Advanced Debugging
About AdvDbg Consult Train Services Products Tools Community Contact  
欢迎光临 高端调试 登录 | 注册 | FAQ
 
  ACPI调试
Linux内核调试
Windows内核调试
 
  调试战役
调试原理
新工具观察
 
  Linux
Windows Vista
Windows
 
  Linux驱动
WDF
WDM
 
  PCI Express
PCI/PCI-X
USB
无线通信协议
 
  64位CPU
ARM
IA-32
  CPU Info Center
 
  ACPI标准
系统认证
Desktop
服务器
 
  Embedded Linux
嵌入式开发工具
VxWorks
WinCE
嵌入式Windows
 
  格蠹调试套件(GDK)
  格蠹学院
  小朱书店
  老雷的微博
  《软件调试》
  《格蠹汇编》
  《软件调试(第二版)》
沪ICP备11027180号-1

C/C++本地代码调试

帖子发起人: 星河   发起时间: 2013-05-23 21:19 下午   回复: 6

Print Search
帖子排序:    
   2013-05-23, 21:19 下午
star.river.lsh 离线,最后访问时间: 2013/5/23 13:15:26 星河

发帖数前200位
注册: 2013-05-23
发 贴: 5
崩溃到ntdll.dll的问题
Reply Quote
我在一个线程里调用了第三方提供的dll,当我的线程结束之后,就不会再取调用这个dll的任何接口,但是遇到一个奇怪的崩溃日志,日志里总会间断性的出现第三方的调用,不知道是我的程序那里的问题导致, 贴上来大家帮忙分析下:

Application:
千千静听(百度音乐版) 7.0.3 (Unicode) (Build 0521)

System:
Windows XP Professional Service Pack 3 (Build 2600)

Module:
C:\WINDOWS\system32\ntdll.dll

IE:
mshtml.dll:  6.0.2900.6380

Thread:
wWinMain

Exception:
Code:       Access Violation
Flags:      0x00000000
Address:    0x7c930a19
Operation:  Read
Address:    0x00000000

Context:
EAX:   0x00c9ebc0  EBX:   0x00c90000  ECX:   0x00000000
EDX:   0x00000000  ESI:   0x00c9ebb8  EDI:   0x00c9eb00
EBP:   0x0012e290  EIP:   0x7c930a19  ESP:   0x0012e284
SegCs: 0x0000001b  SegDs: 0x00000023  SegEs: 0x00000023
SegFs: 0x0000003b  SegGs: 0x00000000  SegSs: 0x00000023
EFLAGS:0x00010246


