none
Dump file Analyze RRS feed

  • Question

  • Hi,

    Need your help, I have 2 days of debugging without a true results.Can you help me identify the problem from the dumb


    Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [D:\dump\AL_Designer.exe.4300.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Symbol search path is: srv*
    Executable search path is: 
    Windows 8.1 Version 9600 MP (3 procs) Free x64
    Product: Server, suite: TerminalServer SingleUserTS
    6.3.9600.18217 (winblue_ltsb.160124-0053)
    Machine Name:
    Debug session time: Sat Feb 15 14:53:16.000 2020 (UTC + 1:00)
    System Uptime: 0 days 0:27:04.038
    Process Uptime: 0 days 0:00:06.000
    ................................................................
    ................................................................
    ....................
    Loading unloaded module list
    .............
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (10cc.1978): Unknown exception - code 40000015 (first/second chance not available)
    For analysis of this file, run !analyze -v
    ntdll!NtWaitForMultipleObjects+0xa:
    00007ffd`dabd0d0a c3              ret
    0:000> ecxr
    Couldn't resolve error at 'cxr'
    0:000> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: $ntdllsym!_CONTEXT                            ***
    ***                                                                   ***
    *************************************************************************
    *** WARNING: Unable to verify checksum for tls8012d.dll
    *** WARNING: Unable to verify checksum for secsock1412d.dll
    ***** OS symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_CONTEXT                                   ***
    ***                                                                   ***
    *************************************************************************

    KEY_VALUES_STRING: 1


    PROCESSES_ANALYSIS: 1

    SERVICE_ANALYSIS: 1

    STACKHASH_ANALYSIS: 1

    TIMELINE_ANALYSIS: 1


    DUMP_CLASS: 2

    DUMP_QUALIFIER: 400

    CONTEXT:  (.ecxr)
    rax=0000000000000000 rbx=0000000000000000 rcx=000000000022b410
    rdx=0000000000000000 rsi=0000000000000001 rdi=0000000000000000
    rip=000000006a4ee775 rsp=000000000022b340 rbp=000000000022ff90
     r8=000000000022b2b8  r9=0274ba7698000000 r10=0000000000000000
    r11=0000000000000286 r12=ffffffffffffffff r13=0000000000000001
    r14=000000000022bab0 r15=0000000140086840
    iopl=0         nv up ei pl nz na pe nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    msvcr80!abort+0x45:
    00000000`6a4ee775 488d4c2430      lea     rcx,[rsp+30h]
    Resetting default scope

    FAULTING_IP: 
    msvcr80!terminate+38
    00000000`6a4e6a68 4883c428        add     rsp,28h

    EXCEPTION_RECORD:  (.exr -1)
    ExceptionAddress: 000000006a4e6a68 (msvcr80!terminate+0x0000000000000038)
       ExceptionCode: 40000015
      ExceptionFlags: 00000000
    NumberParameters: 0

    BUGCHECK_STR:  5D6AA558

    WRONG_SYMBOLS_TIMESTAMP: 5d6aa558

    WRONG_SYMBOLS_SIZE: 1ad000

    FAULTING_MODULE: 00007ffddab40000 ntdll

    DEBUG_FLR_IMAGE_TIMESTAMP:  5d6aa558

    ADDITIONAL_DEBUG_TEXT:  
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols. ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

    ANALYSIS_SESSION_HOST:  VDA1CS2681

    ANALYSIS_SESSION_TIME:  02-15-2020 15:04:25.0095

    ANALYSIS_VERSION: 10.0.18362.1 amd64fre

    STACK_TEXT:  
    00000000`0022b340 00000000`6a4ee775 msvcr80!abort+0x45
    00000000`0022b8f0 00000000`6a4e6a68 msvcr80!terminate+0x38
    00000000`0022b920 00000001`40086879 AL_Designer+0x86879
    00000000`0022b950 00007ffd`d8191b22 KERNELBASE!UnhandledExceptionFilter+0x1a2
    00000000`0022ba40 00007ffd`dabdf1b3 ntdll!memset+0xaaf3
    00000000`0022ba80 00007ffd`dabc1e26 ntdll!_C_specific_handler+0x96
    00000000`0022baf0 00007ffd`dabd349d ntdll!_chkstk+0x9d
    00000000`0022bb20 00007ffd`dab948d7 ntdll!RtlRaiseException+0xf67
    00000000`0022c1f0 00007ffd`dab93afd ntdll!RtlRaiseException+0x18d
    00000000`0022c9b0 00007ffd`d80b908c KERNELBASE!RaiseException+0x6c
    00000000`0022ca90 00000000`6a51b164 msvcr80!CxxThrowException+0xc4
    00000000`0022cb00 00000000`007a667a tls8012d!RWThrow+0x9a
    00000000`0022cb50 00000000`00765c37 tls8012d!operator<=+0x57
    00000000`0022cba0 00000000`00881153 secsock1412d!RWX509CertificateImp::isValid+0x43
    00000000`0022cbd0 00000000`071ca9bf RWAdminClient!SGClient::SGClient+0x169cf
    00000000`0022cc50 00000000`071af520 RWAdminClient!CNotificationServer::ReadSSLConfiguration+0x90
    00000000`0022cf20 00000000`07181f8d RWAdminClient!CActaServerClient::WSAStartup+0x4d
    00000000`0022d100 00000000`012b651a DiagramModelFW3!CRWJobErrorImp::SetCursor+0x944a
    00000000`0022d130 00000000`011e2b09 DiagramModelFW3!CJobServerDiagramModel::WSAStartup+0x9
    00000000`0022d160 00000001`4006e19b AL_Designer+0x6e19b
    00000000`0022fe70 00000000`6622eb9e mfc80u+0x6eb9e
    00000000`0022feb0 00000001`40085fe1 AL_Designer+0x85fe1
    00000000`0022ff60 00007ffd`daa013d2 kernel32!BaseThreadInitThunk+0x22
    00000000`0022ff90 00007ffd`dab554f4 ntdll!RtlUserThreadStart+0x34


