Windows 10: Need help to understand WinDbg Preview Analysis

DV Telecom · Jun 11, 2020

Hi,

Could you please help me to investigate the issue below?

When trying to sign out from Cisco Jabber application, click doesn't work or it takes time kind of application freezing issue.

I took full dump on Jabber and use WinDbg Preview to analyse this problem.

Here is the output of my WinDbg Preview:

OS: Windows 10 Enterprise

Version: 1809

*******************************************************************************

* *
* Exception Analysis *
* *
*******************************************************************************

KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullClassPtr

Key : AV.Fault
Value: Read

Key : Analysis.CPU.Sec
Value: 25

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on LAPTOP-REVMN1U3

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 38

Key : Analysis.Memory.CommitPeak.Mb
Value: 174

Key : Analysis.System
Value: CreateObject

Key : Timeline.OS.Boot.DeltaSec
Value: 175455

Key : Timeline.Process.Start.DeltaSec
Value: 175345

ADDITIONAL_XML: 1

NTGLOBALFLAG: 0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: .ecxr
eax=38fffa0c ebx=00000000 ecx=00000000 edx=00000000 esi=47c413c8 edi=ffffffff
eip=67151ac8 esp=38fff9f8 ebp=38fffa18 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+0xd22e:
67151ac8 8b4308 mov eax,dword ptr [ebx+8] ds:002b:00000008=????????
Resetting default scope

EXCEPTION_RECORD: .exr -1
ExceptionAddress: 67151ac8 common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+0x0000d22e
ExceptionCode: c0000005 Access violation
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008

PROCESS_NAME: CiscoJabber.exe

READ_ADDRESS: 00000008

ERROR_CODE: NTSTATUS 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000008

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
38fffa18 67151a2a 3c177fe0 47c413c8 00000014 common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+0xd22e
38fffa54 66a0ff9c 38fffa20 00000014 35254a58 common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+0xd190
38fffb48 66a88f59 3289be9e 480ff270 480ff270 enhanced_callcontrol_MD!csf::ecc::CC_SIPCCCall::getIxCall+0x125d4c
38fffcf4 67191fa5 671425ef 7625738f 2bce0760 enhanced_callcontrol_MD!csf::ecc::VideoLayoutEnum::toString+0x64479
38fffd34 77330419 3c346790 77330400 38fffda0 common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+0x4d70b
38fffd90 774c88bf f6856cb8 00000000 38fffdb0 kernel32!BaseThreadInitThunk+0x19
38fffda8 774d53d3 00000000 00000000 76257350 ntdll!wcstombs+0x6f
38fffdac 00000000 00000000 76257350 3c346790 ntdll!FinalExceptionHandlerPad51

SYMBOL_NAME: common_MD!csf::ecc:perator==<char,csf::ecc::SafeAllocator<char> >+d22e

MODULE_NAME: common_MD

IMAGE_NAME: common_MD.dll

STACK_COMMAND: ~196s ; .ecxr ; kb

FAILURE_BUCKET_ID: NULL_CLASS_PTR_READ_c0000005_common_MD.dll!csf::ecc:perator==_char,csf::ecc::SafeAllocator_char___

OSPLATFORM_TYPE: x86

OSNAME: Windows 8

FAILURE_ID_HASH: {0d28b898-7945-a7b6-9e17-024bc57709d4}

Followup: MachineOwner
---------

:)

bitp · Jun 11, 2020

WinDBG-all apps

Hi, very good your post and thank you for such information, i followed all the steps but i got this message when trying to set the path for the symbols.

please help, thanks!!

Brink · Jun 11, 2020

New WinDbg available in preview for Windows 10

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

We are excited to announce a preview version of a brand new WinDbg. We've updated WinDbg to have more modern visuals, faster windows, a full-fledged scripting experience, built with the easily extensible debugger data model front and center. I'll start this by saying that WinDbg Preview is using the same underlying engine as WinDbg today, so all the commands, extensions, and workflows you're used to will still work just as they did before.

Getting started

I know a lot of you are going to want to dive right in and try it out, here are the things you should know before doing so.

