当前位置： 文江博客话题详情

什么是“Break指令异常”？在WinDbg中？

发布于 2024-09-10 21:30:26 字数 8673 浏览 9 评论 0原文

我正在调试一些随机崩溃错误，但实际上很难深入研究。因为当我打开故障转储时，只发现一个错误：

0:000> .exr -1
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

实际上我没有在代码中设置任何硬代码断点，所以我在google上搜索了这个异常，有人说这个异常可能是由堆损坏引起的。 所以我的问题是， 除了硬编码断点、调试时手动断点、堆损坏之外，是否还有其他原因导致此异常？

另一个问题是，我尝试使用应用程序验证程序来检查堆损坏，我了解它是如何工作的，应用程序验证程序将在堆损坏时触发中断指令异常。但目前，我在没有应用程序验证程序的情况下运行，谁会引发中断指令异常？

附加信息：当前线程的调用堆栈。

*0:000> k
ChildEBP RetAddr  
0012f96c 7c827d19 ntdll!KiFastSystemCallRet
0012f970 77e6202c ntdll!NtWaitForMultipleObjects+0xc
0012fa18 7739bbd1 kernel32!WaitForMultipleObjectsEx+0x11a
0012fa74 3b288523 user32!RealMsgWaitForMultipleObjectsEx+0x141
0012fab8 3b32b9bd msenv!EnvironmentMsgLoop+0x1ea
0012fae4 3b32b94d msenv!CMsoCMHandler::FPushMessageLoop+0x86
0012fb0c 3b32b8e9 msenv!SCM::FPushMessageLoop+0xb7
0012fb28 3b32b8b8 msenv!SCM_MsoCompMgr::FPushMessageLoop+0x28
0012fb48 3b32be4e msenv!CMsoComponent::PushMsgLoop+0x28
0012fbe0 3b327561 msenv!VStudioMainLogged+0x482
0012fc0c 3000a4a6 msenv!VStudioMain+0xc1
0012fc38 30007301 devenv!util_CallVsMain+0xff
0012ff14 3000760c devenv!CDevEnvAppId::Run+0x91f
0012ff30 30007680 devenv!WinMain+0x74
0012ffc0 77e6f23b devenv!License::GetPID+0x258
0012fff0 00000000 kernel32!BaseProcessStart+0x23*

我们的应用程序是 Visual Studio 包。

在托管堆栈中的结果

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
+0
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00001f1c

DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

PROCESS_NAME:  devenv.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK: 
SP       IP       Function
    0012E584 09C8A903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure(Int32, Int32[])+0x3b
    0012E590 09C8C604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged(UInt32, System.Object, System.Object)+0x144

StackTraceString: <none>
HResult: 80004005

EXCEPTION_OBJECT: !pe 3115d464
Exception object: 3115d464
Exception type: System.Runtime.InteropServices.COMException
Message: Error HRESULT E_FAIL has been returned from a call to a COM component.
InnerException: <none>
StackTrace (generated):
    SP       IP       Function
    0012E584 09C8A903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure(Int32, Int32[])+0x3b
    0012E590 09C8C604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged(UInt32, System.Object, System.Object)+0x144

StackTraceString: <none>
HResult: 80004005

MANAGED_OBJECT: !dumpobj 3201988
Name: System.String
MethodTable: 79330a00
EEClass: 790ed64c
Size: 158(0x9e) bytes
 (C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)
String: Error HRESULT E_FAIL has been returned from a call to a COM component.
Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name
79332c4c  4000096        4         System.Int32  1 instance       71 m_arrayLength
79332c4c  4000097        8         System.Int32  1 instance       70 m_stringLength
793316e0  4000098        c          System.Char  1 instance       45 m_firstChar
79330a00  4000099       10        System.String  0   shared   static Empty
    >> Domain:Value  00219c28:03031198 <<
79331630  400009a       14        System.Char[]  0   shared   static WhitespaceChars
    >> Domain:Value  00219c28:03031798 <<

EXCEPTION_MESSAGE:  Error HRESULT E_FAIL has been returned from a call to a COM component.

MANAGED_OBJECT_NAME:  System.Runtime.InteropServices.COMException

LAST_CONTROL_TRANSFER:  from 7c827d19 to 7c82860c

PRIMARY_PROBLEM_CLASS:  STATUS_BREAKPOINT

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

STACK_TEXT:  
09c8a903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure
09c8c604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged


STACK_COMMAND:  dds 12e584 ; kb

FOLLOWUP_IP: 
+9c8a903
09c8a903 8bc6            mov     eax,esi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure+9c8a903

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Microsoft_VisualStudio_Design

IMAGE_NAME:  Microsoft.VisualStudio.Design.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_Microsoft.VisualStudio.Design.dll!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure

BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure+9c8a903

Followup: MachineOwner

下面是 !analyze -v ...

