Junfeng Zhang's Windows Programming Notes

Win32, Fusion, CLR, .Net Framework, and others

Browse by Tags

Tagged Content List
  • Blog Post: Managed Watson Dump

    From .Net Framework 2.0, Dr. Watson is able to generate dump compatible with .Net framework. This means, dumps with heap data generated by Dr. Watson contains information about managed heap so they can be analyzed with sos.dll. Some update to Dr.Watson is necessary to make this happen. Dumps generated...
  • Blog Post: Inspect a 32 bit Process Dump Generated by a 64 bit Debugger

    64 bit Windows can run both 32 bit process and 64 bit process. For debugging though, you want to use 32 bit debugger to debug 32 bit process, and 64 bit debugger for 64 bit process. Otherwise it won’t be pretty. Occasionally, I receive a 32 bit process dump generated by a 64 bit debugger. When...
  • Blog Post: Event Handles “leak”

    On our stress run, we saw our process’ handle count steadily increases until certain point, then it stabilizes. However the number of handles is high. Most of those handles are Event handles. We are concerned about it. So we went off and did some investigation. Turns out the Event handles are coming...
  • Blog Post: Use !htrace to debug handle leak

    Windbg Debugger’s !htrace extension is very handy to debug handle leak. The process essentially boils down to the following simple steps: 1. Enable trace 2. Take a snapshot 3. Run scenario 4. Show the diff On step 4, !htrace will show all the extra opened handles after the last snapshot...
  • Blog Post: A case study of a NullReferenceException

    We are seeing a NullReferenceException in our stress program. The investigation process may be helpful to some folks. Thread 22 is showing a Watson dialog. This is a register corruption. 0:022> kp ChildEBP RetAddr 091bc9a0 76961220 ntdll!ZwWaitForSingleObject(void)+0x15 ...
  • Blog Post: Getting the right exception context from a memory dump

    When debug a memory dump, the dump may not in the right exception context when it is first loaded in the debugger. However, we can figure out the right context from the dump. Let's load the dump. c:\debuggers>cdb -z c:\temp\foo.dmp Symbol search path is: *** Invalid *** *****************...
  • Blog Post: Calculating the size of each GC generation

    Sos.dll does not have a command to tell the size of each GC generation. However, you can calculate the size based on the output of !eeheap -gc. For example, 0:000> !eeheap -gc Number of GC Heaps: 1 generation 0 starts at 0x1da6c430 generation 1 starts at 0x1da5c240 generation...
  • Blog Post: Figuring out object allocation graph from a managed memory dump

    when debugging a managed memory dump, we can use Sos.dll to inspect managed objects inside the dump. for example, we can do !dumpheap to list the managed objects in GC Heap, we can also use !gcroot to figure out the reference path to a particular object. However, if we want to understand the whole...
  • Blog Post: From Unhandled Exception to Debugger Attach

    I was always wondering what is happening between an application throws an unhandled exception, and a debugger attached to the process. Apparently the information is right under my nose, but I was blind. Windows Debugger's documentation about post-mortem debugging has all the details you want to know...
  • Blog Post: Mismatched PDBs --- Why?

    If you are developing software, most likely you have encountered the "mismatched pdbs" debugger error. It usually happens when you point the debugger to the wrong symbol path. But there are times you are confident that the symbols you point to are the correct symbols, and it left you wondering why...
  • Blog Post: MiniDumpAuxiliaryDlls and KnownManagedDebuggingDlls

    I accidentally stumble on these two registry keys. And the expert in Windows Debugger team answers my question. -----Original Message----- From: Subject: RE: managed minidump Auxiliary DLLs are loaded inside of MiniDumpWriteDump when it finds a registered auxiliary DLL for a module in the target...
  • Blog Post: Loading CLR DAC dll from a different path

    From .Net framework 2.0, CLR creates a debugger helper dll mscordacwks.dll. The dll is used by Windows Debugger to enumerate CLR data structures. Mscordacwks.dll is part of .Net framework redist. C:\Windows\Microsoft.NET\Framework\v2.0.50727>dir mscordacwks.dll Volume in drive C is Vista...
  • Blog Post: Finding Memory leaks

    MSDN and Microsoft support web site have some great information on how to find memory leaks, both for managed application and native applications. Unmanaged: How to use Umdh.exe to find memory leaks http://support.microsoft.com/kb/268343 Managed: Debugging Memory Problems http://msdn2.microsoft.com/en...
  • Blog Post: Unknown exception 0xe0434f4e

    If you attach windows debugger to a .Net framework application, occasionally you may see debug spew of unknown exception 0xe0434f4e. (cfc.1244): Unknown exception - code e0434f4e (first chance) 0xe0434f4e is defined as EXCEPTION_HIJACK. (Copied from Rotor 2.0 sources corexcep.h) #define EXCEPTION_HIJACK...
  • Blog Post: Break on exception in Windows Debugger

    In Windows Debugger, we can break on C++ exception by doing " sxe eh ". We can also break on CLR exception by doing " sxe clr ". But sometimes you may see the following debug spew: (94c.960): C++ EH exception - code e06d7363 (first chance) (94c.960): Unknown exception - code e0434352 (first chance...
  • Blog Post: Connect Kernel Debugger to a Virtual PC/Virtual Server virtual machine

    Virtual Machine completely changes how people test software (Well, definitely me.). Create a virtual machine, enable undo disk, install your changes, test it. Does not work? Throw away the undo disk, and you have a brand new machine to work with. For people working on drivers or critical system services...
  • Blog Post: Understand why your computer restarted unexpectedly

    Many people have experienced unexpected computer restarts. Unexpected restarts can be caused by bugs in Windows Kernel, bugs in critical Windows Services, bugs in drivers, among other things. When Windows experiences an unexpected restart request, it will create a mini dump capturing the minimum information...
Page 1 of 1 (17 items)