如何使用WinDbg从挂起的进程中调试小型转储

时间:2019-06-19 12:04:01

标签: debugging windbg

我正在尝试使用WinDbg从挂起的进程中调试dmp文件。

在退出之前,该过程处于一种完成状态。

我看到所有线程都在等待...

0:000> ~*
.  0  Id: 2c30.1420 Suspend: 0 Teb: 00007ff7`31c6e000 Unfrozen
      Start: HungProgram!mainCRTStartup (00007ff7`31f3ffd0)
      Priority: 0  Priority class: 32  Affinity: 3
   1  Id: 2c30.a74 Suspend: 0 Teb: 00007ff7`31c6a000 Unfrozen
      Start: ucrtbased!thread_start (00007ffb`39ec9f90)
      Priority: 0  Priority class: 32  Affinity: 3
   2  Id: 2c30.3910 Suspend: 0 Teb: 00007ff7`31c68000 Unfrozen
      Start: ntdll!TppWorkerThread (00007ffb`5ef89110)
      Priority: 0  Priority class: 32  Affinity: 3
      ...
  16  Id: 2c30.25f0 Suspend: 0 Teb: 00007ff7`31b18000 Unfrozen
      Start: mswsock!SockAsyncThread (00007ffb`5b1df990)
      Priority: 1  Priority class: 32  Affinity: 3
      ...

而且我看不到任何更多的堆栈跟踪信息。...

0:000> ~* kb

.  0  Id: 2c30.1420 Suspend: 0 Teb: 00007ff7`31c6e000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   1  Id: 2c30.a74 Suspend: 0 Teb: 00007ff7`31c6a000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForMultipleObjects+0xa

   2  Id: 2c30.3910 Suspend: 0 Teb: 00007ff7`31c68000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   3  Id: 2c30.29f8 Suspend: 0 Teb: 00007ff7`31c66000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   4  Id: 2c30.1fa0 Suspend: 0 Teb: 00007ff7`31b3e000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   5  Id: 2c30.10d4 Suspend: 0 Teb: 00007ff7`31b3c000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   6  Id: 2c30.1f70 Suspend: 0 Teb: 00007ff7`31b32000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   7  Id: 2c30.2b90 Suspend: 0 Teb: 00007ff7`31b30000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   8  Id: 2c30.2c9c Suspend: 0 Teb: 00007ff7`31b2e000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

   9  Id: 2c30.3984 Suspend: 0 Teb: 00007ff7`31b2c000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  10  Id: 2c30.2d40 Suspend: 0 Teb: 00007ff7`31b2a000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  11  Id: 2c30.2db4 Suspend: 0 Teb: 00007ff7`31b24000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  12  Id: 2c30.2794 Suspend: 0 Teb: 00007ff7`31b22000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  13  Id: 2c30.1fc4 Suspend: 0 Teb: 00007ff7`31b20000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  14  Id: 2c30.3b98 Suspend: 0 Teb: 00007ff7`31b1e000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  15  Id: 2c30.3284 Suspend: 0 Teb: 00007ff7`31b1c000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  16  Id: 2c30.25f0 Suspend: 0 Teb: 00007ff7`31b18000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForAlertByThreadId+0xa

  17  Id: 2c30.10f0 Suspend: 0 Teb: 00007ff7`31b16000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  18  Id: 2c30.1560 Suspend: 0 Teb: 00007ff7`31b14000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  19  Id: 2c30.2fd4 Suspend: 0 Teb: 00007ff7`31b12000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  20  Id: 2c30.1740 Suspend: 0 Teb: 00007ff7`31b10000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  21  Id: 2c30.16d8 Suspend: 0 Teb: 00007ff7`31b0e000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  22  Id: 2c30.18e0 Suspend: 0 Teb: 00007ff7`31b0c000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  23  Id: 2c30.33cc Suspend: 0 Teb: 00007ff7`31b0a000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  24  Id: 2c30.1bf4 Suspend: 0 Teb: 00007ff7`31b08000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  25  Id: 2c30.1de8 Suspend: 0 Teb: 00007ff7`31b06000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

  26  Id: 2c30.33e8 Suspend: 0 Teb: 00007ff7`31b04000 Unfrozen
 # RetAddr           : Args to Child                                                           : Call Site
00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForSingleObject+0xa

是否有机会知道程序中的哪个“组件”产生了这些线程并且没有终止它们?

或有任何进一步研究的建议?

0 个答案:

没有答案