，有一个明确的错误，Microsoft.VisualStudio.NativeMethods.ThrowOnFailure.. 但这是否意味着com异常会导致break指令异常？

!analyze 似乎只是转储托管级别，com 异常可能是托管级别中的最后一个错误。

我还从google上搜索了一些关于中断和异常的内容，通常情况下，break指令异常可以在以下情况下触发： 1. 硬编码中断请求，如：__asm int 3 (ASM)、System.Diagnostics.Debugger.Break (C#)、DebugBreak() (WinAPI)。 2. OS启用内存运行时检查，例如Application Verifier可以在堆损坏、内存溢出后触发。 3. 编译器可以进行一些配置，以启用未初始化的内存块和函数结束（空白区域，重新启动后..）应填充的内容。例如，Microsoft VC 编译器如果启用/GZ 则可以填充0xCC。 0xCC实际上是__asm int 3的操作码。因此，如果某些错误导致应用程序运行到这样的块，将触发断点。

正确的？

如果是这样，我认为应用程序验证器应该是找到根本原因的最佳选择。

原文

I'm debugging some random crash bugs, but actually very difficult to go deep into. Because when i open crash dump, only find one error:

0:000> .exr -1
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

Actually i haven't set any hard-code breakpoint in code, so i search about this exception in google, some people said this exception may be caused by heap corruption.
So my question is,
Is there any other reason why cause this exception, except hard-code breakpoint, manual breakpoint while debugging, heap corruption?

Another question is, i try to use Application Verifier to check heap corruption, i understand how does it work, app verifier will trigger break instruction exception while heap corruption. But currently, i run without app verifier, who will raise the break instruction exception?

Additional info: call stack for current thread.

*0:000> k
ChildEBP RetAddr  
0012f96c 7c827d19 ntdll!KiFastSystemCallRet
0012f970 77e6202c ntdll!NtWaitForMultipleObjects+0xc
0012fa18 7739bbd1 kernel32!WaitForMultipleObjectsEx+0x11a
0012fa74 3b288523 user32!RealMsgWaitForMultipleObjectsEx+0x141
0012fab8 3b32b9bd msenv!EnvironmentMsgLoop+0x1ea
0012fae4 3b32b94d msenv!CMsoCMHandler::FPushMessageLoop+0x86
0012fb0c 3b32b8e9 msenv!SCM::FPushMessageLoop+0xb7
0012fb28 3b32b8b8 msenv!SCM_MsoCompMgr::FPushMessageLoop+0x28
0012fb48 3b32be4e msenv!CMsoComponent::PushMsgLoop+0x28
0012fbe0 3b327561 msenv!VStudioMainLogged+0x482
0012fc0c 3000a4a6 msenv!VStudioMain+0xc1
0012fc38 30007301 devenv!util_CallVsMain+0xff
0012ff14 3000760c devenv!CDevEnvAppId::Run+0x91f
0012ff30 30007680 devenv!WinMain+0x74
0012ffc0 77e6f23b devenv!License::GetPID+0x258
0012fff0 00000000 kernel32!BaseProcessStart+0x23*

Our application is a Visual Studio Package.

Below is the result from !analyze -v

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
+0
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00001f1c

DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

PROCESS_NAME:  devenv.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK: 
SP       IP       Function
    0012E584 09C8A903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure(Int32, Int32[])+0x3b
    0012E590 09C8C604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged(UInt32, System.Object, System.Object)+0x144

StackTraceString: <none>
HResult: 80004005

EXCEPTION_OBJECT: !pe 3115d464
Exception object: 3115d464
Exception type: System.Runtime.InteropServices.COMException
Message: Error HRESULT E_FAIL has been returned from a call to a COM component.
InnerException: <none>
StackTrace (generated):
    SP       IP       Function
    0012E584 09C8A903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure(Int32, Int32[])+0x3b
    0012E590 09C8C604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged(UInt32, System.Object, System.Object)+0x144

StackTraceString: <none>
HResult: 80004005

MANAGED_OBJECT: !dumpobj 3201988
Name: System.String
MethodTable: 79330a00
EEClass: 790ed64c
Size: 158(0x9e) bytes
 (C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)
String: Error HRESULT E_FAIL has been returned from a call to a COM component.
Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name
79332c4c  4000096        4         System.Int32  1 instance       71 m_arrayLength
79332c4c  4000097        8         System.Int32  1 instance       70 m_stringLength
793316e0  4000098        c          System.Char  1 instance       45 m_firstChar
79330a00  4000099       10        System.String  0   shared   static Empty
    >> Domain:Value  00219c28:03031198 <<
79331630  400009a       14        System.Char[]  0   shared   static WhitespaceChars
    >> Domain:Value  00219c28:03031798 <<

EXCEPTION_MESSAGE:  Error HRESULT E_FAIL has been returned from a call to a COM component.

