windbg - 应用程序故障转储分析-6ren

windbg - 应用程序故障转储分析

转载作者：行者123 更新时间：2023-12-02 06:48:04

我正在尝试分析应用程序在使用 Citrix XenApp 6.5 的 Windows 2k8R2 终端服务器上启动时崩溃的原因。

我创建了一个故障转储并尝试使用 WinDbg 对其进行分析，但我不是开发人员，所以我并不真正了解出了什么问题。

转储:http://ul.to/sesqjqws

这是我通过 WinDbg 得到的结果:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [N:\Shares\Datenaustausch\Kaufmann\atris.exe.21728.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: SRV*C:\SYMBOLS*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Machine Name:
Debug session time: Wed Jul 17 10:51:39.000 2013 (UTC + 2:00)
System Uptime: 0 days 8:18:13.644
Process Uptime: 0 days 0:00:08.000
................................................................
................
Loading unloaded module list
.................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(54e0.2e54): Access violation - code c0000005 (first/second chance not available)
eax=00000070 ebx=038a0000 ecx=00000007 edx=00000000 esi=038a007c edi=0000008c
eip=77b3eb2a esp=00091000 ebp=00091010 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
ntdll!ULongLongToULong+0x2:
77b3eb2a 55              push    ebp
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for atris.exe - 

FAULTING_IP: 
ntdll!ULongLongToULong+2
77b3eb2a 55              push    ebp

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77b3eb2a (ntdll!ULongLongToULong+0x00000002)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00090ffc
Attempt to write to address 00090ffc

DEFAULT_BUCKET_ID:  INVALID_STACK_ACCESS

PROCESS_NAME:  atris.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  00090ffc

WRITE_ADDRESS:  00090ffc 

FOLLOWUP_IP: 
msvcr80!_decode_pointer+3f
74742c18 8bf0            mov     esi,eax