Installation - You can install the WinDbg Preview from the store if you have Windows 10 Anniversary Update or newer at https://www.microsoft.com/en-us/stor...g/9pgjgd53tn86 - WinDbg Preview uses some features from the Windows 10 Anniversary Update, so that’s required for now. The Windows Store lets us release bug fixes and updates to you faster than we've ever been able to before, so make sure to stayed tuned to our blog and MSDN to learn the latest about the preview.

Feedback - Familiarize yourself a bit with the Feedback Hub! We've still got a long way to go before we cover all WinDbg features, and we'll be using the Feedback Hub to help us prioritize what you want us to work on! The Windows Insider website has a great overview on how to give good feedback - Good feedback makes Windows better | Windows 10 Insider Previews Once you've read that, just hit the 'Feedback Hub' button on the home ribbon.

Questions - You're bound to have a lot of questions feel free to post them on this blog post, send feedback in the Feedback Hub, or tweet @aluhrs13 and I'll do my best to answer. We'll be posting an FAQ on our blog sometime in the upcoming weeks.

Documentation - We've got some early documentation up on MSDN that's preliminary and subject to change at Debugging Using WinDbg Preview - Windows drivers | Microsoft Docs, you can give us feedback or propose edits to that documentation by hitting "Comments" or "Edit" on any page. Also keep your eyes on our MSDN blog - Debugging Tools for Windows - for more updates and tips.

Videos - We went to the Channel 9 studio and recorded a couple episodes of Defrag Tools to help explain some of the basics of WinDbg Preview.

Defrag Tools #182 - Tim, Chad, and I go over the basics of WinDbg Preview and some of the features

Defrag Tools #183 - Nick, Tim, and Chad use WinDbg Preview and go over a quick demo

Coming Soon - Defrag Tools #184 - Bill and Andrew walk through the scripting features in WinDbg Preview

What's New

There are a lot of major changes, some of them under the hood and some of them really obvious. Here are my favorites or the things that people have told me they like the best.

Less intimidating

One of the words people often use to describe WinDbg is "intimidating". When you first open it, you get a dull gray screen and very little indication of what to do next. Once you're going, outside of the stepping icons, it's difficult to tell what toolbar button or menu is what you want. With WinDbg Preview we've taken a few steps to make it a bit easier for beginners.

Ribbon - Ribbons are great when icons don't do a great job of describing an action, and when there are a lot of different contextual actions that are only relevant sometimes. Right now our ribbon is pretty barebones with the basics, but over time we'll be adding more ribbons for specific contexts while you're debugging.

Re-worked file menu - The new file menu makes it much more clear which options you have for starting and configuring your debugging session. The attach dialog is much cleaner and more organized now and there's even a new option to launch your Store App or background tasks without needing to set it up with PLMDebug.exe.

Familiar source windows - Source windows now are better in pretty much every way and should look more like to the source windows you're used to seeing in every other modern editor.

Quality of life improvements

WinDbg has gone a long time without any major quality of life improvements or modernizations. This has led a lot of people to doing registry hacks to get a prettier theme, or having a dozen icons pinned to their taskbar for each thing they debug often. We've taken some of these work-arounds and made them easy to access.

Dark theme - This one is pretty self-explanatory, a lot of people use dark themes in their editors, and then flip over to the glaring brightness of WinDbg. Now it can match!

Recent targets - Instead of having to have your KDNET key and IP on a sticky-note on your monitor, WinDbg Preview will now remember all your recent sessions and some of the settings that you had during that session. You can quickly access them again from the recent targets list in the file menu.

Various window improvements - Many windows have gone a while without updates or just have glaring bugs. Some of the notable things we've done differently are that the disassembly window keeps its highlighting in the right spot when scrolled, and the memory window has better highlighting and scrolling. Many windows are also asynchronous now and loading can be cancelled by running another command.

Data model front and center

Hopefully you've heard about the debugger data model by now. If you haven't check out some of my older blog posts at https://blogs.msdn.microsoft.com/windbg and our MSDN docs linked above. Up until now, the data model was only accessible through JavaScript and the dx command. With WinDbg Preview we're putting the data model under the vast majority of what you see, making it much more extensible.

Extensible locals and watch - The data model is now powering the locals and watch windows. NatVis and JavaScript extensions that extend the data model will be reflected in those windows. You can even put LINQ queries into the watch window!

