Using windbg for the first time to debug a process which shuts down without warning

Question

Hi,

I have a process which, when I click on a button on its UI, launches another process. This process it spawns shuts down without warning or any clues in the logs.

How should I use windbg to understand this problem? Furthermore, what do I put for the symbol files path? To download the symbols from the MS symbolserver. I am not sure if I need to set an env variable, too.

Thanks

Answer 1

Here's how to find the symbols: http://support.microsoft.com/kb/311503 .

Generally, the easiest way to do this is to set an environment variable:

_NT_SYMBOL_PATH=SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Make sure you start Windbg AFTER you've set the environment variable, and bear in mind that recent versions of VS will also use this environment variable, so their debugging will tend to be slower to start.

My first step would to try and separate the two processes - can you start the failing one directly, in such a way as it fails?

Silent quitting is often a sign of one of these:

• a stack overflow (infinite recursion)
• an exception in an exception handler (sometimes)
• Messing with the main window setup sequence in WPF apps.

Answer 2

You can attach to the created process by setting an option in windbg that'll attach to any process that is created by the current process. Use ".child_dbg 1" (not sure about the exact command name). Once you have launched the UI process in windbg, just click on the button as usual and let the process get created. This will break in windbg. Once it does, just use "g" command to let the process continue. Whenever the child process exits, you'll get a notification in the debugger. You can thus figure out the cause of process exit.

If that doesn't help (if the process exits normally using exitprocess or is terminated using TerminateProcess), you can put breakpoints at exit functions and check the callstack.