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  00002e54

PRIMARY_PROBLEM_CLASS:  INVALID_STACK_ACCESS

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE

LAST_CONTROL_TRANSFER:  from 77b3eb8e to 77b3eb2a

STACK_TEXT:  
00090ffc 77b3eb8e 00000070 00000000 0009101c ntdll!ULongLongToULong+0x2
00091010 77b3e900 0000008c 00000007 00000010 ntdll!ARRAY_FITS+0x16
0009104c 77b3e9f6 0000077c 00000007 00000002 ntdll!RtlpLocateActivationContextSection+0x126
0009107c 77b3eb12 000910b8 000910dc 000910e0 ntdll!RtlpFindNextActivationContextSection+0x64
00091094 77b3ed19 000910b8 000910dc 000910e0 ntdll!RtlpFindFirstActivationContextSection+0x41
000910e8 77b3f3df 00000003 00000000 00000002 ntdll!RtlFindActivationContextSectionString+0x91
000911a4 77b3f1aa 00000000 00000000 00091390 ntdll!AitFireParentUsageEvent+0x772
00091300 77b3faf6 00000001 00091554 77b3fa84 ntdll!RtlDosApplyFileIsolationRedirection_Ustr+0x23e
00091340 77b3fe2a 00000000 00091554 77b3fa84 ntdll!LdrpApplyFileNameRedirection+0x128
000914c8 77b3fd2f 00000001 00000001 00000000 ntdll!LdrGetDllHandleEx+0x139
000914e4 75a51a35 00000001 00000000 00091554 ntdll!LdrGetDllHandle+0x18
00091538 75a51c49 00091554 0ce8dfd7 00000057 KERNELBASE!GetModuleHandleForUnicodeString+0x22
000919b0 75a51d44 00000001 00000002 030dad10 KERNELBASE!BasepGetModuleHandleExW+0x181
000919c8 75a52ea1 030dad10 76e711e0 001a0018 KERNELBASE!GetModuleHandleW+0x29
000919e0 74742c18 747a49ec 00000000 74742c89 KERNELBASE!GetModuleHandleA+0x34
000919ec 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x3f
000919f8 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091a08 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091a0c 7474182c 00000001 74742b11 00091a2c msvcr80!_errno+0x5
00091a14 74742b11 00091a2c 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091a30 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091a38 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091a44 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091a54 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091a58 7474182c 00000001 74742b11 00091a78 msvcr80!_errno+0x5
00091a60 74742b11 00091a78 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091a7c 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091a84 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091a90 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091aa0 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091aa4 7474182c 00000001 74742b11 00091ac4 msvcr80!_errno+0x5
00091aac 74742b11 00091ac4 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091ac8 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091ad0 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091adc 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091aec 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091af0 7474182c 00000001 74742b11 00091b10 msvcr80!_errno+0x5
00091af8 74742b11 00091b10 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091b14 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091b1c 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091b28 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091b38 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091b3c 7474182c 00000001 74742b11 00091b5c msvcr80!_errno+0x5
00091b44 74742b11 00091b5c 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091b60 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091b68 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091b74 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091b84 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091b88 7474182c 00000001 74742b11 00091ba8 msvcr80!_errno+0x5
00091b90 74742b11 00091ba8 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091bac 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091bb4 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091bc0 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091bd0 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091bd4 7474182c 00000001 74742b11 00091bf4 msvcr80!_errno+0x5
00091bdc 74742b11 00091bf4 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091bf8 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091c00 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091c0c 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091c1c 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091c20 7474182c 00000001 74742b11 00091c40 msvcr80!_errno+0x5
00091c28 74742b11 00091c40 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091c44 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091c4c 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091c58 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091c68 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091c6c 7474182c 00000001 74742b11 00091c8c msvcr80!_errno+0x5
00091c74 74742b11 00091c8c 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091c90 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091c98 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091ca4 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091cb4 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091cb8 7474182c 00000001 74742b11 00091cd8 msvcr80!_errno+0x5
00091cc0 74742b11 00091cd8 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091cdc 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091ce4 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091cf0 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091d00 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091d04 7474182c 00000001 74742b11 00091d24 msvcr80!_errno+0x5
00091d0c 74742b11 00091d24 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091d28 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091d30 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091d3c 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091d4c 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091d50 7474182c 00000001 74742b11 00091d70 msvcr80!_errno+0x5
00091d58 74742b11 00091d70 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091d74 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091d7c 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091d88 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091d98 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091d9c 7474182c 00000001 74742b11 00091dbc msvcr80!_errno+0x5
00091da4 74742b11 00091dbc 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091dc0 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091dc8 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091dd4 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091de4 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091de8 7474182c 00000001 74742b11 00091e08 msvcr80!_errno+0x5
00091df0 74742b11 00091e08 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091e0c 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091e14 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091e20 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091e30 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091e34 7474182c 00000001 74742b11 00091e54 msvcr80!_errno+0x5
00091e3c 74742b11 00091e54 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091e58 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091e60 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091e6c 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091e7c 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091e80 7474182c 00000001 74742b11 00091ea0 msvcr80!_errno+0x5
00091e88 74742b11 00091ea0 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091ea4 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091eac 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091eb8 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091ec8 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091ecc 7474182c 00000001 74742b11 00091eec msvcr80!_errno+0x5
00091ed4 74742b11 00091eec 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091ef0 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091ef8 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091f04 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091f14 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091f18 7474182c 00000001 74742b11 00091f38 msvcr80!_errno+0x5
00091f20 74742b11 00091f38 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091f3c 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091f44 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091f50 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091f60 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091f64 7474182c 00000001 74742b11 00091f84 msvcr80!_errno+0x5
00091f6c 74742b11 00091f84 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091f88 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091f90 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091f9c 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091fac 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091fb0 7474182c 00000001 74742b11 00091fd0 msvcr80!_errno+0x5
00091fb8 74742b11 00091fd0 76e60000 00000000 msvcr80!_get_winmajor+0x10
00091fd4 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00091fdc 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00091fe8 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00091ff8 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00091ffc 7474182c 00000001 74742b11 0009201c msvcr80!_errno+0x5
00092004 74742b11 0009201c 76e60000 00000000 msvcr80!_get_winmajor+0x10
00092020 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00092028 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00092034 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00092044 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00092048 7474182c 00000001 74742b11 00092068 msvcr80!_errno+0x5
00092050 74742b11 00092068 76e60000 00000000 msvcr80!_get_winmajor+0x10
0009206c 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00092074 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00092080 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00092090 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
00092094 7474182c 00000001 74742b11 000920b4 msvcr80!_errno+0x5
0009209c 74742b11 000920b4 76e60000 00000000 msvcr80!_get_winmajor+0x10
000920b8 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
000920c0 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
000920cc 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
000920dc 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
000920e0 7474182c 00000001 74742b11 00092100 msvcr80!_errno+0x5
000920e8 74742b11 00092100 76e60000 00000000 msvcr80!_get_winmajor+0x10
00092104 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
0009210c 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00092118 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00092128 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0x15
0009212c 7474182c 00000001 74742b11 0009214c msvcr80!_errno+0x5
00092134 74742b11 0009214c 76e60000 00000000 msvcr80!_get_winmajor+0x10
00092150 74742c23 00000000 74742c89 00000000 msvcr80!_beginthreadex+0xc9
00092158 74742c89 00000000 00000000 74742dc7 msvcr80!_decode_pointer+0x4a
00092164 74742dc7 ffffffff 00000057 00000000 msvcr80!__set_flsgetvalue+0x1e
00092174 74744351 7474182c 00000001 74742b11 msvcr80!_getptd_noexit+0

STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  f

SYMBOL_NAME:  msvcr80!_decode_pointer+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msvcr80

IMAGE_NAME:  msvcr80.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ca2b271

FAILURE_BUCKET_ID:  INVALID_STACK_ACCESS_c0000005_msvcr80.dll!_decode_pointer

BUCKET_ID:  APPLICATION_FAULT_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE_msvcr80!_decode_pointer+3f


Followup: MachineOwner
---------

0:000> lmvm msvcr80
start    end        module name
74740000 747db000   msvcr80    (pdb symbols)          c:\symbols\msvcr80.i386.pdb\769BC0A2E0054674A3F542BCBBD95BA81\msvcr80.i386.pdb
    Loaded symbol image file: msvcr80.dll
    Image path: C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
    Image name: msvcr80.dll
    Timestamp:        Wed Sep 29 05:28:49 2010 (4CA2B271)
    CheckSum:         000A606B
    ImageSize:        0009B000
    File version:     8.0.50727.4940
    Product version:  8.0.50727.4940
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Visual Studio® 2005
    InternalName:     MSVCR80.DLL
    OriginalFilename: MSVCR80.DLL
    ProductVersion:   8.00.50727.4940
    FileVersion:      8.00.50727.4940
    FileDescription:  Microsoft® C Runtime Library
    LegalCopyright:   © Microsoft Corporation.  All rights reserved.

最佳答案

经过快速分析，从堆栈跟踪中可以清楚地看出，崩溃是在切换到函数 ntdll!ULongLongToULong 期间发生的。当“push ebp”尝试将 ebp 值放入堆栈时失败，原因是堆栈已损坏\耗尽。堆栈损坏更难以破解。如果您怀疑 atris.exe 应用程序没有问题，请尝试增加此应用程序的默认堆栈限制。如果仍然失败，那么你必须实时调试它。我从我的 Windbg 中得到了以下分析。在函数 atris!QuantifySaveData 中保留断点并尝试逐步调试以查看何时耗尽堆栈并崩溃。

FAULTING_IP: 
ntdll!ULongLongToULong+2 [e:\obj.x86fre\minkernel\published\base\objfre\i386\intsafe.h @ 5610]
77b3eb2a 55              push    ebp

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77b3eb2a (ntdll!ULongLongToULong+0x00000002)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00090ffc
Attempt to write to address 00090ffc

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000070 ebx=038a0000 ecx=00000007 edx=00000000 esi=038a007c edi=0000008c
eip=77b3eb2a esp=00091000 ebp=00091010 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
ntdll!ULongLongToULong+0x2:
77b3eb2a 55              push    ebp

DEFAULT_BUCKET_ID:  STACK_CORRUPTION

PROCESS_NAME:  atris.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  00090ffc

WRITE_ADDRESS:  00090ffc 

FOLLOWUP_IP: 
ntdll!ULongLongToULong+2 [e:\obj.x86fre\minkernel\published\base\objfre\i386\intsafe.h @ 5610]
77b3eb2a 55              push    ebp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  atris.exe