Load Modules:
0x00400000 - 0x006c3000:TTPlayer
0x7c920000 - 0x7c9b6000:ntdll
0x7c800000 - 0x7c91e000:kernel32
0x77180000 - 0x77283000:COMCTL32
0x77be0000 - 0x77c38000:msvcrt
0x77da0000 - 0x77e49000:ADVAPI32
0x77e50000 - 0x77ee3000:RPCRT4
0x77fc0000 - 0x77fd1000:Secur32
0x77ef0000 - 0x77f39000:GDI32
0x77d10000 - 0x77da0000:USER32
0x77f40000 - 0x77fb6000:SHLWAPI
0x76b10000 - 0x76b3a000:WINMM
0x76680000 - 0x76726000:WININET
0x765e0000 - 0x76673000:CRYPT32
0x76db0000 - 0x76dc2000:MSASN1
0x770f0000 - 0x7717b000:OLEAUT32
0x76990000 - 0x76ace000:ole32
0x76320000 - 0x76367000:comdlg32
0x7d590000 - 0x7dd84000:SHELL32
0x60000000 - 0x60078000:ttpcomm
0x76d30000 - 0x76d48000:iphlpapi
0x71a20000 - 0x71a37000:WS2_32
0x71a10000 - 0x71a18000:WS2HELP
0x762f0000 - 0x762f5000:MSIMG32
0x5adc0000 - 0x5adf7000:UxTheme
0x4ae90000 - 0x4b03b000:gdiplus
0x10000000 - 0x1001c000:bdaucommon
0x76bc0000 - 0x76bcb000:PSAPI
0x76c60000 - 0x76c88000:imagehlp
0x77bd0000 - 0x77bd8000:VERSION
0x73b40000 - 0x73b60000:MSVFW32
0x77bb0000 - 0x77bc5000:MSACM32
0x76300000 - 0x7631d000:IMM32
0x62c20000 - 0x62c29000:LPK
0x73fa0000 - 0x7400b000:USP10
0x67340000 - 0x6747e000:safemon
0x5fdd0000 - 0x5fe25000:NETAPI32
0x74680000 - 0x746cc000:MSCTF
0x73640000 - 0x7366e000:msctfime
0x6ff50000 - 0x70030000:ttpres
0x01170000 - 0x0118f000:netacc
0x78050000 - 0x780b9000:MSVCP100
0x78aa0000 - 0x78b5f000:MSVCR100
0x012a0000 - 0x012b0000:MLocalData
0x012c0000 - 0x012ef000:MNet
0x01440000 - 0x0173d000:SangforTcp
0x73d30000 - 0x73e22000:MFC42
0x7eae0000 - 0x7eb81000:urlmon
0x75ff0000 - 0x76055000:MSVCP60
0x61be0000 - 0x61bed000:MFC42LOC
0x719c0000 - 0x719fe000:mswsock
0x60fd0000 - 0x61025000:hnetcfg
0x71a00000 - 0x71a08000:wshtcpip
0x01380000 - 0x01395000:MUpDownload
0x013b0000 - 0x013c2000:MHttp
0x01a40000 - 0x01ba5000:SangforNsp
0x76fa0000 - 0x7701f000:CLBCATQ
0x77020000 - 0x770ba000:COMRes
0x76ef0000 - 0x76f17000:DNSAPI
0x76f80000 - 0x76f88000:winrnr
0x76f30000 - 0x76f5c000:WLDAP32
0x76f90000 - 0x76f96000:rasadhlp
0x71a40000 - 0x71a4b000:wsock32
0x68000000 - 0x68036000:rsaenh
0x73b30000 - 0x73b36000:DCIMAN32
0x01d40000 - 0x01d55000:md5extractor
0x02390000 - 0x024a8000:fp_extractor
0x76eb0000 - 0x76eec000:RASAPI32
0x76e60000 - 0x76e72000:rasman
0x76e80000 - 0x76eaf000:TAPI32
0x76e50000 - 0x76e5e000:rtutils
0x7e550000 - 0x7e6c3000:shdocvw
0x75430000 - 0x754a1000:CRYPTUI
0x76c00000 - 0x76c2e000:WINTRUST
0x77c40000 - 0x77c65000:msv1_0
0x76760000 - 0x7676c000:cryptdll
0x71800000 - 0x7187c000:shdoclc
0x02d70000 - 0x032b9000:xpsp2res
0x74cf0000 - 0x74d81000:mlang
0x72240000 - 0x72245000:sensapi
0x7e210000 - 0x7e50d000:mshtml
0x74620000 - 0x74647000:msls31
0x759d0000 - 0x75a7f000:USERENV
0x70e20000 - 0x70e33000:asycfilt
0x76cb0000 - 0x76cd0000:NTMARTA
0x71b70000 - 0x71b83000:SAMLIB
0x74650000 - 0x7467a000:msimtf
0x75bc0000 - 0x75c3d000:jscript
0x75e00000 - 0x75eae000:SXS
0x5dd50000 - 0x5de73000:msxml3
0x73620000 - 0x73627000:msdmo
0x73e70000 - 0x73ecc000:dsound
0x72c90000 - 0x72c99000:wdmaud
0x72c80000 - 0x72c88000:msacm32
0x77ba0000 - 0x77ba7000:midimap
0x73e40000 - 0x73e44000:KsUser
0x66b50000 - 0x66b5c000:ImgUtil
0x5e400000 - 0x5e40c000:pngfilt
0x09040000 - 0x09118000:vgx
0x76af0000 - 0x76b01000:ATL
0x09250000 - 0x0a26f000:Flash32_11_7_700_202
0x73aa0000 - 0x73ab5000:mscms
0x72f70000 - 0x72f96000:WINSPOOL
0x767c0000 - 0x767e9000:schannel
0x753b0000 - 0x75421000:mshtmled
0x68100000 - 0x68126000:dssenh
0x7cf70000 - 0x7d0d9000:quartz
0x07f80000 - 0x07fb7000:EmzMP3SourceFilter
0x67140000 - 0x67180000:iepeers
0x02500000 - 0x025c0000:CutAudio
0x07cd0000 - 0x07d20000:mp3PRO
0x60150000 - 0x6015d000:ttp_asf
0x036f0000 - 0x03737000:ttp_aac
0x03740000 - 0x03761000:ttp_ac3dts
0x11820000 - 0x118dc000:wmadmod
0x0bef0000 - 0x0bf27000:mfplat
0x60350000 - 0x6035c000:ttp_lrcsh
0x68d60000 - 0x68e01000:DBGHELP

