WinDbg - Some Starting Tips...

WinDBG is a debugging tool from Microsoft for user and kernel mode debugging. WinDBG is a GUI interface along with some debugging extensions. 

Here I am explaining how we can make use of WinDbg using Adplus commands to debug the application hang and crash scenarios. 

Please refer to the below link to download WinDBG

http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx

Once you have installed Debugging Tools for Windows, you can instantiate WinDBG from Start->Programs->Debugging Tools for Windows(x86)->WinDbg

Memory Dumps
Memory dump is a snapshot of the memory and register at the time of crash. You can also collect a memory of a process to get the snapshot of a process’s memory at a particular instance.

Step1 :  Get the Memory Dump file which created because of program hang or crash.

For this  we have to attach  debugger  to the application which we want to analyze.  

We will use Adplus commands to collect the dump files. Adplus have 3 modes of operation "Hang", "Crash", "Quick"

ADPlus has 3 modes of operation: ‘Hang‘, ‘Quick‘ and ‘Crash‘ mode.

Hang Mode

                        In ‘Hang’ mode, ADPlus assumes that a process is hung and it will attach a debugger to the process(s) specified on the command line. After the debugger is attached to the process(s) ADPlus will dump the memory of each process to a .dmp file for later analysis with a debugger (such as WinDBG). In this mode, processes are paused briefly while their memory is being dumped to a file and then resumed.

Quick Mode

                       In ‘-quick’ mode ADPlus assumes that a process is hung and it will attach a debugger to the process(s) specified on the command line with either the ‘-p’ or ‘-pn’ or ‘-iis’ switches. After the debugger is attached to the process(s) ADPlus will create mini dumps for each process, containing commonly requested debug information, rather than dumping the entire memory for each process.’Quick’ mode is generally faster than ‘Hang’ mode, but requires symbols to be installed on the server where ADPlus is running.

Crash Mode

                     In ‘Crash’ mode, ADPlus assumes that a process will crash and it will attach a debugger to the process(s) specified on the command line with either the ‘-p’ or ‘-pn’ or ‘-iis’ switches. After the debugger is attached to the process(s)ADPlus will configure the debugger to log ‘first chance’ access violations (AV’s) to a text file. When a ’second chance’ access violation occurs, the processes memory is dumped to a .dmp file for analysis with a debugger such as WinDBG. In this mode, a debugger remains attached to the process(s) until the process exits or the debugger is exited by pressing CTRL-C in the minimized debugger window. When the process crashes, or CTRL-C is pressed, it will need to be re-started.

Collecting Dump using Adplus:

   Open command prompt and go to WinDbg folder, then create command with following elements

-hang/-crash/-quick => indicates for what scenario you want to create dump

-pi => specify the process ID

-pn => specify the process name

-iis => will collect iis dump also

-quiet  => To suppress the dialogs

-o => specify the output folder to which you want to create the dump. By default, the Adplus script will create subfolder similar to the following Hang_Mode__Date_mm-ddyyyy__Time_hh-mm-ssAM/PM. This subfolder will be created under C:\WinDBG\, folder will contain debugger logs and a memory dump.

-r =>  Enables repeated hang attachments.

   


Followings are the additional switches you should know to collect crash dump

-FullOnFirst => This will create a full dump on first chance exception. Remember, you can’t do managed heap analysis unless you have a full dump. Sometime, you do want to get a full dump in case you are noticing unexpected behavior after a first chance exception has occurred. You may want to analyze application state, handles, objects on heap or data structures. Since there could be several first chance exceptions this may really slow down your application since it has to dump the memory on every single first chance exception. The default behavior is to have minidumps created on first chance.You are better off using a configuration file if you already know the exception type.

-MiniOnSecond  => Creates minidumps on second chance for all defined exceptions. The default behavior is to have full dumps created on second chance.

-NoDumpOnFirst  => Creates no dumps on first chance for all defined exceptions. The default behavior is to have minidumps created on first chance.

-NoDumpOnSecond  => Creates no dumps on second chance for all defined exceptions. The default behavior is to have full dumps created on second chance.

The below is the screenshot

Step2 : As we have created dump as above, the next step is to open the dump in WinDbg and analyze it Will be continued.....