tailieunhanh - Memory Dump Analysis Anthology- P12

Memory Dump Analysis Anthology- P12: This is a revised, edited, cross-referenced and thematically organized volume of selected blog posts about crash dump analysis and debugging written in 2006 - 2007 for software engineers developing and maintaining products on Windows platforms, technical support and escalation engineers dealing with complex software issues and general Windows users. | Managed Code Exception 331 MANAGED CODE EXCEPTION .NET programs also crash either from defects in .NET runtime Common Language Runtime CLR or from non-handled runtime exceptions in managed code executed by .NET virtual machine. The latter exceptions are re-thrown from .NET runtime to be handled by operating system and intercepted by native debuggers. Therefore our next crash dump analysis pattern is called Managed Code Exception. When we get a crash dump from .NET application it is the dump from a native process. analyze -v output can usually tell us that exception is actually CLR exception and give us other hints to look at managed code stack CLR stack FAULTING_IP kernel32 RaiseException 53 77e4bee7 5e pop esi EXCEPTION-RECORD ffffffff -- .exr Oxffffffffffffffff ExceptionAddress 77e4bee7 kernel32 RaiseException 0x00000053 ExceptionCode e0434f4d CLR exception ExceptionFlags 00000001 NumberParameters 1 Parameter 0 80131604 DEFAULT_BUCKET_ID CLR_EXCEPTION PROCESSNAME ERROR-CODE NTSTATUS 0xe0434f4d - Unable to get error code text MANAGED-STACK dumpstack -EE No export dumpstack found STACK-TEXT 05faf3d8 79197065 e0434f4d 00000001 00000001 kernel32 RaiseException 0x53 WARNING Stack unwind information not available. Following frames may be wrong. 05faf438 7a0945a4 023f31e0 00000000 00000000 mscorwks DllCanUnloadNowInternal 0 37a9 05faf4fc 00f2f00a 02066be4 02085ee8 023d0df0 mscorwks CorLaunchApplication 0 12005 05faf500 02066be4 02085ee8 023d0df0 023d0e2c 0xf2f00a 05faf504 02085ee8 023d0df0 023d0e2c 05e00dfa 0 2066be4 05faf508 023d0df0 023d0e2c 05e00dfa 023d0e10 0 2085ee8 05faf50c 023d0e2c 05e00dfa 023d0e10 05351d30 0 23d0df0 05faf510 05e00dfa 023d0e10 05351d30 023d0e10 0 23d0e2c Please purchase PDF Split-Merge on to remove this watermark 332 PART 3 Crash Dump Analysis Patterns FOLLOWUP_IP mscorwks DllCanUnloadNowInternal 37a9 79f97065 c745fcfeffffff mov dword ptr ebp-4 0FFFFFFFEh SYMBOL_NAME mscorwks DllCanUnloadNowInternal 37a9 MODULE_NAME .