Call Stack:
0x7C920000[10A19] ntdll.dll: wcsncpy[+49A](13173224,0,1237832,0)
0x7C920000[1084C] ntdll.dll: wcsncpy[+2CD](13172736,0,13233016,13232880)
0x60000000[10BC4] ttpcomm.dll: Ordinal103[+A364](13233016,123303952,0,123303348)
0x60000000[26EB2] ttpcomm.dll: Ordinal15[+84E2](123303348,123275312,1610735477,123275312)
0x60000000[26063] ttpcomm.dll: Ordinal15[+7693](123275312,123275312,17665080,5670916)
0x60000000[1DF75] ttpcomm.dll: Ordinal18[+15](123275312,17665080,5672195,17665080)
0x00400000[168804] TTPlayer.exe: CreateStreamOnInet[+5480](17665080,5670975,1,17441528)
0x00400000[168D03] TTPlayer.exe: CreateStreamOnInet[+597F](1,17441528,14405352,5496915)
0x00400000[16883F] TTPlayer.exe: CreateStreamOnInet[+54BB](17665080,0,1238076,6216837)
0x00400000[13E053] TTPlayer.exe: Cdllmd5extractor::operator=[+121ADA](17441528,5466926,17441528,1)
0x00400000[240C7] TTPlayer.exe: Cdllmd5extractor::operator=[+7B4E](17441528,1,0,14405264)
0x00400000[136B2E] TTPlayer.exe: Cdllmd5extractor::operator=[+11A5B5](14405264,14405264,5463388,1)
0x00400000[136A72] TTPlayer.exe: Cdllmd5extractor::operator=[+11A4F9](1,17276936,17319528,4994523)
0x00400000[135D5C] TTPlayer.exe: Cdllmd5extractor::operator=[+1197E3](1,17285384,17276936,17658156)
0x00400000[C35DB] TTPlayer.exe: Cdllmd5extractor::operator=[+A7062](17276936,1,15,1238240)
0x00400000[C303B] TTPlayer.exe: Cdllmd5extractor::operator=[+A6AC2](1,17276936,0,1)
0x00400000[CAD99] TTPlayer.exe: Cdllmd5extractor::operator=[+AE820](13,1,1239208,17276936)
0x00400000[BE755] TTPlayer.exe: Cdllmd5extractor::operator=[+A21DC](590178,2027,13,1)
0x00400000[EA6A] TTPlayer.exe: (17276936,2027,13,1)
0x77D10000[8734] USER32.dll: GetDC[+6D](1542544,590178,2027,13)
0x77D10000[8816] USER32.dll: GetDC[+14F](0,1542544,590178,2027)
0x77D10000[1A013] USER32.dll: IsWindowUnicode[+A1](1542544,590178,2027,13)
0x77D10000[1A039] USER32.dll: CallWindowProcW[+1B](1542544,590178,2027,13)
0x00400000[DDA2D] TTPlayer.exe: Cdllmd5extractor::operator=[+C14B4](2027,13,1,0)
0x00400000[E1A5A] TTPlayer.exe: Cdllmd5extractor::operator=[+C54E1](17318336,2027,13,1)
0x77D10000[8734] USER32.dll: GetDC[+6D](1623608,590178,2027,13)
0x77D10000[8816] USER32.dll: GetDC[+14F](0,0,0,1238736)
0x7C920000[100B8] ntdll.dll: RtlFreeHeap[+18B](0,1623608,590178,2027)
0x77D10000[18EA0] USER32.dll: DefWindowProcW[+180](9521192,2027,13,1)
0x77D10000[18EEC] USER32.dll: DefWindowProcW[+1CC](1238952,24,9521192,2027)
0x7C920000[E473] ntdll.dll: KiUserCallbackDispatcher[+13](2010296130,590178,2027,13)
0x77D10000[94BE] USER32.dll: GetWindowLongA[+61](590178,2027,13,1)
0x77D10000[1AF42] USER32.dll: GetDlgCtrlID[+27](9521192,2027,13,1)
0x77D10000[192E3] USER32.dll: SendMessageW[+49](590178,2027,13,1)
0x00400000[FAA13] TTPlayer.exe: Cdllmd5extractor::operator=[+DE49A](13,1,17276936,1)
0x00400000[D12CA] TTPlayer.exe: Cdllmd5extractor::operator=[+B4D51](17276936,1240072,17276936,0)
0x00400000[BEB89] TTPlayer.exe: Cdllmd5extractor::operator=[+A2610](590178,273,32006,0)
0x00400000[EA6A] TTPlayer.exe: (17276936,273,32006,0)
0x77D10000[8734] USER32.dll: GetDC[+6D](1542544,590178,273,32006)
0x77D10000[8816] USER32.dll: GetDC[+14F](0,1542544,590178,273)
0x77D10000[1A013] USER32.dll: IsWindowUnicode[+A1](1542544,590178,273,32006)
0x77D10000[1A039] USER32.dll: CallWindowProcW[+1B](1542544,590178,273,32006)
0x00400000[DDA2D] TTPlayer.exe: Cdllmd5extractor::operator=[+C14B4](273,32006,0,0)
0x00400000[E1A5A] TTPlayer.exe: Cdllmd5extractor::operator=[+C54E1](17318336,273,32006,0)
0x77D10000[8734] USER32.dll: GetDC[+6D](1623608,590178,273,32006)
0x77D10000[8816] USER32.dll: GetDC[+14F](0,1623608,590178,273)
0x77D10000[18EA0] USER32.dll: DefWindowProcW[+180](9521192,273,32006,0)
0x77D10000[18EEC] USER32.dll: DefWindowProcW[+1CC](1239852,24,9521192,273)
0x7C920000[E473] ntdll.dll: KiUserCallbackDispatcher[+13](2010300788,590178,273,32006)
0x77D10000[94BE] USER32.dll: GetWindowLongA[+61](9521192,273,32006,0)
 

