A customer is attempting to capture a minidump of a hang. He fires up WindDbg and successfully attaches to the process. WinDbg displays its header:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
and the loaded modules are enumerated.
He enters a dump command:
.dump /m c:\problem.dmp
It reports:
Creating c:\problem.dmp - mini user dump
WriteMemoryFromProcess.Read(0x1f1e000, 0x2000) failed, 0x8007012b
Dump creation failed, Win32 error 0n299
"Only part of a ReadProcessMemory or WriteProcessMemory request was completed."
Error 0x299 is:
The requested operation could not be completed due to a file system limitation
Any ideas what this means or how to diagnose?
Have a look at the /mA switch, it was introduced with 6.10.3:
Type net helpmsg 299, error 299 is
Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
In winerror.h this is ERROR_PARTIAL_COPY
Is the process a 64 bit process? http://winprogger.com/?p=26 lists several reasons this error may occur.
Related
I created a simple console application in both .NET Framework 4.8 and .NET 5 (same code in both), but symbols resolve differently across various debugging tools.
If I run both applications, launch Process Hacker, open the process's properties, click on the Threads tab, and open the Stack for the primary managed thread, the .NET 4.8 Stack shows resolved symbols for my classes and methods, but the .NET 5 Stack does not -- it shows hex strings like 0x7ffbac6087a3.
In both cases, calls to System.Console.dll!System.Console.ReadKey() resolve correctly, so I know I have my symbol loading configured correctly (_NT_SYMBOL_PATH = "srv*C:\Source\symbols*https://msdl.microsoft.com/download/symbols"). In both cases, the projects are configured for full debug type and to include debug symbols. In both cases, there is a .pdb to go along with the .exe.
Sysinternals Process Explorer won't display any of that - the bottom of the call stack is 0x0.
If I take a dump of the applications, I can load them into WinDbg Preview and am able to see all of my code as expected. For the .NET 5 application, the normal Stack shows the same thing as Process Hacker (e.g. 0x7ffbac6087a3), but if I run the command !CLRStack -a, those hex values get properly resolved (e.g. 000000BD4F17E840 00007ffbac6087a3 SymbolsCoreConsoleApp.Program.Run() [C:\Source\research\SymbolsCore\SymbolsCoreConsoleApp\Program.cs # 18]).
So, there's the background. Here are the questions:
1.) Why doesn't the Process Hacker Stack resolve symbols for my classes in a .NET 5 application, but it does for the exact same code in a .NET Framework 4.8 application?
2.) Why doesn't Sysinternals Process Explorer display any of my code (just 0x0) for either application? In case it matters, I run procexp64.exe and my machine is x64 Windows 10 Enterprise. If I run 'procexp.exe`, it ultimately launches the x64 version anyhow. Mentioning this in case there is an issue with 32 vs. 64 bit.
3.) Both Process Hacker and Process Explorer have process tabs specifically for .NET (e.g. .NET assemblies and .NET performance), and those tabs only show up for the .NET Framework 4.8 application, but not for the .NET 5 application. Is this by-design or do I have something configured wrong?
4.) In WinDbg Preview, is this behavior by-design? If so, why?
5.) Are there other special things to consider when debugging/analyzing .NET 5/Core applications outside of Visual Studio?
That's a lot of questions, but they're all closely related, and I suspect there may be some fundamental thing(s) that I'm missing here.
Thanks in advance!
EDIT: 20210803 10:55 AM CDT
Per magicandre1981's comment, I installed the nightly of Process Hacker (v3.0.4234).
It still doesn't resolve those symbols.
It does show .NET assemblies and .NET performance tabs for the .NET 5 application now, but there are no values on the .NET performance tab.
EDIT: 20210803 05:05 PM CDT
I ran symchk and dumpbin against both of the applications in case this will help anyone diagnose the problem.