Model windows - There's a new type of window called a model window. Model windows will show the results of any model query in a normal hierarchy view or a table. You'll see in the FAQ that WinDbg Preview doesn't have a modules window, you can use a model window to make your own with @$cursession.Modules! This also has the benefit that if you make a JavaScript extension that extends modules, it'll automatically update your window.

Built-in scripting environment - One of the biggest complaints with scripting and extending the debugger is having to go into an IDE to write and iterate on it with WinDbg Preview you can write and execute your JavaScript and NatVis directly from the debugger. The script window has error highlighting, IntelliSense, and easier execution of scripts.

Restrictions and other things worth noting

While we've got that big list of what's new and awesome, this is still a preview, so there's some things that you should be aware of.

At this point in the preview, we're only offering WinDbg Preview through the Windows Store. That means only devices running Windows 10 Anniversary Update can install it.

You might hit errors when trying to do something that requires elevation. You'll have to manually launch WinDbg Preview elevated.

The concept of a workspace is going to be changing a lot. A workspace in WinDbg Preview is vastly different from one in WinDbg. The MSDN documentation linked above has more information.

That's where we are today. The core experiences are there and we'll be releasing improvements faster than our normal pace now in that we're shipping from the Windows Store. Please don't hesitate to send us feedback and feature requests in the Feedback Hub or in the comments below, we want your input as we move forward!

-Andy Luhrs
Click to expand...

Source: New WinDbg available in preview! Debugging Tools for Windows

Brink · Jun 11, 2020

New WinDbg available in preview for Windows 10

Tweet

— Twitter API (@user) View on Twiiter[/quote]

We are excited to announce a preview version of a brand new WinDbg. We've updated WinDbg to have more modern visuals, faster windows, a full-fledged scripting experience, built with the easily extensible debugger data model front and center. I'll start this by saying that WinDbg Preview is using the same underlying engine as WinDbg today, so all the commands, extensions, and workflows you're used to will still work just as they did before.

Getting started

I know a lot of you are going to want to dive right in and try it out, here are the things you should know before doing so.

Installation - You can install the WinDbg Preview from the store if you have Windows 10 Anniversary Update or newer at https://www.microsoft.com/en-us/stor...g/9pgjgd53tn86 - WinDbg Preview uses some features from the Windows 10 Anniversary Update, so that’s required for now. The Windows Store lets us release bug fixes and updates to you faster than we've ever been able to before, so make sure to stayed tuned to our blog and MSDN to learn the latest about the preview.

Feedback - Familiarize yourself a bit with the Feedback Hub! We've still got a long way to go before we cover all WinDbg features, and we'll be using the Feedback Hub to help us prioritize what you want us to work on! The Windows Insider website has a great overview on how to give good feedback - Good feedback makes Windows better | Windows 10 Insider Previews Once you've read that, just hit the 'Feedback Hub' button on the home ribbon.

Questions - You're bound to have a lot of questions feel free to post them on this blog post, send feedback in the Feedback Hub, or tweet @aluhrs13 and I'll do my best to answer. We'll be posting an FAQ on our blog sometime in the upcoming weeks.

Documentation - We've got some early documentation up on MSDN that's preliminary and subject to change at Debugging Using WinDbg Preview - Windows drivers | Microsoft Docs, you can give us feedback or propose edits to that documentation by hitting "Comments" or "Edit" on any page. Also keep your eyes on our MSDN blog - Debugging Tools for Windows - for more updates and tips.

Videos - We went to the Channel 9 studio and recorded a couple episodes of Defrag Tools to help explain some of the basics of WinDbg Preview.

Defrag Tools #182 - Tim, Chad, and I go over the basics of WinDbg Preview and some of the features

Defrag Tools #183 - Nick, Tim, and Chad use WinDbg Preview and go over a quick demo

Coming Soon - Defrag Tools #184 - Bill and Andrew walk through the scripting features in WinDbg Preview

What's New

There are a lot of major changes, some of them under the hood and some of them really obvious. Here are my favorites or the things that people have told me they like the best.

Less intimidating

One of the words people often use to describe WinDbg is "intimidating". When you first open it, you get a dull gray screen and very little indication of what to do next. Once you're going, outside of the stepping icons, it's difficult to tell what toolbar button or menu is what you want. With WinDbg Preview we've taken a few steps to make it a bit easier for beginners.

