How to debug a BSOD failure caused indirectly by a .NET application

We have a .NET application that transfers files from a client workstation to a database on a central server on the local network. Some of our clients run this on Windows XP wireless workstations that use a commercial third-party Wi-Fi encryption mechanism (for various reasons, they do not use standard WiFi encryption such as WPA). Quite consistently, these blue screen workstations when our application is running.

Our application does not directly call unmanaged code, but obviously something that our program does indirectly causes a problem in the underlying network stack. I received a mini-core dump file from one of the infected computers and uploaded it to WinDbg, and he told me that the accident was probably caused by the .sys file, which is one of the driver files for the encryption software (which I already mention suspected). However, the debugger no longer told me anything useful.

My question is: is there a way to get the stack trace from the crash point to our .NET application? Do I need a full memory dump? I have a source for our application, but the fact that a) I do not have a source or characters for the driver in question bothers me; and b) I do not experience low-level debugging of Windows. I do not mind changing our application, if necessary, to avoid problematic calls, if necessary, but I need to know what should be avoided.

+4
source share
2 answers

As noted in the comments, the usermode program cannot invoke the bluescreen screen. Only a kernel-level component can invoke a BSOD. Most likely, it happens that your program accidentally sends data in a certain way that the network driver cannot process, and that causes the BSOD. This is not your program. All kernel drivers must use protective programming methods. Therefore, if a BSOD occurs, this leads to a driver failure. This is one of the main features of the kerenel / usermode separation. It is assumed that usermode cannot do anything that can BSOD in a field.

I understand that the above tip does not always help when you are just trying to fix a problem. Therefore, it would be best to open a dump in windbg and run -v analysis. This will give you a reasonable stack trace (for unmanaged code) and you will see which driver is causing this problem.

If you want to know which thread caused this problem, I'm afraid of your SOL. In principle, it is impossible to know exactly which thread caused this problem, because most likely the packet was stuck in the queue and then processed later. By the time the BSOD box, the thread that queues the packet has already left and done other things.

But if you are super lucky and all the stars are aligned, perhaps you can still have the stream in the same place where the packet was placed in the queue, and you can see if windbg uses SOS dll.

A reasonable helper for getting started with managed debugging with windbg is here: http://blogs.msdn.com/b/alejacma/archive/2009/07/07/managed-debugging-with-windbg-introduction-and-index. aspx

This will not answer all your questions, but it is a decent start and a search on Google, you will get most of the time.

+3
source

In general, this results in a dump file. Download the dump file in windbg and run "-v analysis" and load the appropriate output for further analysis.

-one
source

Source: https://habr.com/ru/post/1392080/


All Articles