Crash in WIndow Service

NTDEV
1

Hi,
I am having a crash in a windows Service. !analyze -v out put shows the
following:
FAULTING_IP:
+6b73952f02bbdd5c
00000000 ?? ???
EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0
FAULTING_THREAD: 00001828
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: DxDmService.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint
has been reached.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments
are invalid
NTGLOBALFLAG: 400
APPLICATION_VERIFIER_FLAGS: 0
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 7c826fe9 to 7c82860c
STACK_TEXT:
0257fe9c 7c826fe9 77e416f9 0000023c 00000000 ntdll!KiFastSystemCallRet
0257fea0 77e416f9 0000023c 00000000 00000000 ntdll!NtDeviceIoControlFile+0xc
0257ff04 00414f7e 0000023c 0008c1d0 00000000 kernel32!DeviceIoControl+0x137
0257ff48 004151dd 0017a080 00534a5c 00000000
DxDmService!CDmDriverManager::iDriverRequestGetNext+0x3e
0257ff64 00415134 00000000 00534a5c 0257ffac
DxDmService!CDmDriverManager::iQueueThreadProc2+0x9d
0257ff74 103317d5 00534a5c 57a02651 00000000
DxDmService!CDmDriverManager::iQueueThreadProc+0x14
0257ffac 1033187d 00000000 0257ffec 77e6482f OsUtil!_callthreadstartex+0x1b
0257ffb8 77e6482f 00856ee8 00000000 00000000 OsUtil!_threadstartex+0x82
0257ffec 00000000 103317fb 00856ee8 00000000 kernel32!BaseThreadStart+0x34

STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP:
DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
00414f7e 8945f8 mov dword ptr [ebp-8],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: DxDmService
IMAGE_NAME: DxDmService.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4aa9f9c7
FAILURE_BUCKET_ID:
STATUS_BREAKPOINT_80000003_DxDmService.exe!CDmDriverManager::iDriverRequestGetNext
BUCKET_ID:
APPLICATION_FAULT_STATUS_BREAKPOINT_DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOne/DxDmService_exe/6_30_0_271/4aa9f9c7/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1
Followup: MachineOwner

The registers are:
0:000> r
eax=8000001a ebx=00000000 ecx=00000011 edx=00000070 esi=00000000
edi=0008c1d0
eip=7c82860c esp=0257fea0 ebp=0257ff04 iopl=0 nv up ei pl nz na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202

The problem is I am not able to get stack trace of all threads. There should
be around 50 threads but everytime only this thread is in Dump but this
thread does not look at fault. I tried setting breakpoint in
kernel32!TerminateProcess but this never hits.

How to get dump with all the threads stack trace. I guess the aboe
breakpoint hits on Process_Shutdown event.

Thanks
Ash

2

If you want to see stack traces from all threads in a process use the
following command:

(gdb) thread apply all bt
Thanks
Anshul Makkar
justkernel.com
xxxxx@justkernel.com

On Wed, Apr 14, 2010 at 3:38 PM, Ashish ntdev wrote:

> Hi,
> I am having a crash in a windows Service. !analyze -v out put shows the
> following:
> FAULTING_IP:
> +6b73952f02bbdd5c
> 00000000 ?? ???
> EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
> ExceptionAddress: 00000000
> ExceptionCode: 80000003 (Break instruction exception)
> ExceptionFlags: 00000000
> NumberParameters: 0
> FAULTING_THREAD: 00001828
> DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
> PROCESS_NAME: DxDmService.exe
> ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint
> has been reached.
> EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments
> are invalid
> NTGLOBALFLAG: 400
> APPLICATION_VERIFIER_FLAGS: 0
> PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
> BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
> LAST_CONTROL_TRANSFER: from 7c826fe9 to 7c82860c
> STACK_TEXT:
> 0257fe9c 7c826fe9 77e416f9 0000023c 00000000 ntdll!KiFastSystemCallRet
> 0257fea0 77e416f9 0000023c 00000000 00000000
> ntdll!NtDeviceIoControlFile+0xc
> 0257ff04 00414f7e 0000023c 0008c1d0 00000000 kernel32!DeviceIoControl+0x137
> 0257ff48 004151dd 0017a080 00534a5c 00000000
> DxDmService!CDmDriverManager::iDriverRequestGetNext+0x3e
> 0257ff64 00415134 00000000 00534a5c 0257ffac
> DxDmService!CDmDriverManager::iQueueThreadProc2+0x9d
> 0257ff74 103317d5 00534a5c 57a02651 00000000
> DxDmService!CDmDriverManager::iQueueThreadProc+0x14
> 0257ffac 1033187d 00000000 0257ffec 77e6482f OsUtil!_callthreadstartex+0x1b
>
> 0257ffb8 77e6482f 00856ee8 00000000 00000000 OsUtil!_threadstartex+0x82
> 0257ffec 00000000 103317fb 00856ee8 00000000 kernel32!BaseThreadStart+0x34
>
> STACK_COMMAND: ~0s; .ecxr ; kb
> FOLLOWUP_IP:
> DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
> 00414f7e 8945f8 mov dword ptr [ebp-8],eax
> SYMBOL_STACK_INDEX: 3
> SYMBOL_NAME: DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
> FOLLOWUP_NAME: MachineOwner
> MODULE_NAME: DxDmService
> IMAGE_NAME: DxDmService.exe
> DEBUG_FLR_IMAGE_TIMESTAMP: 4aa9f9c7
> FAILURE_BUCKET_ID:
> STATUS_BREAKPOINT_80000003_DxDmService.exe!CDmDriverManager::iDriverRequestGetNext
> BUCKET_ID:
> APPLICATION_FAULT_STATUS_BREAKPOINT_DxDmService!CDmDriverManager::iDriverRequestGetNext+3e
> WATSON_STAGEONE_URL:
> http://watson.microsoft.com/StageOne/DxDmService_exe/6_30_0_271/4aa9f9c7/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1
> Followup: MachineOwner
> ---------
> The registers are:
> 0:000> r
> eax=8000001a ebx=00000000 ecx=00000011 edx=00000070 esi=00000000
> edi=0008c1d0
> eip=7c82860c esp=0257fea0 ebp=0257ff04 iopl=0 nv up ei pl nz na po
> nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00000202
>
> The problem is I am not able to get stack trace of all threads. There
> should be around 50 threads but everytime only this thread is in Dump but
> this thread does not look at fault. I tried setting breakpoint in
> kernel32!TerminateProcess but this never hits.
>
> How to get dump with all the threads stack trace. I guess the aboe
> breakpoint hits on Process_Shutdown event.
>
> Thanks
> Ash
> — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–

3

anshul makkar wrote:

If you want to see stack traces from all threads in a process use the
following command:

|(gdb) thread apply all bt|

You must have forgotten that this is a Windows mailing list, and that
his dump was from windbg…

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.