如何在 Windows 上以编程方式从转储文件中获取堆栈跟踪

Question

我想以编程方式从用户转储文件中检索堆栈跟踪。 在已知位置有这个用户转储，我想从中提取堆栈跟踪并将其放入纯文本文件中 - 有没有办法做到这一点？

注意：我可以手动完成 - 打开 Windbg 并输入“k”命令 - 但是 正如我之前提到的，我想以编程方式执行此操作。

谢谢

Answer 1

您应该检查 windbg sdk 子文件夹，其中包含有关 dbgeng.dll 如何使用的示例可以以编程方式使用。
代码示例：

 PSTR g_DumpFile;
 PSTR g_ImagePath;
 PSTR g_SymbolPath;

 ULONG64 g_TraceFrom[3];

 IDebugClient* g_Client;
 IDebugControl* g_Control;
 IDebugSymbols* g_Symbols;

  void CreateInterfaces(void)
  {
    HRESULT Status;

    // Start things off by getting an initial interface from
    // the engine.  This can be any engine interface but is
    // generally IDebugClient as the client interface is
    // where sessions are started.
    if ((Status = DebugCreate(__uuidof(IDebugClient),
                              (void**)&g_Client)) != S_OK)
    {
        Exit(1, "DebugCreate failed, 0x%X\n", Status);
    }

    // Query for some other interfaces that we'll need.
    if ((Status = g_Client->QueryInterface(__uuidof(IDebugControl),
                                           (void**)&g_Control)) != S_OK ||
        (Status = g_Client->QueryInterface(__uuidof(IDebugSymbols),
                                           (void**)&g_Symbols)) != S_OK)
    {
        Exit(1, "QueryInterface failed, 0x%X\n", Status);
    }
 }

 void
 DumpStack(void)
 {
    HRESULT Status;
    PDEBUG_STACK_FRAME Frames = NULL;
    int Count = 50;

    printf("\nFirst %d frames of the call stack:\n", Count);

    if (g_TraceFrom[0] || g_TraceFrom[1] || g_TraceFrom[2])
    {
        ULONG Filled;

        Frames = new DEBUG_STACK_FRAME[Count];
        if (Frames == NULL)
        {
            Exit(1, "Unable to allocate stack frames\n");
        }

        if ((Status = g_Control->
             GetStackTrace(g_TraceFrom[0], g_TraceFrom[1], g_TraceFrom[2],
                           Frames, Count, &Filled)) != S_OK)
        {
            Exit(1, "GetStackTrace failed, 0x%X\n", Status);
        }

        Count = Filled;
    }

    // Print the call stack.
    if ((Status = g_Control->
         OutputStackTrace(DEBUG_OUTCTL_ALL_CLIENTS, Frames,
                          Count, DEBUG_STACK_SOURCE_LINE |
                          DEBUG_STACK_FRAME_ADDRESSES |
                          DEBUG_STACK_COLUMN_NAMES |
                          DEBUG_STACK_FRAME_NUMBERS)) != S_OK)
    {
        Exit(1, "OutputStackTrace failed, 0x%X\n", Status);
    }

    delete[] Frames;
 }


 void __cdecl main(int Argc, __in_ecount(Argc) char** Argv)
 {
    CreateInterfaces();

    ParseCommandLine(Argc, Argv);

    ApplyCommandLineArguments();

    DumpStack();

    Exit(0, NULL);
 }

Answer 2

几年前，我在 DDJ 上写了一篇关于在 Windows 和 Unix/Linux 中转储 C/C++ 堆栈的文章。 它不使用 cordump，但会在发生内部错误或操作系统确定应用程序故障时将堆栈帧写入日志文件。

也许它对您有帮助：

请参阅http://www.ddj.com/architect/185300443