-1

This is my first time asking a question, and I will admit up front that I am a rank beginner when it comes to user mode debugging. Here's what I'm trying to do:

I've already gotten the exceptions and counts by using !dae and I've chosen one that has a callstack. I want to view what parameters are being passed to the functions in this callstack, so I'm assuming that I'll need to switch to the thread that contains this exception and view the parameter addresses by using the kb command.

I've already tried the !threads command and while it did list the threads, there were no exceptions showing under the 'exception' column.

Thomas Weller
  • 55,411
  • 20
  • 125
  • 222
Will Buffington
  • 1,048
  • 11
  • 13

1 Answers1

0

As mentioned by @magicandre1981 in the comments, !dae is an old command, which just lists exception objects that are available on the heap. Many of those exceptions have not been thrown. (That command is similar (probably not identical) to !dumpheap -type Exception.)

I've chosen one that has a callstack

That's certainly a good idea. However, be aware that this exception may have been caught and has been handled or will be caught and handled.

I'm assuming that I'll need to switch to the thread that contains this exception

The command for that would be ~#s:

  • ~: thread
  • #: with exception
  • s: select / switch to

For that to work, the exception must be thrown at the moment (read on).

view the parameter addresses by using the kb command

This will not work, since the k commands are designed for native stacks, not for managed stacks. For .NET you need !clrstack -p. Like kb, this only works real callstacks, not for callstacks attached to an exception.

I've already tried the !threads command and while it did list the threads, there were no exceptions showing under the 'exception' column.

This probably means that you're unlucky and that exception is not thrown right now.

The following commands might help to clarify that:

  • .exr -1: get the last exception. If this gives 0xE0434F4D, a .NET exception is thrown. If not, you're unlucky (likely in your case).
  • !pe: print the managed exception that is thrown (unlikely in your case).

Since I assume that both will not give you the result you expected, the question is: how and when did you take the crash dump. If you want to analyze a crash, you need to take the crash dump while the application is crashing. Not before and not after. See How to take a good crash dump for .NET for things to consider. In your case, ProcDump with the -e command line switch or WER LocalDumps seem suitable if you don't use an unhandled exception handler.

Thomas Weller
  • 55,411
  • 20
  • 125
  • 222