MANAGED_OBJECT_NAME:  System.Runtime.InteropServices.COMException

LAST_CONTROL_TRANSFER:  from 7c827d19 to 7c82860c

PRIMARY_PROBLEM_CLASS:  STATUS_BREAKPOINT

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

STACK_TEXT:  
09c8a903 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure
09c8c604 Microsoft_VisualStudio_Design!Microsoft.VisualStudio.Design.VSDesignSurfaceManager.Microsoft.VisualStudio.Shell.Interop.IVsSelectionEvents.OnElementValueChanged


STACK_COMMAND:  dds 12e584 ; kb

FOLLOWUP_IP: 
+9c8a903
09c8a903 8bc6            mov     eax,esi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure+9c8a903

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Microsoft_VisualStudio_Design

IMAGE_NAME:  Microsoft.VisualStudio.Design.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_Microsoft.VisualStudio.Design.dll!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure

BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_Microsoft_VisualStudio_Design!Microsoft.VisualStudio.NativeMethods.ThrowOnFailure+9c8a903

Followup: MachineOwner

...

In the managed stack, there is a explicit error,Microsoft.VisualStudio.NativeMethods.ThrowOnFailure..
But that means the com exception cause the break instruction exception?

!analyze seems just dump the managed level, the com exception maybe the last error in the managed level.

I also search something about interrupt and exception from google, Normally, the break instruction exception can be triggered in following conditions:
1. Hardcode interrupt request, like: __asm int 3 (ASM), System.Diagnostics.Debugger.Break (C#), DebugBreak() (WinAPI).
2. OS enable memory runtime check, like Application Verifier can trigger after heap corruption, memory overrun.
3. Compiler can have some configuration to enble what should be filled for the uninitialized memory block and end of function(blank area, after retun..). For example, Microsoft VC complier can fill 0xCC if enable /GZ. 0xCC is actually a opcode of __asm int 3. So if some error cause the application run into such block, will trigger a break point.

Correct?

If that, I think Application Verifier should be best choice to find the root cause.

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论， 你可以免费 注册 一个本站的账号。

评论（2）

〃安静 2024-09-17 21:30:26

为了便于将来参考，由于您需要将 Windows 符号添加到 Windbg 符号路径，因此会出现 您的调试器未使用正确的符号 警告。以下是如何做到这一点：

自动设置 Microsoft 符号服务器路径：

0:000> .symfix

您可以选择指定从中下载符号的其他位置，例如：

0:000> .sympath+ c:\myproject

检查当前符号搜索路径：

0:000> .sympath

您应该看到类似这样的内容：

SRV**http://msdl.microsoft.com/download/symbols

重新加载符号：

0:000> .reload

然后，您将能够使用此命令查看有关当前异常的信息：

0:000> !analyze -v

您应该看到类似于以下内容的行：

ExceptionCode: c0000005 (Access violation)

祝你好运修复错误！

For future reference, the Your debugger is not using the correct symbols warning is caused because you need to add Windows symbols to the Windbg symbols path. Here is how to do that:

Set Microsoft symbol server path automatically:

0:000> .symfix

Optionally you can specify an additional location where to download symbol from, e.g.:

0:000> .sympath+ c:\myproject

Check current symbol search path:

0:000> .sympath

You should see something like this:

SRV**http://msdl.microsoft.com/download/symbols

Reload symbols:

0:000> .reload

Then, you will be able to see information about the current exception using this command:

0:000> !analyze -v

You should see a line similar to the following:

ExceptionCode: c0000005 (Access violation)

Good luck fixing bugs!

回复 原文
本宫微胖 2024-09-17 21:30:26

用于查找导致故障转储的异常的命令是.ecxr。您从 .exr -1 获得的输出不正确，因为 ExceptionAddress 为零。

The command to use to find the exception that caused the crash dump is .ecxr. The outpt you got from .exr -1 is incorrect as the ExceptionAddress is zero.

回复 原文
~没有更多了~

关于作者

半透明的墙

暂无简介

文章
评论
25 人气
发私信

相关话题

更多

热门标签

操作系统 程序设计 IT运维 Linux系统管理 JavaScript 服务器应用 solaris C/C++ PHP Shell BSD Vue.js aix Oracle Python HTML 系统管理 HTML5 CSS 前端
更多

推荐作者

一桥轻雨一伞开

文章 0 评论 0

冷血

文章 0 评论 0

隔岸观火

文章 0 评论 0

昔梦

文章 0 评论 0

最终幸福

文章 0 评论 0

世界等同你

文章 0 评论 0

更多

友情链接

文江博客
    我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
    原文