ANALYSIS_VERSION: 6.13.0015.1825 (debuggers(dbg).130504-0129) x86fre

FAULTING_THREAD:  00002e54

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 77b3eb8e to 77b3eb2a

PRIMARY_PROBLEM_CLASS:  STACK_CORRUPTION

BUGCHECK_STR:  APPLICATION_FAULT_STACK_CORRUPTION_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE

STACK_TEXT:  
00091000 77b3eb8e ntdll!ARRAY_FITS+0x16
00091014 77b3e900 ntdll!RtlpLocateActivationContextSection+0x126
00091038 77b3ec62 ntdll!bsearch+0x70
00091044 77b3eba1 ntdll!ARRAY_FITS+0x2d
00091050 77b3e9f6 ntdll!RtlpFindNextActivationContextSection+0x64
00091080 77b3eb12 ntdll!RtlpFindFirstActivationContextSection+0x41
00091098 77b3ed19 ntdll!RtlFindActivationContextSectionString+0x91
000910ec 77b3f3df ntdll!sxsisol_SearchActCtxForDllName+0x90
00091154 77b3f442 ntdll!sxsisol_SearchActCtxForDllName+0x1ab
000911a0 7600311b shell32!_GUID_70577d41_432e_45c1_9245_816af8da9136+0xf
000911a8 77b3f1aa ntdll!RtlDosApplyFileIsolationRedirection_Ustr+0x23e
000911c8 00800000 atris!QuantifySaveData+0x373ff0
000912e8 77b3fb2e ntdll!ApiSetResolveToHost+0x28
000912f0 77b3fb48 ntdll!`string'+0x0
000912fc 760033bf shell32![thunk]:CResultSetManager::AddRef`adjustor{60}'+0x8
00091304 77b3faf6 ntdll!LdrpApplyFileNameRedirection+0x128
00091344 77b3fe2a ntdll!LdrGetDllHandleEx+0x139
00091380 77b3fa84 ntdll!LdrpDefaultExtension+0x0
000913a8 77b3e1b2 ntdll!zzz_AsmCodeRange_End+0x0
000913b0 760035ab shell32!CResultSetManager::~CResultSetManager+0x4d
000913fc 760035df shell32!CResultSetManager::~CResultSetManager+0x81
00091448 76003513 shell32!CResultSetManager::Release+0x1a
00091478 77c101a0 ntdll!LdrpDefaultPath+0x0
0009148c 01b3e1b2 atris!QuantifySaveData+0x16b21a2
00091490 77b40000 ntdll!LdrGetDllHandleEx+0x324
00091494 76003547 shell32!CResultSetManager::`scalar deleting destructor'+0xf
0009149c 77b3fd17 ntdll!LdrGetDllHandle+0x0
000914ac 76003477 shell32!CItem::~CItem+0x28
000914e8 75a51a35 kernelbase!GetModuleHandleForUnicodeString+0x22
0009150c 01ba9a3f atris!QuantifySaveData+0x171da2f
00091514 77b40078 ntdll!LdrGetDllHandleEx+0x451
00091518 77b3fd2f ntdll!LdrGetDllHandle+0x18
0009153c 75a51c49 kernelbase!BasepGetModuleHandleExW+0x181
00091820 02080000 atris!QuantifySaveData+0x1bf3ff0
00091830 75a51ac0 kernelbase!GetModuleHandleForUnicodeString+0xad
00091834 75a7737e kernelbase!__SEH_epilog4_GS+0xa
00091864 76003857 shell32!CResultSetManager::s_ClearSetInfo+0x58
00091884 75a51cfb kernelbase!BasepGetModuleHandleExW+0x233
000918b0 7600398b shell32!ShouldSuppressGrouping+0x26
000918fc 7600393f shell32!ILCompareHiddenStackData+0x76
00091948 76003973 shell32!ShouldSuppressGrouping+0xe
00091964 77b3e752 ntdll!RtlAnsiStringToUnicodeString+0x97
00091978 77b3e785 ntdll!RtlAnsiStringToUnicodeString+0xf2
0009197c 76003913 shell32![thunk]:CDefView::Release`adjustor{92}'+0x9
000919b4 75a51d44 kernelbase!GetModuleHandleW+0x29
000919cc 75a52ea1 kernelbase!GetModuleHandleA+0x34
000919d4 76e711e0 kernel32!TlsGetValueStub+0x0
000919e4 74742c18 msvcr80!_decode_pointer+0x3f
000919e8 747a49ec msvcr80!`string'+0x0
0018f054 74742c23 msvcr80!_decode_pointer+0x4a
0018f05c 74742c89 msvcr80!__set_flsgetvalue+0x1e
0018f068 74742dc7 msvcr80!_getptd_noexit+0x15
0018f078 74744351 msvcr80!_errno+0x5
0018f07c 7474182c msvcr80!_get_winmajor+0x10
0018f084 74742b11 msvcr80!_use_encode_pointer+0x1b
0018f09c 77b3e046 ntdll!RtlAllocateHeap+0x0
0018f0a0 74742bac msvcr80!_encode_pointer+0x4a
0018f0a8 74742bd7 msvcr80!_encoded_null+0x7
0018f0b0 747410de msvcr80!_set_error_mode+0x5
0018f0b4 74741c91 msvcr80!_FF_MSGBANNER+0x7
0018f0bc 74744d31 msvcr80!malloc+0x28
0018f0cc 76e71484 kernel32!InterlockedCompareExchangeStub+0x0
0018f0d0 7474474a msvcr80!_malloc_crt+0xd
0018f0d8 72b0e440 ctxwsapi!CtxWSVirtualChannelSupportsShadow+0x6460
0018f0e0 72af4e19 ctxwsapi!CtxWSAppKilledNotifyPrivileged+0x329
0018f0e8 72b0a1d0 ctxwsapi!CtxWSVirtualChannelSupportsShadow+0x21f0
0018f0ec 74741762 msvcr80!_initterm_e+0x15
0018f0f4 72af4efe ctxwsapi!CtxWSAppKilledNotifyPrivileged+0x40e
0018f0f8 72b0a1cc ctxwsapi!CtxWSVirtualChannelSupportsShadow+0x21ec
0018f0fc 72b0a1d4 ctxwsapi!CtxWSVirtualChannelSupportsShadow+0x21f4
0018f110 72af5084 ctxwsapi!CtxWSAppKilledNotifyPrivileged+0x594
0018f144 72af553d ctxwsapi!CtxWSAppKilledNotifyPrivileged+0xa4d
0018f154 72af5150 ctxwsapi!CtxWSAppKilledNotifyPrivileged+0x660
0018f184 72af0000 ctxwsapi+0x0
0018f1e0 77b4da1b ntdll!LdrpHandleTlsData+0x2f
0018f1e4 68590000 sehook20+0x0
0018f1f0 77b4da2d ntdll!LdrpHandleTlsData+0x323
0018f1f4 7611d2d3 shell32!CUndoManager::GetOpenParentState+0x49
0018f23c 72af5133 ctxwsapi!CtxWSAppKilledNotifyPrivileged+0x643
0018f250 00b4bc9e atris!QuantifySaveData+0x6bfc8e
0018f270 77b4d78c ntdll!LdrpLoadDll+0x4d1
0018f284 77b329ba ntdll! ?? ::FNODOBFM::`string'+0x0
0018f2ac 010db390 atris!QuantifySaveData+0xc4f380
0018f2c4 758f18a3 imm32!CtfImmTIMActivate+0x32
0018f2e4 7595b546 user32!ImeSystemHandler+0x2a6
0018f374 75a76fd0 kernelbase!_except_handler4+0x0
0018f380 75a55a0b kernelbase!LocalAlloc+0x19a
0018f390 7595cfef user32!RealDefWindowProcA+0x4a
0018f394 75a5e949 kernelbase!BasepIncInstanceRefCount+0x1e
0018f398 75a81810 kernelbase!DllSearchPath+0x10
0018f3a4 75a81800 kernelbase!DllSearchPath+0x0
0018f3b4 75a5eac2 kernelbase!BaseEndReadingCache+0x3a
0018f3b8 77b74393 ntdll!RtlWow64EnableFsRedirectionEx+0x70
0018f3bc 7611d367 shell32!CEnumOleUndoUnit::Skip+0x12
0018f3d0 01ba9dbf atris!QuantifySaveData+0x171ddaf
0018f3dc 77b4c4d5 ntdll!LdrLoadDll+0xaa
0018f3f8 77b47d93 ntdll!RtlInitUnicodeStringEx+0x0
0018f414 75a52c95 kernelbase!LoadLibraryExW+0x1f1
0018f450 7595aac3 user32!__ClientLoadLibrary+0x66
0018f590 77b2010a ntdll!KiUserCallbackDispatcher+0x2e
0018f5a0 77b20070 ntdll!KiUserCallbackExceptionHandler+0x0
0018f5bc 00680066 atris!QuantifySaveData+0x1f4056
0018f5cc 7595a95d user32!NtUserCreateWindowEx+0x15
0018f5d0 7595a8e8 user32!VerNtUserCreateWindowEx+0x1a9
0018f690 77b438be ntdll!RtlpFreeHeap+0xbb1
0018f69c 7611d7c3 shell32!CEnumOleUndoUnit::Next+0x35
0018f6e4 02000002 atris!QuantifySaveData+0x1b73ff2
0018f724 77b43c94 ntdll!RtlpAllocateHeap+0xab2
0018f72c 7611d743 shell32!_GUID_df7b49a5_e292_4b38_b6df_bb4b621e7282+0x3
0018f754 01000001 atris!QuantifySaveData+0xb73ff1
0018f760 01010000 atris!QuantifySaveData+0xb83ff0
0018f774 01bae8ef atris!QuantifySaveData+0x17228df
0018f77c 77b4389a ntdll!RtlpFreeHeap+0xb7a