IP 地址: 已记录   报告
   2013-05-24, 11:14 上午
star.river.lsh 离线,最后访问时间: 2013/5/23 13:15:26 星河

发帖数前200位
注册: 2013-05-23
发 贴: 5
Re: 崩溃到ntdll.dll的问题
Reply Quote
我比较疑惑的是,堆栈里来看 没有调用md5extractor相关的内容,为什么会总出现?求前辈们帮忙分析啊....

0x00400000[135D5C] TTPlayer.exe: Cdllmd5extractor::operator=[+1197E3](1,17285384,17276936,17658156)
0x00400000[C35DB] TTPlayer.exe: Cdllmd5extractor::operator=[+A7062](17276936,1,15,1238240)
0x00400000[C303B] TTPlayer.exe: Cdllmd5extractor::operator=[+A6AC2](1,17276936,0,1)
0x00400000[CAD99] TTPlayer.exe: Cdllmd5extractor::operator=[+AE820](13,1,1239208,17276936)
0x00400000[BE755] TTPlayer.exe: Cdllmd5extractor::operator=[+A21DC](590178,2027,13,1)

IP 地址: 已记录   报告
   2013-05-24, 14:07 下午
star.river.lsh 离线,最后访问时间: 2013/5/23 13:15:26 星河

发帖数前200位
注册: 2013-05-23
发 贴: 5
Re: 崩溃到ntdll.dll的问题
Reply Quote
在附上一个完整的dump日志: 不知道为何我的ttplayer.pdb总是加载不上,如何分析是从ttplayer模块的什么地方调到了ttpcom模块


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\develop\sorcecode\7.0.3\bin\TTPlayer.exe_dump_0524131621.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: D:\develop\sorcecode\7.0.3\bin
Executable search path is: D:\develop\sorcecode\7.0.3\bin
Windows XP Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Fri May 24 13:23:17.000 2013 (GMT+8)
System Uptime: not available
Process Uptime: 0 days 0:06:56.000
................................................................
...................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(1618.11ec): Access violation - code c0000005 (first/second chance not available)
eax=00e60000 ebx=09d880f8 ecx=00000007 edx=7c92e514 esi=09d880d0 edi=09d88128
eip=7c92e514 esp=0012d7f8 ebp=0012d808 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
ntdll+0xe514:
7c92e514 c3              ret
0:000> !anaylze -v
No export anaylze found
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for ttpcomm.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ttpcomm.dll - 
*** WARNING: Unable to verify timestamp for TTPlayer.exe
*** ERROR: Module load completed but symbols could not be loaded for TTPlayer.exe
*** WARNING: Unable to verify timestamp for user32.dll
*** ERROR: Module load completed but symbols could not be loaded for user32.dll
*** WARNING: Unable to verify timestamp for kernel32.dll
*** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
***** OS symbols are WRONG. Please fix symbols to do analysis.

Unable to load image C:\WINDOWS\system32\ieframe.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ieframe.dll
*** ERROR: Module load completed but symbols could not be loaded for ieframe.dll
Unable to load image C:\WINDOWS\system32\ole32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ole32.dll
*** ERROR: Module load completed but symbols could not be loaded for ole32.dll
*** WARNING: Unable to verify timestamp for mshtml.dll
*** ERROR: Module load completed but symbols could not be loaded for mshtml.dll
*** WARNING: Unable to verify timestamp for GdiPlus.dll
*** ERROR: Module load completed but symbols could not be loaded for GdiPlus.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for netacc.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for msvcr100.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MLocalData.dll - 
Unable to load image C:\WINDOWS\system32\mswsock.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mswsock.dll
*** ERROR: Module load completed but symbols could not be loaded for mswsock.dll
*** WARNING: Unable to verify timestamp for ws2_32.dll
*** ERROR: Module load completed but symbols could not be loaded for ws2_32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MNet.dll - 
*** WARNING: Unable to verify timestamp for wininet.dll
*** ERROR: Module load completed but symbols could not be loaded for wininet.dll
Unable to load image C:\WINDOWS\system32\rpcrt4.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rpcrt4.dll
*** ERROR: Module load completed but symbols could not be loaded for rpcrt4.dll
*** WARNING: Unable to verify timestamp for userenv.dll
*** ERROR: Module load completed but symbols could not be loaded for userenv.dll
*** WARNING: Unable to verify timestamp for wdmaud.drv
*** ERROR: Module load completed but symbols could not be loaded for wdmaud.drv
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
ntdll+10a19
7c930a19 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c930a19 (ntdll+0x00010a19)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000010
Attempt to read from address 00000010

PROCESS_NAME:  TTPlayer.exe

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: ttpcomm

FAULTING_MODULE: 7c920000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  519e1482

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000010

READ_ADDRESS:  00000010 

FOLLOWUP_IP: 
ttpcomm!Ordinal103+a364
60010bc4 e88a310000      call    ttpcomm!Ordinal103+0xd4f3 (60013d53)

FAULTING_THREAD:  000011ec

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

IP_ON_HEAP:  00ee0000

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 00ee0000 to 7c930a19

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e73c 00ee0000 0a5047e0 00000000 0012e820 ntdll+0x10a19
0012e74c 7c93084c 00ee0000 00000010 0012e804 0xee0000
0012e820 60010bc4 00ee0000 00000000 0a5047e8 ntdll+0x1084c
0012e85c 6002bbbb 0a5047e8 00000000 0a4eb960 ttpcomm!Ordinal103+0xa364
0012e8c8 004240c7 013ba7b8 00536ace 013ba7b8 ttpcomm!Ordinal19+0x466b
0012e8f8 00536a12 03fd8518 03fd8518 00535cfc TTPlayer+0x240c7
0012e958 004ca762 012f4150 00000001 012f4150 TTPlayer+0x136a12
0012ebc4 004be657 012f4150 04079f54 00000000 TTPlayer+0xca762
0012ebe0 0040ea6a 001104da 00000010 00000001 TTPlayer+0xbe657
0012ec2c 77d18734 012f4150 00000010 00000001 TTPlayer+0xea6a
0012ec58 77d18816 0016f120 001104da 00000010 user32+0x8734
0012ecc0 77d2a013 00000000 0016f120 001104da user32+0x8816
0012ecf0 77d2a039 0016f120 001104da 00000010 user32+0x1a013
0012ed10 004dd9cd 0016f120 001104da 00000010 user32+0x1a039
0012ed6c 77d18734 012fe308 00000010 00000001 TTPlayer+0xdd9cd
0012ed98 77d18816 00178948 001104da 00000010 user32+0x8734
0012ee00 77d189cd 00000000 00178948 001104da user32+0x8816
0012ee60 77d18a10 0012fe04 00000000 00000001 user32+0x89cd
0012ee70 0054731d 0012fe04 7c80934a 0012fe4c user32+0x8a10
0012ee74 0012fe04 7c80934a 0012fe4c 0065d378 TTPlayer+0x14731d
0012ee78 7c80934a 0012fe4c 0065d378 00000000 0x12fe04
0012fe04 00000000 00000001 00000000 00cd5b98 kernel32+0x934a


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ttpcomm!Ordinal103+a364

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ttpcomm.dll

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_ttpcomm.dll!Ordinal103

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/TTPlayer_exe/7_0_3_0/519ee4a5/ntdll_dll/5_1_2600_6055/4d00f280/c0000005/00010a19.htm?Retriage=1

Followup: MachineOwner
---------

0:000> .reload
................................................................
...................................................
Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
0:000> !anaylze -v
No export anaylze found
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for ttpcomm.dll
Unable to load image C:\Program Files\TTPlayer\TTPlayer.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for TTPlayer.exe
*** ERROR: Module load completed but symbols could not be loaded for TTPlayer.exe
*** WARNING: Unable to verify timestamp for user32.dll
*** ERROR: Module load completed but symbols could not be loaded for user32.dll
*** WARNING: Unable to verify timestamp for kernel32.dll
*** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
***** OS symbols are WRONG. Please fix symbols to do analysis.

