Debugging a Crash Dump

Rajinder Yadav - C++ Windows Development Tools & Resources :Design, Code, Test, Debug

Debugging Using a Crash Dump with Dr. Watson - Page 1

Author: Rajinder Yadav
Date: April 19, 2007

Introduction

This article will quickly walk you through on learning how to analyze a crash dump. We're going to use the Dr. Watson utility to capture a crash dump. I'll first show you how to setup Dr. Watson, then will build a test app and learn how to set the proper compiler setting to produce the symbols files that will be required for us to debug the crash. I will be using Visual Studio 2005 for this demonstration the steps for your vendor's compiler should be similar.

Setting up Dr. Watson

Let's first start off by creating a crash_dump folder under the "C:" drive

C:\crash_dump\

From the Start menu, click on the "Run", or use the shortcut [WIN]+R, type in "drwtsn32" to run the Dr. Watson utility.

1. Make sure to set both the "Log File Path" and "Crash Dump" to point to the location "C:\crash_dump"

2. Set the crash dump type to "mini" and check the displayed options.

Click Ok

What we've done here is set the error handler.

When a program error occurs in Windows, the system searches for a program error handler. A program error handler deals with errors as they arise during the running of a program. If the system does not find a program error handler, the system verifies that the program is not currently being debugged and considers the error to be unhandled. The system then processes unhandled errors by looking in Registry Editor for a program error debugger.

3. We need to install Dr. Watson as the default debugger.

To do this go to the Run menu and type in "drwtsn32 -i" and click OK.

This causes the following registry entries to be made in

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug

For more info on the settings see Dr. Watson help file, here is an extract. Which you can skip as it's not important for the most part.

The system looks in Registry Editor under the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug for the entries named Debugger and Auto. The value for the Debugger entry specifies the command for the debugger that will be used to analyze program errors. If the value for the Debugger entry is found, the system checks to see if the value for the Auto entry is set to zero or one.

If the value for the Auto entry is set to zero, the system generates a message box that notifies you that a program error has occurred. If the value for the Debugger entry specifies the command for a valid debugger, the message box will display two buttons: OK and Cancel. If you click OK, the program is terminated. If you click Cancel, the specified debugger is started. If the value for the Debugger entry is empty, the message box will display only OK, and no debugger will start.

If the value for the Auto entry is set to one and the value for the Debugger entry specifies the command for a valid debugger, the system automatically starts the debugger and does not generate a message box.

When Windows is set up on your system, the value for the Auto entry is set by default to one and the value for the Debugger entry specifies the command to start Dr. Watson. This means that when a program error occurs, Dr. Watson for Windows will automatically diagnose the error and log the appropriate diagnostic information.

NOTE: The following switches can be used with Dr. Watson

Once Dr. Watson has been setup as the default debugger (error handler). We need to configure our project to create a symbol file that will be required for debugging the crash. All the projects you create, make sure to follow these compiler setting, and to save you debug symbol along with the executable after each build.

Page 1 Page 2 Page 3 Page 4 Home