0018f780 77b43492 ntdll!RtlFreeHeap+0x142
0018f7e0 01000000 atris!QuantifySaveData+0xb73ff0
0018f7f4 01bae8cf atris!QuantifySaveData+0x17228bf
0018f7fc 77b43cc3 ntdll!RtlpAllocateHeap+0xe73
0018f800 77b43cee ntdll!RtlAllocateHeap+0x23a
0018f850 01baee67 atris!QuantifySaveData+0x1722e57
0018f858 77b3f55e ntdll!RtlImageNtHeaderEx+0x117
0018f85c 77b4319f ntdll!RtlImageNtHeader+0x1b
0018f864 00400000 atris+0x0
0018f87c 7595aa3c user32!_CreateWindowEx+0x210
0018f8d0 01baf2e7 atris!QuantifySaveData+0x17232d7
0018f8d8 77b3e38c ntdll!RtlpLowFragHeapAllocFromContext+0xaec
0018f8dc 77b3e0f2 ntdll!RtlAllocateHeap+0x206
0018f900 77b32260 ntdll!RtlLeaveCriticalSection+0x0
0018f904 50008f45 gwbase!GwMemoryPool::allocate+0x5e
0018f930 7595d261 user32!CreateWindowExA+0x33
0018f96c 50168de1 gwcore!GwGritSync::GwGritSync+0x6f
0018f9ac 50168e42 gwcore!GwGritSync::wnd_proc+0x0
0018f9cc 502280a8 gwcore!gwtogitm_atom_tab+0x1b8
0018f9d0 50230438 gwcore!GwDDE::dde_sync+0x0
0018f9d8 501a6166 gwcore!GwDDEerror_message+0x2f2
0018f9dc 5022424c gwcore!GwDDE_Client::`vftable'+0x5cfe8
0018f9e0 501a4969 gwcore!GwDDESync::operator=+0x67
0018f9e4 754cc167 msvcrt!_initterm+0x13
0018f9f0 501a7b99 gwcore!GwDDEerror_message+0x1d25
0018f9f4 50224000 gwcore!GwDDE_Client::`vftable'+0x5cd9c
0018f9f8 50224254 gwcore!GwDDE_Client::`vftable'+0x5cff0
0018fa00 501a7c51 gwcore!GwDDEerror_message+0x1ddd
0018fa20 77b49950 ntdll!zzz_AsmCodeRange_End+0x0
0018fa40 77b4d8c9 ntdll!LdrpRunInitializeRoutines+0x26f
0018fa48 50100000 gwcore+0x0
0018fa54 7611db8f shell32!CCommonParentUndoUnit::GetMarshalSizeMax+0x76
0018fa64 77b4c913 ntdll!SbUpdateSwitchContextBasedOnDll+0x267
0018fa68 77b4ea4b ntdll!LdrpHandleOneOldFormatImportDescriptor+0x11d
0018fa7c 77b4c95c ntdll!SbSupportedOsList+0x1c
0018fa88 77b4c940 ntdll!SbSupportedOsList+0x0
0018faa8 77b4df9d ntdll!LdrpProcessStaticImports+0x2b4
0018fab0 77b4dfc4 ntdll!LdrpProcessStaticImports+0x2d0
0018fab4 77b4dfb4 ntdll!LdrpProcessStaticImports+0x1ab
0018fab8 7611db93 shell32!CCommonParentUndoUnit::GetMarshalSizeMax+0x7a
0018fac0 77b566bc ntdll!Kernel32DllName+0x0
0018fae4 77b4d8a8 ntdll!LdrpRunInitializeRoutines+0x24b
0018fb00 501a7c00 gwcore!GwDDEerror_message+0x1d8c
0018fb28 01ba9e0f atris!QuantifySaveData+0x171ddff
0018fb34 77b5681c ntdll!LdrpInitializeProcess+0x1400
0018fb44 77c1206c ntdll!LdrpProcessInitialized+0x0
0018fbc4 77b55838 ntdll!KnownDllPathString+0x0
0018fbd8 77b33cbe ntdll! ?? ::FNODOBFM::`string'+0x0
0018fbe4 77b100d8 ntdll!CsrPortMemoryRemoteDelta+0x0
0018fbfc 76e60000 kernel32!ConsolePortHeap+0x0
0018fc20 0208001c atris!QuantifySaveData+0x1bf400c
0018fc40 00400118 atris+0x118
0018fcac 7611dc0f shell32!CCommonParentUndoUnit::MarshalInterface+0x45
0018fcb4 77b552d6 ntdll!_LdrpInitialize+0x78
0018fcc0 7611ddbf shell32!CEnumOleUndoUnit::Release+0x23
0018fce4 77c12088 ntdll!__security_cookie+0x0
0018fcf4 77b871d5 ntdll!_except_handler4+0x0
0018fcf8 01ba9e2f atris!QuantifySaveData+0x171de1f
0018fd04 77b49e79 ntdll!LdrInitializeThunk+0x10
0018fd1c 77b10000 ntdll!CsrPortMemoryRemoteDelta+0x0
0018fdac 016718a3 atris!QuantifySaveData+0x11e5893
0018fdd4 01b2f7e2 atris!QuantifySaveData+0x16a37d2
0018fddc 77b201b4 ntdll!RtlUserThreadStart+0x0


