Question

我想以编程方式从用户转储文件中检索堆栈跟踪。在已知位置存在此用户转储，我想从中提取堆栈跟踪并将其放在纯文本文件中 - 有没有办法做到这一点？

注意：我可以手动完成 - 打开windbg并输入“k”命令 - 但是正如我之前提到的，我想以编程方式执行此操作。

由于

Answer 1

您应该查看windbg sdk子文件夹，其中包含有关如何以编程方式使用dbgeng.dll的示例。
代码示例：

 PSTR g_DumpFile;
 PSTR g_ImagePath;
 PSTR g_SymbolPath;

 ULONG64 g_TraceFrom[3];

 IDebugClient* g_Client;
 IDebugControl* g_Control;
 IDebugSymbols* g_Symbols;

  void CreateInterfaces(void)
  {
    HRESULT Status;

    // Start things off by getting an initial interface from
    // the engine.  This can be any engine interface but is
    // generally IDebugClient as the client interface is
    // where sessions are started.
    if ((Status = DebugCreate(__uuidof(IDebugClient),
                              (void**)&g_Client)) != S_OK)
    {
        Exit(1, "DebugCreate failed, 0x%X\n", Status);
    }

    // Query for some other interfaces that we'll need.
    if ((Status = g_Client->QueryInterface(__uuidof(IDebugControl),
                                           (void**)&g_Control)) != S_OK ||
        (Status = g_Client->QueryInterface(__uuidof(IDebugSymbols),
                                           (void**)&g_Symbols)) != S_OK)
    {
        Exit(1, "QueryInterface failed, 0x%X\n", Status);
    }
 }

 void
 DumpStack(void)
 {
    HRESULT Status;
    PDEBUG_STACK_FRAME Frames = NULL;
    int Count = 50;

    printf("\nFirst %d frames of the call stack:\n", Count);

    if (g_TraceFrom[0] || g_TraceFrom[1] || g_TraceFrom[2])
    {
        ULONG Filled;

        Frames = new DEBUG_STACK_FRAME[Count];
        if (Frames == NULL)
        {
            Exit(1, "Unable to allocate stack frames\n");
        }

        if ((Status = g_Control->
             GetStackTrace(g_TraceFrom[0], g_TraceFrom[1], g_TraceFrom[2],
                           Frames, Count, &Filled)) != S_OK)
        {
            Exit(1, "GetStackTrace failed, 0x%X\n", Status);
        }

        Count = Filled;
    }

    // Print the call stack.
    if ((Status = g_Control->
         OutputStackTrace(DEBUG_OUTCTL_ALL_CLIENTS, Frames,
                          Count, DEBUG_STACK_SOURCE_LINE |
                          DEBUG_STACK_FRAME_ADDRESSES |
                          DEBUG_STACK_COLUMN_NAMES |
                          DEBUG_STACK_FRAME_NUMBERS)) != S_OK)
    {
        Exit(1, "OutputStackTrace failed, 0x%X\n", Status);
    }

    delete[] Frames;
 }


 void __cdecl main(int Argc, __in_ecount(Argc) char** Argv)
 {
    CreateInterfaces();

    ParseCommandLine(Argc, Argv);

    ApplyCommandLineArguments();

    DumpStack();

    Exit(0, NULL);
 }

Answer 2

我写了一篇文章，几年前在DDJ中使用Windows和Unix / Linux在C / C ++中转储堆栈。它不使用cordump，但它会将堆栈帧写入日志文件，内部错误或OS确定应用程序故障时。

也许它可以帮到你：

请参阅http://www.ddj.com/architect/185300443

如何在Windows上以编程方式从转储文件获取堆栈跟踪

2 个答案: