CODEWITHSUNDEEP
windowsdebuggingcrashdebug-symbolswinpdb
Boris
Boris

Reputation: 1467

Finding functions names for crash

We received a crash log from customer's site looking like that(no function name resolution)

Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] XXXX.exe caused a in module at 001B:77E4BEE7
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80]
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] Build 5.2.0.426
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80]
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] WorkingSetSize: 296443904 bytes
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80]
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] EAX=7E5CCF88 EBX=00000000 ECX=00000000 EDX=7E5CD030 ESI=7E5CD010
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] EDI=00000000 EBP=7E5CCFD8 ESP=7E5CCF84 EIP=77E4BEE7 FLG=00000206
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] CS=001B DS=0023 SS=0023 ES=0023 FS=003B GS=0000
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80]
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:77E4BEE7 (0xE06D7363 0x00000001 0x00000003 0x7E5CD004)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:007339C1 (0x7E5CD030 0x00867174 0x823D8B58 0x7E5CD388)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:0072E769 (0x5832EF90 0x823D8AF0 0x00DF7118 0x00F97A38)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:004CB6CE (0x5832EF90 0x00F979F8 0x00000000 0x5832EF90)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:004D713C (0x00000002 0x582F5C50 0x823D8930 0x7E5CD1D8)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:004D681A (0x08A9F398 0x823D89FC 0x7E5CD388 0x007C8B64)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:004BD21E (0x823D89C4 0x823D89C8 0x00000000 0x08A9F398)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:00402157 (0x823D8838 0x0370B910 0x7E5CD2B8 0x7E5CD2B8)
Jan 13 12:15:41.739 ccodvcs2 VCS: [0x00003e80] 001B:0052AF9C (0x7E5CD370 0x823D8814 0x00F95F98 0x0367E120)

I have a corresponding PDB for all Dll's and EXE itself. how can I find the names of the functions on stack? Seems like a pretty useful thing but I couldn't be able to see any focused information on web,

I have tried to dump PDB file but addresses there do not correspond to what appears in crash.

Upvotes: 1

Views: 164

Answers (1)

John
John

Reputation: 5635

Open the program with windbg and type

ln 77E4BEE7 
ln 007339C1

etc.

Upvotes: 2

Related Questions