事后调试之MiniDump转储

程序发布后，针对在用户使用过程中出现的一些问题进行调试，这个过程可以称为是事后调试。在程序Crash时转储MiniDump文件供软件开发工程师分析是一种比较常用的方法。下面介绍两种常用的在程序Crash时转储MiniDump文件的方法。

1. MiniDumpWriteDump

MiniDumpWriteDump是windows DbgHelp.dll提供的一个转储进程MiniDump的API，可以将其导入到C#程序中。

     using System;
     using System.Diagnostics;
     using System.IO;
     using System.Runtime.InteropServices;
     using System.Threading;

     public class MiniDumpUtil
     {
         [DllImport("kernel32.dll")]
         private static extern int GetCurrentThreadId();

         [DllImport("DbgHelp.dll")]
         private static extern bool MiniDumpWriteDump(IntPtr hProcess, int processId, IntPtr fileHandle, MiniDumpType dumpType, ref MiniDumpExceptionInfo excepInfo, IntPtr userInfo, IntPtr extInfo);

         [DllImport("DbgHelp.dll")]
         private static extern bool MiniDumpWriteDump(IntPtr hProcess, int processId, IntPtr fileHandle, MiniDumpType dumpType, IntPtr excepParam, IntPtr userInfo, IntPtr extInfo);

         public static bool TryWriteMiniDump(string dmpFileName, MiniDumpType dmpType)
         {
             using (FileStream stream = new FileStream(dmpFileName, FileMode.OpenOrCreate))
             {
                 Process process = Process.GetCurrentProcess();
                 MiniDumpExceptionInfo exceptionInfo = new MiniDumpExceptionInfo();
                 exceptionInfo.ThreadId = GetCurrentThreadId();
                 exceptionInfo.ExceptionPointers = Marshal.GetExceptionPointers();
                 exceptionInfo.ClientPointers = true;
                 if (exceptionInfo.ExceptionPointers == IntPtr.Zero)
                 {
                     return MiniDumpWriteDump(process.Handle, process.Id, stream.SafeFileHandle.DangerousGetHandle(), dmpType, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
                 }
                 else
                 {
                     return MiniDumpWriteDump(process.Handle, process.Id, stream.SafeFileHandle.DangerousGetHandle(), dmpType, ref exceptionInfo, IntPtr.Zero, IntPtr.Zero);
                 }
             }
         }
     }

     [Flags]
     public enum MiniDumpType
     {
         MiniDumpNormal = 0x00000000,
         MiniDumpWithDataSegs = 0x00000001,
         MiniDumpWithFullMemory = 0x00000002,
         MiniDumpWithHandleData = 0x00000004,
         MiniDumpFilterMemory = 0x00000008,
         MiniDumpScanMemory = 0x00000010,
         MiniDumpWithUnloadedModules = 0x00000020,
         MiniDumpWithIndirectlyReferencedMemory = 0x00000040,
         MiniDumpFilterModulePaths = 0x00000080,
         MiniDumpWithProcessThreadData = 0x00000100,
         MiniDumpWithPrivateReadWriteMemory = 0x00000200,
         MiniDumpWithoutOptionalData = 0x00000400,
         MiniDumpWithFullMemoryInfo = 0x00000800,
         MiniDumpWithThreadInfo = 0x00001000,
         MiniDumpWithCodeSegs = 0x00002000,
         MiniDumpWithoutAuxiliaryState = 0x00004000,
         MiniDumpWithFullAuxiliaryState = 0x00008000,
         MiniDumpWithPrivateWriteCopyMemory = 0x00010000,
         MiniDumpIgnoreInaccessibleMemory = 0x00020000,
         MiniDumpWithTokenInformation = 0x00040000,
         MiniDumpWithModuleHeaders = 0x00080000,
         MiniDumpFilterTriage = 0x00100000,
         MiniDumpValidTypeFlags = 0x001fffff
     }

     public struct MiniDumpExceptionInfo
     {
         public int ThreadId;
         public IntPtr ExceptionPointers;
         public bool ClientPointers;
     }