    STACK_COMMAND:  .ecxr ; kb ; ** Pseudo Context ** Pseudo ** Value: 30da1efba0 ** ; kb

    THREAD_SHA1_HASH_MOD_FUNC:  ff9ccfb576c799956fe49923e7dc77d7ca4ec40b

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  b1bd1c2e2fb3ac1d4410c6de7701c8a031e2ae63

    THREAD_SHA1_HASH_MOD:  19ef0bdf4cf63d6dd6c61f0fea46b6f7b4c27968

    FOLLOWUP_IP: 
    msvcr80!abort+45
    00000000`6a4ee775 488d4c2430      lea     rcx,[rsp+30h]

    FAULT_INSTR_CODE:  244c8d48

    SYMBOL_STACK_INDEX:  0

    FOLLOWUP_NAME:  MachineOwner

    EXCEPTION_CODE: (NTSTATUS) 0x5d6aa558 - <Unable to get error code text>

    EXCEPTION_CODE_STR:  5D6AA558

    EXCEPTION_STR:  PRIVATE_SYMBOLS

    PROCESS_NAME:  ntdll.wrong.symbols.dll

    IMAGE_NAME:  ntdll.wrong.symbols.dll

    MODULE_NAME: ntdll_wrong_symbols

    SYMBOL_NAME:  ntdll_wrong_symbols!5D6AA5581AD000

    BUCKET_ID:  PRIVATE_SYMBOLS_X64_6.3.9600.18217_(winblue_ltsb.160124-0053)_TIMESTAMP_190831-165032

    DEFAULT_BUCKET_ID:  PRIVATE_SYMBOLS_X64_6.3.9600.18217_(winblue_ltsb.160124-0053)_TIMESTAMP_190831-165032

    PRIMARY_PROBLEM_CLASS:  PRIVATE_SYMBOLS

    FAILURE_BUCKET_ID:  PRIVATE_SYMBOLS_X64_6.3.9600.18217_(winblue_ltsb.160124-0053)_TIMESTAMP_190831-165032_5D6AA558_ntdll.wrong.symbols.dll!5D6AA5581AD000

    FAILURE_EXCEPTION_CODE:  5D6AA558

    FAILURE_IMAGE_NAME:  ntdll.wrong.symbols.dll

    BUCKET_ID_IMAGE_STR:  ntdll.wrong.symbols.dll

    FAILURE_MODULE_NAME:  ntdll_wrong_symbols

    BUCKET_ID_MODULE_STR:  ntdll_wrong_symbols

    FAILURE_FUNCTION_NAME:  5D6AA5581AD000

    BUCKET_ID_FUNCTION_STR:  5D6AA5581AD000

    BUCKET_ID_OFFSET:  0

    BUCKET_ID_MODTIMEDATESTAMP:  0

    BUCKET_ID_MODCHECKSUM:  0

    BUCKET_ID_MODVER_STR:  0.0.0.0

    BUCKET_ID_PREFIX_STR:  PRIVATE_SYMBOLS_X64_6.3.9600.18217_(winblue_ltsb.160124-0053)_TIMESTAMP_190831-165032

    FAILURE_PROBLEM_CLASS:  PRIVATE_SYMBOLS

    FAILURE_SYMBOL_NAME:  ntdll.wrong.symbols.dll!5D6AA5581AD000

    TARGET_TIME:  2020-02-15T13:53:16.000Z

    OSBUILD:  9600

    OSSERVICEPACK:  19538

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  272

    PRODUCT_TYPE:  3

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 8.1

    OSEDITION:  Windows 8.1 Server TerminalServer SingleUserTS

    OS_LOCALE:  

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2019-10-15 05:45:31

    BUILDDATESTAMP_STR:  160124-0053

    BUILDLAB_STR:  winblue_ltsb

    BUILDOSVER_STR:  6.3.9600.18217

    ANALYSIS_SESSION_ELAPSED_TIME:  28b6

    ANALYSIS_SOURCE:  UM

    FAILURE_ID_HASH_STRING:  um:private_symbols_x64_6.3.9600.18217_(winblue_ltsb.160124-0053)_timestamp_190831-165032_5d6aa558_ntdll.wrong.symbols.dll!5d6aa5581ad000

    FAILURE_ID_HASH:  {29d6724e-ad60-5ea5-7b45-2180d9f40aed}

    Followup:     MachineOwner
    ---------

    Saturday, February 15, 2020 2:09 PM

All replies

  • Any?
    Saturday, February 15, 2020 2:23 PM
  • 1. according to Windbg, you didn't set a correct symbol path
    2. the call stack doesn't contain managed code: you are in the wrong forum
    3. the exception is thrown from this 3rd party code (or is it your own?)
    maybe testing a certificate?

    0000000`0022cb00 00000000`007a667a tls8012d!RWThrow+0x9a
    00000000`0022cb50 00000000`00765c37 tls8012d!operator<=+0x57
    00000000`0022cba0 00000000`00881153 secsock1412d!RWX509CertificateImp::isValid+0x43


    • Edited by EckiS Sunday, February 16, 2020 7:22 PM
    Saturday, February 15, 2020 7:04 PM