debug 64bit dump of a 32bit process in windows 7 64bit
In Windows 7 the TaskMgr provides one easy way to create dump for the applications. You can right click the Application from Applications tab or click the process from Processes tab and click the Create Dump File menu item. The dump files will be created under certain folder soon. Here assume that we created one dump file for one of MaxWell consoles. If you load the dump file into Windbg and type “k” command, you will have below wired output.
0:000> k Child-SP RetAddr Call Site 00000000`0008e2e8 00000000`7458aea8 wow64win+0x3fe3a *** ERROR: Symbol file could not be found. Defaulted to export symbols for wow64.dll - 00000000`0008e2f0 00000000`745dcf87 wow64win+0x1aea8 *** ERROR: Symbol file could not be found. Defaulted to export symbols for wow64cpu.dll - 00000000`0008e350 00000000`74562776 wow64!Wow64SystemServiceEx+0xd7 00000000`0008ec10 00000000`745dd07e wow64cpu!TurboDispatchJumpAddressEnd+0x2d 00000000`0008ecd0 00000000`745dc549 wow64!Wow64SystemServiceEx+0x1ce 00000000`0008ed20 00000000`76e94956 wow64!Wow64LdrpInitialize+0x429 00000000`0008f270 00000000`76e91a17 ntdll!RtlUniform+0x6e6 00000000`0008f760 00000000`76e7c32e ntdll!RtlCreateTagHeap+0xa7 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe |
This callstack looks quite strange to us. What the hell wow64!Wow64LdrpInitialize is?
The reason why we have this strange callstack with this dump file is because we used the 64bit TaskMgr to create one 64bit dump for a 32-bit process. If you use the 64bit application such as 64bit TaskMrg or 64bit WinDBG to create the dump for a 32bit process, you will get a 64bit dump of a 32bit process. But how can we debug this 64bit dump of a 32bit process?
We can make use of WOW64 debugger extension. You can find more information from below link:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa384163(v=vs.85).aspx
0:000> .load wow64exts 0:000> !sw Switched to 32bit mode 0:000:x86> k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0031f280 6d5d88f7 user32!WaitMessage+0x15 0031f2d8 6d5d8741 System_Windows_Forms_ni+0x2088f7 0031f308 6d595911 System_Windows_Forms_ni+0x208741 0031f320 70f86739 System_Windows_Forms_ni+0x1c5911 0031f350 02341b4c NewConsole_ni+0x6739 0031f360 02358951 mscorwks+0x1b4c 0031f3e0 02375fbd mscorwks+0x18951 0031f518 02375ff0 mscorwks!CoUninitializeEE+0x11861 0031f534 0237600e mscorwks!CoUninitializeEE+0x11894 0031f54c 02414675 mscorwks!CoUninitializeEE+0x118b2 |
Windows also provides one 32bit TaskMgr which is C:\Windows\SysWOW64\taskmgr.exe. You can create a 32bit dump for 32bit process. With that 32bit dump we don’t need the WOW64 extension when we loaded it into WinDBG.
debug 64bit dump of a 32bit process in windows 7 64bit的更多相关文章
- Can't load IA 32-bit .dll on a AMD 64-bit platform错误的解决
64位的系统,64位的myeclipse,64位的jdk,64位的tomcat,结果报错:Can't load IA 64-bit .dll on a AMD 32-bit platform,简直无语 ...
- java.lang.UnsatisfiedLinkError: C:\apache-tomcat-8.0.21\bin\tcnative-1.dll: Can't load IA 32-bit .dll on a AMD 64-bit platform
Tomcat启动报错: 25-Mar-2016 10:40:43.478 SEVERE [main] org.apache.catalina.startup.Catalina.stopServer C ...
- MyEclipse: Can't load IA 32-bit .dll on a AMD 64-bit platform
java.lang.UnsatisfiedLinkError: D:\Tomcat7\apache-tomcat-7.0.59\bin\tcnative-1.dll: Can't load IA 32 ...
