I have been trying to use WinDbg (Microsoft Debugging Tool) to open the dump file and analyze it further.

It comes with Windows SDK. I have downloaded the SDK and while installing, I selected only the Debugging Tool. At first it failed to install properly.

According to the articles found on the net, I uninstalled Microsoft Visual C++ 2010 Redistributable (x64 and x86) version 10.0.40219 from my desktop.

After that I was able to install the Debugging Tool with the help of the SDK installer.

Then I reinstalled the Microsoft Visual C++ 2010 Redistributable x64 by downloading from Microsoft website. However, it now shows the version 10.0.30319

I tried to open the Dump file in Windbg from File -> Open Crash Dump. It gave the error message “ ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll ”. So I tried to setup the symbol file (steps 1 & 2)

1) Added two environmental variables “_NT_ALT_SYMBOL_PATH” and “_NT_SYMBOL_PATH” with the value “srv*c:\Symbols*http://msdl.microsoft.com/download/symbols”.  FYI, I have created the c:\symbols folder separately.

2)Added “SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols;srv*” in File -> Symbol File Path in the tool.

3)Now it does not give the above error message.

However, it does not show all the threads in the dump file. It just shows “ntdll!Zw WaitForSingleObject +0xa:”.

I tried to analyze this thread by running the Windbg command “ !analyze -v ”. But it gave the error message “The version of SOS does not match the version of CLR you are debugging”. So to resolve this issue,

I copied the clr.dll, SOS.dll and mscordacwks.dll from the folder location “C:\Windows\Microsoft.NET\Framework64\v4.0.30319” in our performance test environment frontend server to my local desktop. FYI, I have Visual Studio 2013 Ultimate version in my local desktop.

I then loaded the copied SOS.dll into the Windbg tool by running the command “.load C:\Soumya_Misc\DLL_For_Windbg\qwebbc2\SOS.dll”. This resolved the above issue i.e I do not see the SOS vs CLR version error anymore.

But now when I try to analyze the dump file in the tool, it does not give a proper report. Instead I see “WRONG_SYMBOLS_FILL_PATTERN” in the output. I think the tool is not able to find the correct symbol for the target dll. As per articles on the net, the debugging tool uses the symbols to understand the correct function names.

Kindly help me fixing this issue as I am completely stuck here.

Thanks.

SPAM/Advertising Virus/Spyware/Malware danger Other Term of Use or Code of Conduct violation Child exploitation or abuse Harassment is any behavior intended to disturb or upset a person or group of people. Threats include any threat of suicide, violence, or harm to another. Any content of an adult theme or inappropriate to a community web site. Any image, link, or discussion of nudity. Any behavior that is insulting, rude, vulgar, desecrating, or showing disrespect. Any behavior that appears to violate End user license agreements, including providing product keys or links to pirated software. Unsolicited bulk mail or bulk advertising. Any link to or advocacy of virus, spyware, malware, or phishing sites. Any other inappropriate content or behavior as defined by the Terms of Use or Code of Conduct. Any image, link, or discussion related to child pornography, child nudity, or other child abuse or exploitation.

The public symbol servers are experiencing problems ATM.  You could always upload the DMP file for someone who has a local copy of the symbols

Did you try !thread>dps?

Cat herder
Windows Insider MVP
MVP-Windows and Devices for IT
http://www.zigzag3143.com/ SPAM/Advertising Virus/Spyware/Malware danger Other Term of Use or Code of Conduct violation Child exploitation or abuse Harassment is any behavior intended to disturb or upset a person or group of people. Threats include any threat of suicide, violence, or harm to another. Any content of an adult theme or inappropriate to a community web site. Any image, link, or discussion of nudity. Any behavior that is insulting, rude, vulgar, desecrating, or showing disrespect. Any behavior that appears to violate End user license agreements, including providing product keys or links to pirated software. Unsolicited bulk mail or bulk advertising. Any link to or advocacy of virus, spyware, malware, or phishing sites. Any other inappropriate content or behavior as defined by the Terms of Use or Code of Conduct. Any image, link, or discussion related to child pornography, child nudity, or other child abuse or exploitation.

I get the above output.

After adding "SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols" in Symbol File Path, I could see that a lot of PDB files have been downloaded in C:\Symbols folder. Do you mean to say that perhaps I am not getting all the PDB files? Can you share the local copy of the symbols in case you have one? Do I need to get the application specific PDB files separately from the developers?

Thanks,

SPAM/Advertising Virus/Spyware/Malware danger Other Term of Use or Code of Conduct violation Child exploitation or abuse Harassment is any behavior intended to disturb or upset a person or group of people. Threats include any threat of suicide, violence, or harm to another. Any content of an adult theme or inappropriate to a community web site. Any image, link, or discussion of nudity. Any behavior that is insulting, rude, vulgar, desecrating, or showing disrespect. Any behavior that appears to violate End user license agreements, including providing product keys or links to pirated software. Unsolicited bulk mail or bulk advertising. Any link to or advocacy of virus, spyware, malware, or phishing sites. Any other inappropriate content or behavior as defined by the Terms of Use or Code of Conduct. Any image, link, or discussion related to child pornography, child nudity, or other child abuse or exploitation.

This is not the place to do this.  There are many things you can try but it would be far faster if you uploaded the DMP file

Things you can try

!thread> then parse the base and limit into dps

!sym noisy which will  tell you what you are missing then .reload

I have 125 GB of local symbols because the public servers are slow and unreliable and yes if you have proprietary software that has not submitted symbol files to Microsoft you will need to contact the developer.

Again this is far too complex to do in a forum setting

Cat herder
Windows Insider MVP
MVP-Windows and Devices for IT
http://www.zigzag3143.com/ SPAM/Advertising Virus/Spyware/Malware danger Other Term of Use or Code of Conduct violation Child exploitation or abuse Harassment is any behavior intended to disturb or upset a person or group of people. Threats include any threat of suicide, violence, or harm to another. Any content of an adult theme or inappropriate to a community web site. Any image, link, or discussion of nudity. Any behavior that is insulting, rude, vulgar, desecrating, or showing disrespect. Any behavior that appears to violate End user license agreements, including providing product keys or links to pirated software. Unsolicited bulk mail or bulk advertising. Any link to or advocacy of virus, spyware, malware, or phishing sites. Any other inappropriate content or behavior as defined by the Terms of Use or Code of Conduct. Any image, link, or discussion related to child pornography, child nudity, or other child abuse or exploitation.