As soon as I had a problem when the application was like yours. This turned out to be an unpleasant buffer overflow in sprintf. Naturally, it worked at startup with a connected debugger. I installed an unhandled exception filter ( SetUnhandledExceptionFilter ), in which I simply blocked endlessly (using WaitForSingleObject on a dummy handle with a timeout value of INFINITE).
So you could be something like:
long __stdcall MyFilter (EXCEPTION_POINTERS *)
{
HANDLE hEvt = :: CreateEventW (0,1,0,0);
if (hEvt)
{
if (WAIT_FAILED == :: WaitForSingleObject (hEvt, INFINITE))
{
// log failure
}
}
}
// somewhere in your wmain / WinMain:
SetUnhandledExceptionFilter (MyFilter);
Then I applied the debugger after the error showed up (the gui program stopped responding).
Then you can take the dump and work with it later:
.dump / ma path_to_dump_file
Or debug it right now. The easiest way is to keep track of where the processor context was saved by the runtime exception handling mechanism:
sd esp range 1003f
The team will look for the address space of the stack for CONTEXT records (s) for the duration of the search. Usually I use something like 'l? 10000 ' . Please note: do not use non-standard large numbers as the entry that you usually find next to the raw exception filter frame. 1003f is a combination of flags (I believe that it matches CONTEXT_FULL) used to capture processor state. Your search will look something like this:
0: 000> sd esp l1000 1003f
0012c160 0001003f 000000000000000000000000? ................
Once you get the results back, use the address in the cxr command:
.cxr 0012c160
This will lead you to this new CONTEXT, exactly at the time of the crash (you will get exactly the stack trace during the crash of the application). Also use:
.exr -1
to find out exactly what exception occurred.
Hope this helps.
deemok Oct 09 '08 at 8:25 2008-10-09 08:25
source share