- java.lang.UnsatisfiedLinkError: D:\Tomcat-7.0.59\apache-tomcat-7.0.59\bin\tcnative-1.dll: Can't load IA 32-bit .dll on a AMD 64-bit platform
今日上午用Tomcat运行一个小项目,报出以下异常信息: java.lang.UnsatisfiedLinkError: D:\Tomcat-7.0.59\apache-tomcat-7.0.59\b ...
- Convert Windows 32bit dirver to Windows 64bit
Pre-condition: 1.source code(vc6.0+WDK based) Development environment: 2.VS2013 3.WDK 8/8.1 Steps: 1 ...
- Tomcat:Can't load IA 32-bit .dll on a AMD 64-bit platform问题的解决
控制台错误如下: java.lang.UnsatisfiedLinkError: D:\apache-tomcat-7.0.56\bin\tcnative-1.dll: Can't load IA 3 ...
- 错误:C:\Windows\System32\ssleay32.dll: Can't load IA 32-bit .dll on a AMD 64-bit
错误:C:\Windows\System32\ssleay32.dll: Can't load IA 32-bit .dll on a AMD 64-bit 错误的原因是:jdk不是64位的,而是32 ...
- Can't load IA 32-bit .dll on a AMD 64-bit platform
在myeclipse中使用的,tomcat异常:java.lang.UnsatisfiedLinkError: D:\JAVA\ApacheTomcat\bin\tcnative-1.dll: Can ...
- 解决Tomcat: Can't load IA 32-bit .dll on a AMD 64-bit platform 问题
错误如下: java.lang.UnsatisfiedLinkError: E:\Program Files\MyEclipse 10\apache-tomcat-7.0.23\bin\tcnativ ...
随机推荐
- Cookie工具类 - CookieUtil.java
Cookie工具类,提供Cookie的创建.获取.删除方法. 源码如下:(点击下载 -CookieUtil.java ) import javax.servlet.http.Cookie; impor ...
- poj 1742 Coins (多重背包)
http://poj.org/problem?id=1742 n个硬币,面值分别是A1...An,对应的数量分别是C1....Cn.用这些硬币组合起来能得到多少种面值不超过m的方案. 多重背包,不过这 ...
- file的这几个取得path的方法各有不同,下边说说详细的区别
html, body { font-size: 15px; } body { font-family: Helvetica, "Hiragino Sans GB", 微软雅黑, & ...
- SOCKSify Ruby
http://socksify.rubyforge.org/ What is it? SOCKSify Ruby redirects any TCP connection initiated by a ...
- Android开源库--SlidingMenu左右侧滑菜单
如果说我比别人看得更远些,那是因为我站在了巨人的肩上. github地址:https://github.com/jfeinstein10/SlidingMenu 设置: 1.下载之后以依赖项的 ...
- CSS控制背景
一.设置背景颜色:background-color 十六进制 background-color:#ff0000; 英文名称 background-color:red; 三原色 background-c ...
- UVa 514 (stack的使用) Rails
练习一下stack的使用,还有要注意一下输入的格式,看了好长时间没懂. //#define LOCAL #include <iostream> #include <cstdio> ...
- Flume环境部署和配置详解及案例大全
flume是一个分布式.可靠.和高可用的海量日志采集.聚合和传输的系统.支持在日志系统中定制各类数据发送方,用于收集数据;同时,Flume提供对数据进行简单处理,并写到各种数据接受方(比如文本.HDF ...
- ffmpeg命令学习
1.组成 程序:ffmpeg.ffplay.ffprobe.ffserverffmpeg:转码程序ffplay:播放程序ffserver:服务器程序 库:libavcodec.libavdevice. ...
- HDU 5353 Average 糖果分配(模拟,图)
题意:有n个人坐在圆桌上,每个人带着糖果若干,每次只能给旁边的人1科糖果,而且坐相邻的两个人最多只能给一次(要么你给我,要么我给你),问是否能将糖果平均分了. 思路: 明显每个人最多只能多于平均值2个 ...