WinDGB双机调试.docVIP

假设某台计算机在运行某个驱动时蓝屏（运行代码在WinDbg教程\代码文件夹中）。如下图： 这时我们可以通过WinDGB进行双机调试。首先选择两台电系统之间的通信方式，WinDGB支持串行口、1394、USB三种方式。选择好通信方式后，就可以将合适的电缆插到两台系统的相应端口上。然后在主机上启动WinDBG，在其“File（文件）”选择“Kernel Debug(内核调试)”，或者按“Ctrl+K”。如下图： 在内核调试对话框中选择要与通信电缆和目标机器一致的类型和参数，然后点击“确定”。WinDBG进入等待壮态，等待来自目标系统的调试数据。如下图所示： 连接到目标系统后，第一步是使用 !analyze 扩展命令。该扩展执行大量的自动分析，分析结果在调试器命令窗口中显示。若要数据的全冗长模式显示，还应该使用 -v 选项。这里输入!analyze –v命令，如下图所示： –v命令后的显示： kd !analyze -v ******************************************************************************* * Bugcheck Analysis * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0 This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: The exception code that was not handled Arg2: f8d55578, The address that the exception occurred at Arg3: f8afdb90, Exception Record Address Arg4: f8afd88c, Context Record Address //上面给出了相应的四个参数，第二列是代号，第三列是解释。 Debugging Details: ------------------***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files th