Different Call Stacks

WINDBG
1

I am facing some issues in displaying the call stacks while analyzing a user mode dump of my application.
When I fire the !analyze command I a get a different stack in it and when I fire the kn command I get a different one.
!analyze -v output:
STACK_TEXT:
4e54f208 0be25cd1 06b67270 06b67270 4e54f224 semax!semax_increment+0xb WARNING: Stack unwind information not available. Following frames may be wrong.
4e54f218 0be2380b 4e54f350 4e54f248 0be91e30 hpProvider+0x5cd1
4e54f224 0be91e30 342ec834 119f1101 342ec7b0 hpProvider+0x380b
4e54f248 0be52809 4e54f350 119f103d 00000000 hpProvider+0x71e30
4e54f374 0080c28b 4e54f3d8 50723100 00000013 hpProvider+0x32809
4e54f3f4 00410ed9 4e54fbb8 4e54f974 4e54f984 hpUtilities!hpProvider::enumeratehpInstance+0x9b
4e54fc90 004309a2 00000001 4ef7cc98 4ef7ccf8 XCIMOM+0x10ed9
4e54fce8 0099c3bf 17eafca9 00000000 00000000 XCIMOM+0x309a2
4e54fef4 0099be1d 30f333e0 4e54ff48 0024244a semax!CI_Thread::_thread_run+0xcf
4e54ff00 0024244a 30f333e0 17eafd1b 00000000 semax!_thread_run_wrapper+0xd
4e54ff48 754429bb 4e936850 17eafdaa 00000000 semax!thread_wrapper+0x7a
4e54ff80 75442a47 00000000 75f33677 252b2bf8 msvcr80!_endthreadex+0x3b
4e54ff88 75f33677 252b2bf8 4e54ffd4 77cf9d72 msvcr80!_endthreadex+0xc7
4e54ff94 77cf9d72 252b2bf8 3ed35933 00000000 kernel32!BaseThreadInitThunk+0xe
4e54ffd4 77cf9d45 754429e1 252b2bf8 ffffffff ntdll!__RtlUserThreadStart+0x70
4e54ffec 00000000 754429e1 252b2bf8 00000000 ntdll!_RtlUserThreadStart+0x1b

kn output
0:080> kn

ChildEBP RetAddr

00 4e54da80 760594ef ntdll!NtGetContextThread+0x12
01 4e54dac0 75f31e9e KERNELBASE!FindClose+0x93
02 4e54dd98 75bd9c39 kernel32!_SEH_epilog4_GS+0xa
03 4e54ddbc 75bd9c39 msvcrt!_VEC_memzero+0x36
04 4e54ddcc 00000000 msvcrt!_VEC_memzero+0x36

Why this happening and how to resolve it?

2

Search “!analyze -v” output for STACK_COMMAND, that’s how !analyze gets the stack for triage.

Below is an example:
STACK_COMMAND: ~0s; .ecxr ; kb

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, May 19, 2011 10:37 AM
To: Kernel Debugging Interest List
Subject: [windbg] Different Call Stacks

I am facing some issues in displaying the call stacks while analyzing a user mode dump of my application.
When I fire the !analyze command I a get a different stack in it and when I fire the kn command I get a different one.
!analyze -v output:
STACK_TEXT:
4e54f208 0be25cd1 06b67270 06b67270 4e54f224 semax!semax_increment+0xb WARNING: Stack unwind information not available. Following frames may be wrong.
4e54f218 0be2380b 4e54f350 4e54f248 0be91e30 hpProvider+0x5cd1
4e54f224 0be91e30 342ec834 119f1101 342ec7b0 hpProvider+0x380b
4e54f248 0be52809 4e54f350 119f103d 00000000 hpProvider+0x71e30
4e54f374 0080c28b 4e54f3d8 50723100 00000013 hpProvider+0x32809
4e54f3f4 00410ed9 4e54fbb8 4e54f974 4e54f984 hpUtilities!hpProvider::enumeratehpInstance+0x9b
4e54fc90 004309a2 00000001 4ef7cc98 4ef7ccf8 XCIMOM+0x10ed9
4e54fce8 0099c3bf 17eafca9 00000000 00000000 XCIMOM+0x309a2
4e54fef4 0099be1d 30f333e0 4e54ff48 0024244a semax!CI_Thread::_thread_run+0xcf
4e54ff00 0024244a 30f333e0 17eafd1b 00000000 semax!_thread_run_wrapper+0xd
4e54ff48 754429bb 4e936850 17eafdaa 00000000 semax!thread_wrapper+0x7a
4e54ff80 75442a47 00000000 75f33677 252b2bf8 msvcr80!_endthreadex+0x3b
4e54ff88 75f33677 252b2bf8 4e54ffd4 77cf9d72 msvcr80!_endthreadex+0xc7
4e54ff94 77cf9d72 252b2bf8 3ed35933 00000000 kernel32!BaseThreadInitThunk+0xe
4e54ffd4 77cf9d45 754429e1 252b2bf8 ffffffff ntdll!__RtlUserThreadStart+0x70 4e54ffec 00000000 754429e1 252b2bf8 00000000 ntdll!_RtlUserThreadStart+0x1b

kn output
0:080> kn

ChildEBP RetAddr

00 4e54da80 760594ef ntdll!NtGetContextThread+0x12
01 4e54dac0 75f31e9e KERNELBASE!FindClose+0x93
02 4e54dd98 75bd9c39 kernel32!_SEH_epilog4_GS+0xa
03 4e54ddbc 75bd9c39 msvcrt!_VEC_memzero+0x36
04 4e54ddcc 00000000 msvcrt!_VEC_memzero+0x36

Why this happening and how to resolve it?

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer