int 3 

I am a software developer (VB.NET/C#) with no experience in this level of debugging, so I'm not sure what I am doing, but it looks like WinDbg is joining my process and then crashing right away. Then, when I do the analysis, he thinks the breakpoint (which she just set) is a problem with the application?

How can I use WinDbg to easily join and analyze a process?

(Also, are there any good books / tutorials to get started with this level of debugging and WinDbg?)

Answer 1

WinDbg is a user and kernel mode debugger, but by itself it does not understand managed code, and therefore the !analyze command has limited use. If you want to debug managed applications using WinDbg, you need to somehow make WinDbg understand the internal structures of managed code. There are many DLL extensions that allow this. The .NET platform comes with sos.dll, and there are downloads such as psscor2.dll and sosex.dll .

SOS and PSSCOR2 provide more or less the same functions, while SOSEX adds new features for controlled debugging. Help files for each of them are available from WinDbg. For example. for help for SOS, you can use the !sos.help .

You need to download SOS or PSSCOR2 and possibly SOSEX to debug a managed application using WinDbg. For example. if you want to load SOS, you use a load command like this

.loadby sos clr

This will load SOS from the location of the .NET runtime. Note that the runtime is called mscorwks in .NET 2 and coreclr in Silverlight, so if you use any of them, you need to modify the .loadby command .loadby .

WinDbg needs characters to display additional information. This is especially important for unmanaged code. You can use the .symfix command .symfix that WinDbg retrieves characters as needed from the Microsoft character server.

As your application hangs, there is a good chance that you will have one or more blocked threads. You can view managed threads with the !threads (or just !t ) command. In .NET, simple locks are implemented internally using the SyncBlocks framework. You can view them using the !syncblk . If you downloaded SOSEX, the !dlk can automatically detect deadlocks.

If you need more information, there are several books and some blogs to read.

Books:

• Advanced .NET debugging by Mario Hewardt. There is also a book about native debugging from the same author.
• Debugging Microsoft.NET 2.0 Applications by John Robbins
• CLR via C # by Jeffrey Richter is a great introduction to CLR internals.

Blogs:

• The Tess Blog is great. It has many textbooks and laboratories that you can use for practice.
• Tom's blog is also very helpful.

Video:

• I made a presentation about guided debugging at the Microsoft development center in Denmark. Videos are available on channel p. Part 1 and part 2 .

Answer 2

Tess Ferrandez Blog is a fantastic resource for .NET WinDbg stuff:

If it's broken, fix it, you should

Although many of her articles focus on the IIS / ASP.NET workflow workflow, freeze and leak, most methods can be applied to all kinds of scripts.

Answer 3

Advanced Windows debugging will be a good start.

When Windbg joins a process, it inserts a thread that calls DbgBreakPoint. This is what you see. You can use ~ to view the current streams, and then ~ n to switch to another stream. k will give you a stack trace of the current thread, which should give you some idea of ​​the hang.

Answer 4

The int 3 (cc in binary) command is one of the ways that debuggers set breakpoints in an application. This command generates an interrupt that pauses program execution and gives the debugger the ability to respond to this interrupt. You just need to continue executing until you get to the place where your program hangs.