Ribbon - Ribbons are great when icons don't do a great job of describing an action, and when there are a lot of different contextual actions that are only relevant sometimes. Right now our ribbon is pretty barebones with the basics, but over time we'll be adding more ribbons for specific contexts while you're debugging.

Re-worked file menu - The new file menu makes it much more clear which options you have for starting and configuring your debugging session. The attach dialog is much cleaner and more organized now and there's even a new option to launch your Store App or background tasks without needing to set it up with PLMDebug.exe.

Familiar source windows - Source windows now are better in pretty much every way and should look more like to the source windows you're used to seeing in every other modern editor.

Quality of life improvements

WinDbg has gone a long time without any major quality of life improvements or modernizations. This has led a lot of people to doing registry hacks to get a prettier theme, or having a dozen icons pinned to their taskbar for each thing they debug often. We've taken some of these work-arounds and made them easy to access.

Dark theme - This one is pretty self-explanatory, a lot of people use dark themes in their editors, and then flip over to the glaring brightness of WinDbg. Now it can match!

Recent targets - Instead of having to have your KDNET key and IP on a sticky-note on your monitor, WinDbg Preview will now remember all your recent sessions and some of the settings that you had during that session. You can quickly access them again from the recent targets list in the file menu.

Various window improvements - Many windows have gone a while without updates or just have glaring bugs. Some of the notable things we've done differently are that the disassembly window keeps its highlighting in the right spot when scrolled, and the memory window has better highlighting and scrolling. Many windows are also asynchronous now and loading can be cancelled by running another command.

Data model front and center

Hopefully you've heard about the debugger data model by now. If you haven't check out some of my older blog posts at Debugging Tools for Windows and our MSDN docs linked above. Up until now, the data model was only accessible through JavaScript and the dx command. With WinDbg Preview we're putting the data model under the vast majority of what you see, making it much more extensible.

Extensible locals and watch - The data model is now powering the locals and watch windows. NatVis and JavaScript extensions that extend the data model will be reflected in those windows. You can even put LINQ queries into the watch window!

Model windows - There's a new type of window called a model window. Model windows will show the results of any model query in a normal hierarchy view or a table. You'll see in the FAQ that WinDbg Preview doesn't have a modules window, you can use a model window to make your own with @$cursession.Modules! This also has the benefit that if you make a JavaScript extension that extends modules, it'll automatically update your window.

Built-in scripting environment - One of the biggest complaints with scripting and extending the debugger is having to go into an IDE to write and iterate on it with WinDbg Preview you can write and execute your JavaScript and NatVis directly from the debugger. The script window has error highlighting, IntelliSense, and easier execution of scripts.

Restrictions and other things worth noting

While we've got that big list of what's new and awesome, this is still a preview, so there's some things that you should be aware of.

At this point in the preview, we're only offering WinDbg Preview through the Windows Store. That means only devices running Windows 10 Anniversary Update can install it.

You might hit errors when trying to do something that requires elevation. You'll have to manually launch WinDbg Preview elevated.

The concept of a workspace is going to be changing a lot. A workspace in WinDbg Preview is vastly different from one in WinDbg. The MSDN documentation linked above has more information.

That's where we are today. The core experiences are there and we'll be releasing improvements faster than our normal pace now in that we're shipping from the Windows Store. Please don't hesitate to send us feedback and feature requests in the Feedback Hub or in the comments below, we want your input as we move forward!

-Andy Luhrs
Click to expand...

Windows 10: Need help to understand WinDbg Preview Analysis

Need help to understand WinDbg Preview Analysis

Need help to understand WinDbg Preview Analysis

Need help to understand WinDbg Preview Analysis

Need help to understand WinDbg Preview Analysis - Similar Threads - Need help understand

Help Understanding Memory.DMP WinDbg Analysis

Help Understanding Memory.DMP WinDbg Analysis

Help understanding WinDbg Minidump debug

Help understanding WinDbg Minidump debug

Help me out to understand the reason of GSOD on my laptop via WINDBG analysis

Help me out to understand the reason of GSOD on my laptop via WINDBG analysis

Help me out to understand the reason of GSOD on my laptop via WINDBG analysis

WinDbg Analysis

WinDbg Analysis