Discussion:
NEWBIE: crashed process, what dll contains the crashing code?
(too old to reply)
u***@yahoo.com
2010-08-27 15:38:14 UTC
Permalink
Raw Message
Hello,

I am monitoring the "Computer Browser" service via a jscript polling
the WMI Win32_Service class.

Sometime the "Computer Browser" service unexpectedly stopped itself
and the ExitCode property of Win32_Service class is set to
"ERROR_PROCESS_ABORTED 1067 (0x42B) The process terminated
unexpectedly."

"Computer Browser" service is hosted inside svchost.exe and this
process loads many dlls, is there any way to recognize what dlls is
containing the crashing code?

Maybe I can attach windbg to the proper svchost and, in some way,
having it break when the crash occurs?

Thank you very much.
Alessandro
Hans De Smaele
2010-09-29 11:16:03 UTC
Permalink
Raw Message
Hi,

you can use ADPLUS to attach the debugger engine to the process.
ADPLUS exists as a script and (at least in the latest releases of the
debugging tools for windows) as an executable.
Run ADPLUS with -p <PID> -crash parameters (see documentation) to attach the
debugger. When your application crashes (use tlist /v to find the proper PID
for the svchost you want to monitor), analyze the dump in WinDbg, using the
!analyze -v command as a starting point.

Good luck.

"***@yahoo.com" wrote:

> Hello,
>
> I am monitoring the "Computer Browser" service via a jscript polling
> the WMI Win32_Service class.
>
> Sometime the "Computer Browser" service unexpectedly stopped itself
> and the ExitCode property of Win32_Service class is set to
> "ERROR_PROCESS_ABORTED 1067 (0x42B) The process terminated
> unexpectedly."
>
> "Computer Browser" service is hosted inside svchost.exe and this
> process loads many dlls, is there any way to recognize what dlls is
> containing the crashing code?
>
> Maybe I can attach windbg to the proper svchost and, in some way,
> having it break when the crash occurs?
>
> Thank you very much.
> Alessandro
> .
>
Loading...