陷入崩溃转储分析 - user32！NtUserSetFocus冻结app？

时间：2015-07-28 13:39:36

标签： windbg postmortem-debugging

我们有一个旧的VB6应用程序，可以保持冻结和/或崩溃。我们设置了一个简单的快捷方式，供用户在程序冻结时创建完整转储。

我们现在有一个星期的转储，其中大多数显示来自挂起线程的神秘堆栈，它甚至不包含我们的任何函数，最后一个调用是user32！NtUserSetFocus。

我们真的被困在这里......任何人都可以帮忙吗？

0:000> kb
ChildEBP RetAddr  Args to Child              
0018d788 755eee3e 002609ac 00000001 755eed34 user32!NtUserSetFocus+0x15
0018d7a0 755962fa 00260f22 00000110 002609ac user32!MB_DlgProc+0x10a
0018d7cc 755bf9df 755eed34 00260f22 00000110 user32!InternalCallWinProc+0x23
0018d848 755bf784 00000000 755eed34 00260f22 user32!UserCallDlgProcCheckWow+0xd7
0018d898 755bf889 0160cf70 00000000 00000110 user32!DefDlgProcWorker+0xb7
0018d8b8 755962fa 00260f22 00000110 002609ac user32!DefDlgProcW+0x29
0018d8e4 75596d3a 755bf860 00260f22 00000110 user32!InternalCallWinProc+0x23
0018d95c 7559965e 00000000 76ee3d54 00260f22 user32!UserCallWinProcCheckWow+0x109
0018d9a0 755c206f 0160cf70 00000000 76ee3d54 user32!SendMessageWorker+0x581
0018da74 755bcf4b 75580000 00000008 00000000 user32!InternalCreateDialog+0xb9f
0018daac 755ef73c 75580000 1736f6a8 0010193a user32!InternalDialogBox+0xc1
0018db60 755efa18 00000030 ffffffff ffff0000 user32!SoftModalMessageBox+0x757
0018dcb8 755efc65 0018dcd0 00000000 755efbd1 user32!MessageBoxWorker+0x269
0018dd38 729af829 0018dd50 0010193a 0010193a user32!MessageBoxIndirectA+0x94
0018dd78 729af6a5 0018ddbc 00000000 00000000 msvbvm60!VBMessageBox2+0x92
0018dda0 729af9a0 729af7ce 0018ddbc 0018ddbc msvbvm60!MessageBoxPVoid+0x4b
0018ddd0 729a3d68 00000000 12aa8ef8 0018ddf8 msvbvm60!DlgEnableModeless+0x5e
0018de34 729a3db6 032807d4 002308e4 00000030 msvbvm60!_Scanint+0x13
0018de54 72a0c411 174be0e4 00000000 00000030 msvbvm60!RefMemberIDFromHxmod+0x39
0018de70 72a0c6f3 174be0e4 00000000 00000030 msvbvm60!EbShowError+0x3
0018de94 72a2497c 010831b8 00000000 00000000 msvbvm60!GetErrMsg+0x90
0018deb0 770fb6ad 0018df9c 00000000 0018dfec msvbvm60!SehUpdateStack+0x29
0018ded4 770fb67f 0018df9c 0018f6f8 0018dfec ntdll!ExecuteHandler2+0x26
0018def8 770fb620 0018df9c 0018f6f8 0018dfec ntdll!ExecuteHandler+0x24
0018df84 770b0163 0018df9c 0018dfec 0018df9c ntdll!RtlDispatchException+0x127
0018df84 74f3c42d 0018df9c 0018dfec 0018df9c ntdll!KiUserExceptionDispatcher+0xf
0018e4a0 72a10dcf c000008f 00000001 00000002 KERNELBASE!RaiseException+0x58
0018e4c0 72a0e228 010831b8 800a0061 0018e584 msvbvm60!CEnumConPnts::QueryInterface+0x34
0018e4d4 72a0e28c 010831b8 00000000 00000000 msvbvm60!BasicExcepDeferredFillIn+0x65
0018e4e4 72a0be99 00000061 11035a85 00000000 msvbvm60!BasicExcepDeferredFillIn+0xd2
00000000 00000000 00000000 00000000 00000000 msvbvm60!ValidateArray+0xb4

！失控证明这确实是悬挂的线程。

0:000> !runaway
 User Mode Time
  Thread       Time
   0:ca8       0 days 0:01:00.325
   8:13a4      0 days 0:00:00.171
   6:10b4      0 days 0:00:00.062
  10:1554      0 days 0:00:00.031
  19:1598      0 days 0:00:00.000
  18:a88       0 days 0:00:00.000
  17:7b0       0 days 0:00:00.000
  16:ba0       0 days 0:00:00.000
  15:770       0 days 0:00:00.000
  14:103c      0 days 0:00:00.000
  13:16bc      0 days 0:00:00.000
  12:17e4      0 days 0:00:00.000
  11:1160      0 days 0:00:00.000
   9:1194      0 days 0:00:00.000
   7:dc8       0 days 0:00:00.000
   5:1510      0 days 0:00:00.000
   4:af0       0 days 0:00:00.000
   3:e5c       0 days 0:00:00.000
   2:10f4      0 days 0:00:00.000
   1:ff8       0 days 0:00:00.000

！analyze -hang -v产生以下内容：

0:000> !analyze -hang -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for mscorlib.ni.dll
GetUrlPageData2 (WinHttp) failed: 12152.

