利用windbg分析dump文件

windbg是windows下一个分析调试的工具，功能非常强大。这里主要记录利用windbg来分析windows蓝屏时所产生的内存转储文件*.dmp。

1，下载：

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

<wbr style="line-height:25px"></wbr>

2，配置symbol path：

windows程序在编译生成后，会产生一些.exe,dll文件。同时也会用到一些symbol文件，这些文件包含全局变量，局部变量等信息。在调试不同的系统的时候，用到的symbol是不同的，而且这些文件会很大，如果下载安装会占用很大的硬盘空间。如果下载，在上面提供的地址也可以下载。微软还提供了一个网络上的symbol服务器。其网络地址是：http://msdl.microsoft.com/download/symbols，设置symbol时可以在打开windbg后，file->symbol file path设置如下：其d:\temp是本地缓存的目录：SRV*d:/temp/*http://msdl.microsoft.com/download/symbols。也可以用命令如下设置：

set<wbr style="line-height:25px">_NT_SYMBOL_PATH=srv*</wbr>DownstreamStore*http://msdl.microsoft.com/download/symbols

利用windbg分析dump文件（二）基本调试

1，打开dump文件，在正确设置了symbol路径后，会有如下的显示：

Microsoft (R) Windows Debugger<wbr style="line-height:23px">Version 6.5.0003.7<br style="line-height:23px"> Copyright (c) Microsoft Corporation. All rights reserved.</wbr>

Loading Dump File [D:\important\document\win系统\debug\Mini121605-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:/temp/*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e8f0
Debug session time: Fri Dec 16 13:30:21.203 2005 (GMT+8)
System Uptime: not available
Loading Kernel Symbols
....................................................................................................................
Loading unloaded module list
...................
Loading User Symbols
*******************************************************************************
*<wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px">*<br style="line-height:23px"> *<span></span><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px">Bugcheck Analysis<span></span><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px">*<br style="line-height:23px"> *<span></span><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px">*<br style="line-height:23px"> *******************************************************************************</wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr>

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 0, 0, 0}

c0000005 Exception in ext.Analyze debugger extension.
<wbr style="line-height:23px"><span></span><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px"><wbr style="line-height:23px">PC: 77c16fa3<span></span><wbr style="line-height:23px">VA: 01fe8000<span></span><wbr style="line-height:23px">R/W: 0<span></span><wbr style="line-height:23px">Parameter: 0001003f</wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr>

<wbr style="line-height:25px"></wbr>

2，关于调试窗口：view菜单下面有详细的列表：可以调出对应的窗口，默认的打开窗口是command窗口

3，基本调试命令：

r<wbr style="line-height:23px"><wbr style="line-height:23px"></wbr></wbr>可以显示系统崩溃时的寄存器，和最后的命令状态。

dd显示当前内存地址，dd参数：显示参数处的内存。

u<wbr style="line-height:23px"><wbr style="line-height:23px"></wbr></wbr>可以显示反汇编的指令

！analyze -v显示分析的详细信息。

kb显示call stack内容

kv.bugcheck可以显示出错的代码