Unable to load image C:\WINDOWS\system32\ieframe.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ieframe.dll
*** ERROR: Module load completed but symbols could not be loaded for ieframe.dll
Unable to load image C:\WINDOWS\system32\ole32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ole32.dll
*** ERROR: Module load completed but symbols could not be loaded for ole32.dll
*** WARNING: Unable to verify timestamp for mshtml.dll
*** ERROR: Module load completed but symbols could not be loaded for mshtml.dll
*** WARNING: Unable to verify timestamp for GdiPlus.dll
*** ERROR: Module load completed but symbols could not be loaded for GdiPlus.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for netacc.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for msvcr100.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MLocalData.dll - 
Unable to load image C:\WINDOWS\system32\mswsock.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mswsock.dll
*** ERROR: Module load completed but symbols could not be loaded for mswsock.dll
*** WARNING: Unable to verify timestamp for ws2_32.dll
*** ERROR: Module load completed but symbols could not be loaded for ws2_32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MNet.dll - 
*** WARNING: Unable to verify timestamp for wininet.dll
*** ERROR: Module load completed but symbols could not be loaded for wininet.dll
Unable to load image C:\WINDOWS\system32\rpcrt4.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rpcrt4.dll
*** ERROR: Module load completed but symbols could not be loaded for rpcrt4.dll
*** WARNING: Unable to verify timestamp for userenv.dll
*** ERROR: Module load completed but symbols could not be loaded for userenv.dll
*** WARNING: Unable to verify timestamp for wdmaud.drv
*** ERROR: Module load completed but symbols could not be loaded for wdmaud.drv
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
ntdll+10a19
7c930a19 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c930a19 (ntdll+0x00010a19)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000010
Attempt to read from address 00000010

PROCESS_NAME:  TTPlayer.exe

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: ttpcomm

FAULTING_MODULE: 7c920000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  519e1482

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000010

READ_ADDRESS:  00000010 

FOLLOWUP_IP: 
ttpcomm!MD5String+474 [d:\develop\sorcecode\7.0.3\ttpcomm\md5.cpp @ 350]
60010bc4 e88a310000      call    ttpcomm!filter10_std+0xb3 (60013d53)

FAULTING_THREAD:  000011ec

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

IP_ON_HEAP:  00ee0000

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 00ee0000 to 7c930a19

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e73c 00ee0000 0a5047e0 00000000 0012e820 ntdll+0x10a19
0012e74c 7c93084c 00ee0000 00000010 0012e804 0xee0000
0012e820 60010bc4 00ee0000 00000000 0a5047e8 ntdll+0x1084c
0012e85c 6002bbbb 0a5047e8 00000000 0a4eb960 ttpcomm!MD5String+0x474 [d:\develop\sorcecode\7.0.3\ttpcomm\md5.cpp @ 350]
0012e8c8 004240c7 013ba7b8 00536ace 013ba7b8 ttpcomm!math_dfst+0xf01 [d:\develop\sorcecode\7.0.3\ttpcomm\dsp\fftsg.c @ 592]
0012e8f8 00536a12 03fd8518 03fd8518 00535cfc TTPlayer+0x240c7
0012e958 004ca762 012f4150 00000001 012f4150 TTPlayer+0x136a12
0012ebc4 004be657 012f4150 04079f54 00000000 TTPlayer+0xca762
0012ebe0 0040ea6a 001104da 00000010 00000001 TTPlayer+0xbe657
0012ec2c 77d18734 012f4150 00000010 00000001 TTPlayer+0xea6a
0012ec58 77d18816 0016f120 001104da 00000010 user32+0x8734
0012ecc0 77d2a013 00000000 0016f120 001104da user32+0x8816
0012ecf0 77d2a039 0016f120 001104da 00000010 user32+0x1a013
0012ed10 004dd9cd 0016f120 001104da 00000010 user32+0x1a039
0012ed6c 77d18734 012fe308 00000010 00000001 TTPlayer+0xdd9cd
0012ed98 77d18816 00178948 001104da 00000010 user32+0x8734
0012ee00 77d189cd 00000000 00178948 001104da user32+0x8816
0012ee60 77d18a10 0012fe04 00000000 00000001 user32+0x89cd
0012ee70 0054731d 0012fe04 7c80934a 0012fe4c user32+0x8a10
0012ee74 0012fe04 7c80934a 0012fe4c 0065d378 TTPlayer+0x14731d
0012ee78 7c80934a 0012fe4c 0065d378 00000000 0x12fe04
0012fe04 00000000 00000001 00000000 00cd5b98 kernel32+0x934a


STACK_COMMAND:  ~0s; .ecxr ; kb

FAULTING_SOURCE_CODE:  
   346: {
   347: *pCh++ = s_chHexChars[(szDigstIdea [I] >> 4) & 0x0F];
   348: *pCh++ = s_chHexChars[szDigstIdea [I] & 0x0F];
   349: }
>  350: *pCh = '\0';
   351: return szDes;
   352: }



SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ttpcomm!MD5String+474

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ttpcomm.dll

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_ttpcomm.dll!MD5String

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/TTPlayer_exe/7_0_3_0/519ee4a5/ntdll_dll/5_1_2600_6055/4d00f280/c0000005/00010a19.htm?Retriage=1

Followup: MachineOwner
---------

0:000> .reload
................................................................
...................................................
Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for ttpcomm.dll
Unable to load image C:\Program Files\TTPlayer\TTPlayer.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for TTPlayer.exe
*** ERROR: Module load completed but symbols could not be loaded for TTPlayer.exe
*** WARNING: Unable to verify timestamp for user32.dll
*** ERROR: Module load completed but symbols could not be loaded for user32.dll
*** WARNING: Unable to verify timestamp for kernel32.dll
*** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
***** OS symbols are WRONG. Please fix symbols to do analysis.

Unable to load image C:\WINDOWS\system32\ieframe.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ieframe.dll
*** ERROR: Module load completed but symbols could not be loaded for ieframe.dll
Unable to load image C:\WINDOWS\system32\ole32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ole32.dll
*** ERROR: Module load completed but symbols could not be loaded for ole32.dll
*** WARNING: Unable to verify timestamp for mshtml.dll
*** ERROR: Module load completed but symbols could not be loaded for mshtml.dll
*** WARNING: Unable to verify timestamp for GdiPlus.dll
*** ERROR: Module load completed but symbols could not be loaded for GdiPlus.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for netacc.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for msvcr100.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MLocalData.dll - 
Unable to load image C:\WINDOWS\system32\mswsock.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mswsock.dll
*** ERROR: Module load completed but symbols could not be loaded for mswsock.dll
*** WARNING: Unable to verify timestamp for ws2_32.dll
*** ERROR: Module load completed but symbols could not be loaded for ws2_32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MNet.dll - 
*** WARNING: Unable to verify timestamp for wininet.dll
*** ERROR: Module load completed but symbols could not be loaded for wininet.dll
Unable to load image C:\WINDOWS\system32\rpcrt4.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rpcrt4.dll
*** ERROR: Module load completed but symbols could not be loaded for rpcrt4.dll
*** WARNING: Unable to verify timestamp for userenv.dll
*** ERROR: Module load completed but symbols could not be loaded for userenv.dll
*** WARNING: Unable to verify timestamp for wdmaud.drv
*** ERROR: Module load completed but symbols could not be loaded for wdmaud.drv
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
ntdll+10a19
7c930a19 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c930a19 (ntdll+0x00010a19)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000010
Attempt to read from address 00000010

PROCESS_NAME:  TTPlayer.exe

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: ttpcomm

FAULTING_MODULE: 7c920000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  519e1482

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000010

READ_ADDRESS:  00000010 

FOLLOWUP_IP: 
ttpcomm!MD5String+474 [d:\develop\sorcecode\7.0.3\ttpcomm\md5.cpp @ 350]
60010bc4 e88a310000      call    ttpcomm!filter10_std+0xb3 (60013d53)

