最近接到用户的投诉，在Windows 7 32位的机器上，UMDF驱动频繁崩溃，关键是SetUnhandledExceptionFilter 设置的异常过滤竟然一丁点用都没有，查询了半天，才注意到UMDF框架把UnhandledException接管了，你完全是无力反抗。
然后去MSDN上查询，根据Determining Why the Reflector Terminated the Host Process微软文档，WER会在“%windir%\system32\LogFiles\WUDF”目录下面生成DUMP文件，测试之后发现，是否生成完全依赖WER的心情，捣鼓到后来，干脆完全不生成DUMP文件了，另外他偶尔生成的也都是MiniDump ，作用有限。“Users\All Users\Microsoft\Windows\WER\ReportQueue”目录下面的报告数据，也是时有时无，阴晴不定。
继续Google，微软文档 Collecting User-Mode Dumps 设置如下的注册表
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps] "DumpType"=dword:00000001 "DumpCount"=dword:0000000A "DumpFolder"="D:\\Temp" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps] "DumpType"=dword:00000001 "DumpCount"=dword:0000000A "DumpFolder"="D:\\Temp" [HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps] "DumpType"=dword:00000001 "DumpCount"=dword:0000000A "DumpFolder"="D:\\Temp" |
这样设置之后，正常的应用都可以在D:\Temp 下面生成崩溃记录，但是WUDFHost.exe 就是不能生成崩溃DUMP，貌似是WUDFHost.exe 用其他低权限用户账户运行，导致没办法生成转储文件。
继续Google，ProcDump进入视野，着实是个好的工具软件，非常好用。于是写了个批处理文件来跟踪WUDFHost.exe的异常。
|
1 |
procdump -ma -e WUDFHost.exe |
应用崩溃的时候，会在当前目录下面生产对应的.dmp文件。
下面为简单的用法例子
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 |
Using ProcDump usage: procdump [-a] [[-c|-cl CPU usage] [-u] [-s seconds]] [-n exceeds] [-e [1 [-b]] [-f <filter,...>] [-g] [-h] [-l] [-m|-ml commit usage] [-ma | -mp] [-o] [-p|-pl counter threshold] [-r] [-t] [-d <callback DLL>] [-64] <[-w] <process name or service name or PID> [dump file] | -i <dump file> | -u | -x <dump file> <image file> [arguments] >] [-? [ -e] -a Avoid outage. Requires -r. If the trigger will cause the target to suspend for a prolonged time due to an exceeded concurrent dump limit, the trigger will be skipped. -b Treat debug breakpoints as exceptions (otherwise ignore them). -c CPU threshold at which to create a dump of the process. -cl CPU threshold below which to create a dump of the process. -d Invoke the minidump callback routine named MiniDumpCallbackRoutine of the specified DLL. -e Write a dump when the process encounters an unhandled exception. Include the 1 to create dump on first chance exceptions. -f Filter the first chance exceptions. Wildcards (*) are supported. To just display the names without dumping, use a blank ("") filter. -g Run as a native debugger in a managed process (no interop). -h Write dump if process has a hung window (does not respond to window messages for at least 5 seconds). -i Install ProcDump as the AeDebug postmortem debugger. Only -ma, -mp, -d and -r are supported as additional options. -l Display the debug logging of the process. -m Memory commit threshold in MB at which to create a dump. -ma Write a dump file with all process memory. The default dump format only includes thread and handle information. -ml Trigger when memory commit drops below specified MB value. -mp Write a dump file with thread and handle information, and all read/write process memory. To minimize dump size, memory areas larger than 512MB are searched for, and if found, the largest area is excluded. A memory area is the collection of same sized memory allocation areas. The removal of this (cache) memory reduces Exchange and SQL Server dumps by over 90%. -n Number of dumps to write before exiting. -o Overwrite an existing dump file. -p Trigger on the specified performance counter when the threshold is exceeded. Note: to specify a process counter when there are multiple instances of the process running, use the process ID with the following syntax: "\Process(<name>_<pid>)\counter" -pl Trigger when performance counter falls below the specified value. -r Dump using a clone. Concurrent limit is optional (default 1, max 5). CAUTION: a high concurrency value may impact system performance. Windows 7 : Uses Reflection. OS doesn't support -e. Windows 8.0 : Uses Reflection. OS doesn't support -e. Windows 8.1+: Uses PSS. All trigger types are supported. -s Consecutive seconds before dump is written (default is 10). -t Write a dump when the process terminates. -u Treat CPU usage relative to a single core (used with -c). As the only option, Uninstalls ProcDump as the postmortem debugger. -w Wait for the specified process to launch if it's not running. -x Launch the specified image with optional arguments. If it is a Store Application or Package, ProcDump will start on the next activation (only). -64 By default ProcDump will capture a 32-bit dump of a 32-bit process when running on 64-bit Windows. This option overrides to create a 64-bit dump. Only use for WOW64 subsystem debugging. -? Use -? -e to see example command lines. If you omit the dump file name, it defaults to <processname>_<datetime>.dmp. Use the -accepteula command line option to automatically accept the Sysinternals license agreement. Examples Write a mini dump of a process named 'notepad' (only one match can exist): C:\>procdump notepad Write a full dump of a process with PID '4572': C:\>procdump -ma 4572 Write 3 mini dumps 5 seconds apart of a process named 'notepad': C:\>procdump -s 5 -n 3 notepad Write up to 3 mini dumps of a process named 'consume' when it exceeds 20% CPU usage for five seconds: C:\>procdump -c 20 -s 5 -n 3 consume Write a mini dump for a process named 'hang.exe' when one of it's Windows is unresponsive for more than 5 seconds: C:\>procdump -h hang.exe hungwindow.dmp Write a mini dump of a process named 'outlook' when total system CPU usage exceeds 20% for 10 seconds: C:\>procdump outlook -p "\Processor(_Total)\% Processor Time" 20 Write a full dump of a process named 'outlook' when Outlook's handle count exceeds 10,000: C:\>procdump -ma outlook -p "\Process(Outlook)\Handle Count" 10000 Write a MiniPlus dump of the Microsoft Exchange Information Store when it has an unhandled exception: C:\>procdump -mp -e store.exe Display without writing a dump, the exception codes/names of w3wp.exe: C:\>procdump -e 1 -f "" w3wp.exe Write a mini dump of w3wp.exe if an exception's code/name contains 'NotFound': C:\>procdump -e 1 -f NotFound w3wp.exe Launch a process and then monitor it for exceptions: C:\>procdump -e 1 -f "" -x c:\dumps consume.exe Register for launch, and attempt to activate, a modern 'application'. A new ProcDump instance will start when it activated to monitor for exceptions: C:\>procdump -e 1 -f "" -x c:\dumps Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps Register for launch of a modern 'package'. A new ProcDump instance will start when it is (manually) activated to monitor for exceptions: C:\>procdump -e 1 -f "" -x c:\dumps Microsoft.BingMaps_1.2.0.136_x64__8wekyb3d8bbwe Register as the Just-in-Time (AeDebug) debugger. Makes full dumps in c:\dumps. C:\>procdump -ma -i c:\dumps See a list of example command lines (the examples are listed above): C:\>procdump -? -e |