SYMBOL_STACK_INDEX:  49

SYMBOL_NAME:  ctxwsapi

FOLLOWUP_NAME:  wintriag

MODULE_NAME: ctxwsapi

IMAGE_NAME:  ctxwsapi.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  51b5cf53

STACK_COMMAND:  dpS 91000 190000 ; dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; dps 91000 ; kb

FAILURE_BUCKET_ID:  STACK_CORRUPTION_c0000005_ctxwsapi.dll!Unknown

BUCKET_ID:  APPLICATION_FAULT_STACK_CORRUPTION_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE_ctxwsapi

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:stack_corruption_c0000005_ctxwsapi.dll!unknown

FAILURE_ID_HASH:  {25f34e8f-b24e-3ec8-95d5-cbe76e2a9281}

更新线程执行 block

0:000> !teb
TEB at 7efdd000
    ExceptionList:        000914b8
    StackBase:            00190000
    StackLimit:           00091000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 7efdd000
    EnvironmentPointer:   00000000
    ClientId:             000054e0 . 00002e54
    RpcHandle:            00000000
    Tls Storage:          7efdd02c
    PEB Address:          7efde000
    LastErrorValue:       87
    LastStatusValue:      c000000d

关于windbg - 应用程序故障转储分析，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/17696472/

文章推荐： numpy - Scipy Sparse 是否使用(稀疏)BLAS 库？

文章推荐： azure - 是否可以重命名 Azure 订阅名称/域？

文章推荐： Azure Service Fabric 路由

C 程序我想知道是否有办法简化我的 dayofyear 程序？
我是 C 语言新手，我编写了这个 C 程序，让用户输入一年中的某一天，作为返回，程序将输出月份以及该月的哪一天。该程序运行良好，但我现在想简化该程序。我知道我需要一个循环，但我不知道如何去做。这是程序
java - GUI Java 程序 - Paint 程序
我一直在努力找出我的代码有什么问题。这个想法是创建一个小的画图程序，并有红色、绿色、蓝色和清除按钮。我有我能想到的一切让它工作，但无法弄清楚代码有什么问题。程序打开，然后立即关闭。 import ja
homebrew - 从 Homebrew 程序/欺骗程序到 Homebrew 程序/核心的迁移是什么？
我想安装screen，但是接下来我应该做什么？ $ brew search screen imgur-screenshot screen
python - 客户端(python 程序)没有收到服务器(c 程序)返回的响应？
我有一个在服务器端工作的 UDP 套接字应用程序。为了测试服务器端，我编写了一个简单的 python 客户端程序，它发送消息“hello world how are you”。服务器随后应接收消息，将
python - 运行一个 shell 脚本，该脚本运行一个 python 程序，然后运行一个 R 程序
我有一个 shell 脚本，它运行一个 Python 程序来预处理一些数据，然后运行一个 R 程序来执行一些长时间运行的任务。我正在学习使用 Docker 并且我一直在运行 FROM r-base:l
python - 在 Linux 中从 Python 启动一个 c 程序，将一个大文本字符串作为参数传递给 c 程序
在 Linux 中。我有一个 c 程序，它读取一个 2048 字节的文本文件作为输入。我想从 Python 脚本启动 c 程序。我希望 Python 脚本将文本字符串作为参数传递给 c 程序，而不是将
在网页上调起本机C#程序
前言最近开始整理笔记里的库存草稿，本文是 23 年 5 月创建的了（因为中途转移到 onedrive，可能还不止）网页调起电脑程序是经常用到的场景，比如百度网盘下载，加入 QQ 群之类的我
VHDL 程序
对于一个类，我被要求编写一个 VHDL 程序，该程序接受两个整数输入 A 和 B，并用 A+B 替换 A，用 A-B 替换 B。我编写了以下程序和测试平台。它完成了实现和行为语法检查，但它不会模拟。尽
haskell 程序
module Algorithm where import System.Random import Data.Maybe import Data.List type Atom = String ty
求给定N个数的最小公倍数的C++程序
我想找到两个以上数字的最小公倍数求给定N个数的最小公倍数的C++程序最佳答案 int lcm(int a, int b) { return (a/gcd(a,b))*b; } 对于gcd，请查看
索引器的c#程序
这个程序有错误。谁能解决这个问题？ Error is :TempRecord already defines a member called 'this' with the same paramete
铁路围栏密码的C++程序
当我运行下面的程序时，我在 str1 和 str2 中得到了垃圾值。所以 #include #include #include using namespace std; int main() {
死兔子的C++程序
这是我的作业: 一对刚出生的兔子(一公一母)被放在田里。兔子在一个月大时可以交配，因此在第二个月的月底，每对兔子都会生出两对新兔子，然后死去。注:在第0个月，有0对兔子。第 1 个月，有 1 对兔子
十进制转十六进制的C++程序
我编写了一个程序，通过对字母使用 switch 命令将十进制字符串转换为十六进制，但是如果我使用 char，该程序无法正常工作!没有 switch 我无法处理 9 以上的数字。我希望你能理解我，因为我
连接MySQL的C++程序
我是 C++ 新手(虽然我有一些 C 语言经验)和 MySQL，我正在尝试制作一个从 MySQL 读取数据库的程序，我一直在关注这个 tutorial但当我尝试“构建”解决方案时出现错误。 (我正在使
Swift If 程序
仍然是一个初学者，只是尝试使用 swift 中的一些基本函数。有人能告诉我这段代码有什么问题吗？ import UIKit var guessInt: Int var randomNum = arc
折叠常量的C++程序
我正在用 C++11 编写一个函数，它采用 constant1 + constant2 形式的表达式并将它们折叠起来。 constant1 和 constant2 存储在 std::string 中，
2个矩阵相加和相乘的C++程序
我用 C++ 编写了这段代码，使用运算符重载对 2 个矩阵进行加法和乘法运算。当我执行代码时，它会在第 57 行和第 59 行产生错误，非法结构操作(两行都出现相同的错误)。请解释我的错误。提前致谢:
交换字符串中两个字符的C++程序
我是 C++ 的初学者，我想编写一个简单的程序来交换字符串中的两个字符。例如；我们输入这个字符串:“EXAMPLE”，我们给它交换这两个字符:“E”和“A”，输出应该类似于“AXEMPLA”。我在
确定三角形的C++程序
我需要以下代码的帮助: 声明 3 个 double 类型变量，每个代表三角形的三个边中的一个。提示用户为第一面输入一个值，然后将用户的输入设置为您创建的代表三角形第一条边的变量。将最后 2 个步

行者123

个人简介

我是一名优秀的程序员,十分优秀！

作者热门文章

滴滴打车优惠券免费领取

全站热门文章

首页

博学

6Ren·AI

商城

windbg - 应用程序故障转储分析