FAULTING_IP: 
+0
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000001 ebx=00000000 ecx=00000000 edx=00000000 esi=0018dcd0 edi=00260f22
eip=755a218a esp=0018d788 ebp=0018d7a0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00200246
user32!NtUserSetFocus+0x15:
755a218a 83c404          add     esp,4

FAULTING_THREAD:  00000000

BUGCHECK_STR:  HANG

DEFAULT_BUCKET_ID:  APPLICATION_HANG

PROCESS_NAME:  OurProcess.exe

ERROR_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  OurProcess.exe

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0xca8 (0)
Current frame: 
ChildEBP RetAddr  Caller, Callee

DERIVED_WAIT_CHAIN:  

Dl Eid Cid     WaitType
-- --- ------- --------------------------
   0   758.ca8 Unknown                

WAIT_CHAIN_COMMAND:  ~0s;k;;

BLOCKING_THREAD:  00000ca8

PRIMARY_PROBLEM_CLASS:  APPLICATION_HANG

LAST_CONTROL_TRANSFER:  from 755eee3e to 755a218a

STACK_TEXT:  
0018d788 755eee3e 002609ac 00000001 755eed34 user32!NtUserSetFocus+0x15
0018d7a0 755962fa 00260f22 00000110 002609ac user32!MB_DlgProc+0x10a
0018d7cc 755bf9df 755eed34 00260f22 00000110 user32!InternalCallWinProc+0x23
0018d848 755bf784 00000000 755eed34 00260f22 user32!UserCallDlgProcCheckWow+0xd7
0018d898 755bf889 0160cf70 00000000 00000110 user32!DefDlgProcWorker+0xb7
0018d8b8 755962fa 00260f22 00000110 002609ac user32!DefDlgProcW+0x29
0018d8e4 75596d3a 755bf860 00260f22 00000110 user32!InternalCallWinProc+0x23
0018d95c 7559965e 00000000 76ee3d54 00260f22 user32!UserCallWinProcCheckWow+0x109
0018d9a0 755c206f 0160cf70 00000000 76ee3d54 user32!SendMessageWorker+0x581
0018da74 755bcf4b 75580000 00000008 00000000 user32!InternalCreateDialog+0xb9f
0018daac 755ef73c 75580000 1736f6a8 0010193a user32!InternalDialogBox+0xc1
0018db60 755efa18 00000030 ffffffff ffff0000 user32!SoftModalMessageBox+0x757
0018dcb8 755efc65 0018dcd0 00000000 755efbd1 user32!MessageBoxWorker+0x269
0018dd38 729af829 0018dd50 0010193a 0010193a user32!MessageBoxIndirectA+0x94
0018dd78 729af6a5 0018ddbc 00000000 00000000 msvbvm60!VBMessageBox2+0x92
0018dda0 729af9a0 729af7ce 0018ddbc 0018ddbc msvbvm60!MessageBoxPVoid+0x4b
0018ddd0 729a3d68 00000000 12aa8ef8 0018ddf8 msvbvm60!DlgEnableModeless+0x5e
0018de34 729a3db6 032807d4 002308e4 00000030 msvbvm60!_Scanint+0x13
0018de54 72a0c411 174be0e4 00000000 00000030 msvbvm60!RefMemberIDFromHxmod+0x39
0018de70 72a0c6f3 174be0e4 00000000 00000030 msvbvm60!EbShowError+0x3
0018de94 72a2497c 010831b8 00000000 00000000 msvbvm60!GetErrMsg+0x90
0018deb0 770fb6ad 0018df9c 00000000 0018dfec msvbvm60!SehUpdateStack+0x29
0018ded4 770fb67f 0018df9c 0018f6f8 0018dfec ntdll!ExecuteHandler2+0x26
0018def8 770fb620 0018df9c 0018f6f8 0018dfec ntdll!ExecuteHandler+0x24
0018df84 770b0163 0018df9c 0018dfec 0018df9c ntdll!RtlDispatchException+0x127
0018df84 74f3c42d 0018df9c 0018dfec 0018df9c ntdll!KiUserExceptionDispatcher+0xf
0018e4a0 72a10dcf c000008f 00000001 00000002 KERNELBASE!RaiseException+0x58
0018e4c0 72a0e228 010831b8 800a0061 0018e584 msvbvm60!CEnumConPnts::QueryInterface+0x34
0018e4d4 72a0e28c 010831b8 00000000 00000000 msvbvm60!BasicExcepDeferredFillIn+0x65
0018e4e4 72a0be99 00000061 11035a85 00000000 msvbvm60!BasicExcepDeferredFillIn+0xd2
00000000 00000000 00000000 00000000 00000000 msvbvm60!ValidateArray+0xb4


FOLLOWUP_IP: 
msvbvm60!VBMessageBox2+92
729af829 8bd8            mov     ebx,eax

SYMBOL_STACK_INDEX:  e

SYMBOL_NAME:  msvbvm60!VBMessageBox2+92

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msvbvm60

IMAGE_NAME:  msvbvm60.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bda6c

STACK_COMMAND:  ~0s ; kb

BUCKET_ID:  HANG_msvbvm60!VBMessageBox2+92

FAILURE_BUCKET_ID:  APPLICATION_HANG_cfffffff_msvbvm60.dll!VBMessageBox2

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:application_hang_cfffffff_msvbvm60.dll!vbmessagebox2

FAILURE_ID_HASH:  {e6dc63dc-251f-a6d5-c66e-f5e07e418955}

Followup: MachineOwner
---------

1 个答案:

答案 0 :(得分：-1)

首先，我要知道它在做什么。当它挂起时会得到几个故障转储并比较堆栈以找出它正在旋转的位置。还有一些符号有很大的偏移量（user32！InternalCreateDialog + 0xb9f ），你使用的是符号服务器吗？

相关问题
最新问题