FAULTING_THREAD:  000011ec

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

IP_ON_HEAP:  00ee0000

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 00ee0000 to 7c930a19

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e73c 00ee0000 0a5047e0 00000000 0012e820 ntdll+0x10a19
0012e74c 7c93084c 00ee0000 00000010 0012e804 0xee0000
0012e820 60010bc4 00ee0000 00000000 0a5047e8 ntdll+0x1084c
0012e85c 6002bbbb 0a5047e8 00000000 0a4eb960 ttpcomm!MD5String+0x474 [d:\develop\sorcecode\7.0.3\ttpcomm\md5.cpp @ 350]
0012e8c8 004240c7 013ba7b8 00536ace 013ba7b8 ttpcomm!math_dfst+0xf01 [d:\develop\sorcecode\7.0.3\ttpcomm\dsp\fftsg.c @ 592]
0012e8f8 00536a12 03fd8518 03fd8518 00535cfc TTPlayer+0x240c7
0012e958 004ca762 012f4150 00000001 012f4150 TTPlayer+0x136a12
0012ebc4 004be657 012f4150 04079f54 00000000 TTPlayer+0xca762
0012ebe0 0040ea6a 001104da 00000010 00000001 TTPlayer+0xbe657
0012ec2c 77d18734 012f4150 00000010 00000001 TTPlayer+0xea6a
0012ec58 77d18816 0016f120 001104da 00000010 user32+0x8734
0012ecc0 77d2a013 00000000 0016f120 001104da user32+0x8816
0012ecf0 77d2a039 0016f120 001104da 00000010 user32+0x1a013
0012ed10 004dd9cd 0016f120 001104da 00000010 user32+0x1a039
0012ed6c 77d18734 012fe308 00000010 00000001 TTPlayer+0xdd9cd
0012ed98 77d18816 00178948 001104da 00000010 user32+0x8734
0012ee00 77d189cd 00000000 00178948 001104da user32+0x8816
0012ee60 77d18a10 0012fe04 00000000 00000001 user32+0x89cd
0012ee70 0054731d 0012fe04 7c80934a 0012fe4c user32+0x8a10
0012ee74 0012fe04 7c80934a 0012fe4c 0065d378 TTPlayer+0x14731d
0012ee78 7c80934a 0012fe4c 0065d378 00000000 0x12fe04
0012fe04 00000000 00000001 00000000 00cd5b98 kernel32+0x934a


STACK_COMMAND:  ~0s; .ecxr ; kb

FAULTING_SOURCE_CODE:  
   346: {
   347: *pCh++ = s_chHexChars[(szDigstIdea [I] >> 4) & 0x0F];
   348: *pCh++ = s_chHexChars[szDigstIdea [I] & 0x0F];
   349: }
>  350: *pCh = '\0';
   351: return szDes;
   352: }



SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ttpcomm!MD5String+474

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ttpcomm.dll

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_ttpcomm.dll!MD5String

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/TTPlayer_exe/7_0_3_0/519ee4a5/ntdll_dll/5_1_2600_6055/4d00f280/c0000005/00010a19.htm?Retriage=1

Followup: MachineOwner
---------

0:000> g
       ^ No runnable debuggees error in 'g'
0:000> .reload
................................................................
...................................................
Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
0:000> .reload /f @"C:\Program Files\TTPlayer\TTPlayer.exe"
Unable to load image C:\Program Files\TTPlayer\TTPlayer.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for TTPlayer.exe
*** ERROR: Module load completed but symbols could not be loaded for TTPlayer.exe


IP 地址: 已记录   报告
   2013-05-24, 14:13 下午
star.river.lsh 离线,最后访问时间: 2013/5/23 13:15:26 星河

发帖数前200位
注册: 2013-05-23
发 贴: 5
Re: 崩溃到ntdll.dll的问题
Reply Quote
看到张老师说用.ecxr可以查看当时的上下文,可是 我打出来怎么是这样的,如何分析呢?
0:000> .ecxr
eax=0a509fe8 ebx=00ee0000 ecx=00000010 edx=00ee0198 esi=0a509fe0 edi=0a5047e0
eip=7c930a19 esp=0012e740 ebp=0012e74c iopl=0         nv up ei ng nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210283
ntdll+0x10a19:
7c930a19 ??              ???

IP 地址: 已记录   报告
   2013-05-26, 20:07 下午
Raymond 离线,最后访问时间: 2020/7/3 3:40:25 格蠹老雷

发帖数前10位
注册: 2005-12-19
发 贴: 1,303
Re: 崩溃到ntdll.dll的问题
Reply Quote

比较典型的无效指针(非法内存访问),建议先解决符号问题,Google或者参考《软件调试》中关于符号文件的部分...


IP 地址: 已记录   报告
   2013-05-27, 11:22 上午
star.river.lsh 离线,最后访问时间: 2013/5/23 13:15:26 星河

发帖数前200位
注册: 2013-05-23
发 贴: 5
Re: 崩溃到ntdll.dll的问题
Reply Quote

多谢老师回复,正在努力复现dump加载正确的符号文件


IP 地址: 已记录   报告
   2013-05-30, 10:09 上午
frankiewang008 离线,最后访问时间: 2013/5/30 2:05:09 frankiewang008

发帖数前200位
注册: 2013-05-30
发 贴: 6
Re: 崩溃到ntdll.dll的问题
Reply Quote
已经显示报错的代码行了,就好办啦~~~内存越界
IP 地址: 已记录   报告
高端调试 » 软件调试 » C/C++本地代码调试 » Re: 崩溃到ntdll.dll的问题

 
Legal Notice Privacy Statement Corporate Governance Corporate Governance
(C)2004-2020 ADVDBG.ORG All Rights Reserved.