can we get the penultimate exception that occurred from an mdmp or hdmp in windbg

Question

Hi,

I got a crash dump (both mdmp and hdmp) for my application (written in C++) captured using dr. watson. After analyzing the dumps through windbg, I concluded that the crash had occurred in the catch() itself :)

What I need to know is what exception caused the the failure in the first place i.e. I need that penultimate(last but one th) exception that had occurred.

I know I could get the same by some other ways, but is there a specific command with which we could get the list of errors\exceptions occurring from the dump file.

Thanks.

--Samrat Patil

Answer 1

what i usually do is issue the search command looking for specific CONTEXT flags:

s-d esp l10000 1003f

the search is usually performed with the current value of esp as a starting point. Once you're lucky you get back a bunch of addresses on stack you can further use as parameters for .cxr. The addresses (if several) can be followed to trace the exception flow.

Once the new context is set, it is usually trivial to see where a particular exception is thrown.