这里要注意的一点是当前线程的ID，不能用当前线程的托管线程ID(即Thread.CurrentThread.ManagedThreadId)，而是用当前线程的操作系统ID(即OSID)，否则用windbg加载dump文件时可能会出现一些错误信息：

ERROR: Unable to find system thread 1
ERROR: The thread being debugged has either exited or cannot be accessed
ERROR: Many commands will not work properly

当然，这似乎对调试影响并不是很大，切换线程很容易通过windbg命令完成。

可以简单地在未处理异常中转储进程的MiniDump

     class Program
     {
         static void Main(string[] args)
         {
             AppDomain.CurrentDomain.UnhandledException += new UnhandledExceptionEventHandler(CurrentDomain_UnhandledException);

             TestMethod(-);
         }

         static void CurrentDomain_UnhandledException(object sender, UnhandledExceptionEventArgs e)
         {
             MiniDumpUtil.TryWriteMiniDump("E:\\dump\\test.dmp", MiniDumpType.MiniDumpWithFullMemory);
         }

         static void TestMethod(int num)
         {
             if (num < )
             {
                 throw new ArgumentException("The argument 'num' is less than zero!");
             }
         }
     }

运行程序后，会生成test.dmp文件，用windbg加载该dump文件，设置pdb路径，可以分析异常信息。以下是采用windbg分析输出的一些信息：

Loading Dump File [E:\dump\test.dmp]

User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*

Executable search path is:

Windows 7 Version 7600 MP (4 procs) Free x86 compatible

Product: WinNt, suite: SingleUserTS

Machine Name:

Debug session time: Tue Oct 29 21:42:14.000 2013 (UTC + 8:00)

System Uptime: 0 days 2:42:59.907

Process Uptime: not available

...............................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(168.1474): CLR exception - code e0434352 (first/second chance not available)

eax=fffffffd ebx=038b0d78 ecx=0013d7f8 edx=77886194 esi=038b0d38 edi=0013d898

eip=77886194 esp=0013d558 ebp=0013d568 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

77886194 c3              ret

0:000> .sympath+ E:\dump

Symbol search path is: srv*;E:\dump

Expanded Symbol search path is: cache*;SRV*http://msdl.microsoft.com/download/symbols;e:\dump

0:000> .loadby sos clr

0:000> !pe

Exception object: 017eb58c

Exception type:   System.ArgumentException

Message:          The argument 'num' is less than zero!

InnerException:   <none>

StackTrace (generated):

SP       IP       Function

0013EC98 002B00E6 DumpUtilDemo!DumpUtilDemo.Program.Main(System.String[])+0x76

StackTraceString: <none>

HResult: 80070057

加粗部分是输入的调试命令，具体命令这里不作过多的说明。

2. Windows Error Reporting - Local Dump

Windows系统在 Server 2008， Vista SP1以后的版本中，Windows Error Reporting能够自动转储Crash程序的Dump文件。可以通过修改注册表来设定Dump文件的路径，类型等等。

运行regedit打开注册表，找到注册表项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps ，如果没有可以自己建。这里包括以下几个值：

(1) DumpFolder 转储Dump文件的目录，默认路径为%LOCALAPPDATA%\CrashDumps

(2) DumpCount 最大Dump数，若转储的Dump数超出该限制，则会以最新转储的Dump文件替换最早的

(3) DumpType 即Dump的类型，1-Mini Dump 2-Full Dump 0-Custom Dump

(4) CustomDumpFlags 该值仅在DumpType=0时有效，可以定制转储Dump的内容。可以取前面定义的枚举类型MiniDumpType中某几个值之和，如MiniDumpWithDataSegs | MiniDumpWithUnloadedModules

如果要针对某一个具体的应用程序来设置的话，可以在LocalDumps下面在以应用程序集的名称建一个项，然后同样要设置上述的几个值。

例如，在上面的程序中将转储进程MiniDump的相关代码去掉，在LocalDumps下创建DumpDemo.exe项，设置DumpType=0，CustomDumpFlags=2(即MiniDumpWithFullMemory)，DumpFolder=E:\dump\DumpDemo 。运行程序(DumpDemo.exe)后，在E:\dump\DumpDemo\ 目录下就可以得到一个Dump文件。