.NET 5
net5.0> $> pwd
C:\Source\research\SymbolsCore\SymbolsCoreConsoleApp\bin\Debug\net5.0
net5.0> $> & 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symchk.exe' .\SymbolsCoreConsoleApp.exe /r
SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1
net5.0> $> & 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30037\bin\Hostx64\x64\dumpbin.exe' /PDBPATH:VERBOSE .\SymbolsCoreConsoleApp.exe
Microsoft (R) COFF/PE Dumper Version 14.29.30040.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file .\SymbolsCoreConsoleApp.exe
File Type: EXECUTABLE IMAGE
PDB file 'C:\Source\research\SymbolsCore\SymbolsCoreConsoleApp\bin\Debug\net5.0\apphost.pdb' checked. (File not found)
PDB file 'D:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdb' checked. (File not found)
PDB file 'C:\WINDOWS\symbols\exe\apphost.pdb' checked. (File not found)
PDB file 'C:\WINDOWS\exe\apphost.pdb' checked. (File not found)
PDB file 'C:\WINDOWS\apphost.pdb' checked. (File not found)
Summary
2000 .data
2000 .pdata
9000 .rdata
1000 .reloc
1000 .rsrc
14000 .text
1000 _RDATA
net5.0> $> & 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symchk.exe' .\SymbolsCoreConsoleApp.dll /r
SYMCHK: SymbolsCoreConsoleApp.dll FAILED - SymbolsCoreConsoleApp.pdb mismatched or not found
SYMCHK: SymbolsCoreConsoleApp.dll FAILED - No CodeView information found.
SYMCHK: FAILED files = 2
SYMCHK: PASSED + IGNORED files = 0
net5.0> $> & 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30037\bin\Hostx64\x64\dumpbin.exe' /PDBPATH:VERBOSE .\SymbolsCoreConsoleApp.dll
Microsoft (R) COFF/PE Dumper Version 14.29.30040.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file .\SymbolsCoreConsoleApp.dll
File Type: EXECUTABLE IMAGE
PDB file found at 'C:\Source\research\SymbolsCore\SymbolsCoreConsoleApp\bin\Debug\net5.0\SymbolsCoreConsoleApp.pdb'
Summary
2000 .reloc
2000 .rsrc
2000 .text
.NET 4.8
Debug> $> pwd
C:\Source\research\SymbolsFramework\SymbolsFrameworkConsoleApp\bin\Debug
Debug> $> & 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symchk.exe' .\SymbolsFrameworkConsoleApp.exe /r
SYMCHK: SymbolsFrameworkConsoleApp.exe FAILED - SymbolsFrameworkConsoleApp.pdb mismatched or not found
SYMCHK: FAILED files = 1
SYMCHK: PASSED + IGNORED files = 0
Debug> $> & 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30037\bin\Hostx64\x64\dumpbin.exe' /PDBPATH:VERBOSE .\SymbolsFrameworkConsoleApp.exe
Microsoft (R) COFF/PE Dumper Version 14.29.30040.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file .\SymbolsFrameworkConsoleApp.exe
File Type: EXECUTABLE IMAGE
PDB file found at 'C:\Source\research\SymbolsFramework\SymbolsFrameworkConsoleApp\bin\Debug\SymbolsFrameworkConsoleApp.pdb'
Summary
2000 .reloc
2000 .rsrc
2000 .text
EDIT: 20210803 07:54 PM CDT
Per hanpassant's comment, here is the project file (it already had the DebugType set to full).
SymbolsCoreConsoleApp.csproj
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net5.0</TargetFramework>
<EmbedUntrackedSources>true</EmbedUntrackedSources>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<DefineConstants>DEBUG;TRACE</DefineConstants>
</PropertyGroup>
</Project>
EDIT: 20210803 08:40 PM CDT
Here are a few screenshots in case it wasn't clear from my explanation.
Notice the 0x7xfbb03a8 addresses instead of resolved symbols.
Notice the resolved symbols for SymbolsFramework.ConsoleApp.Program instead of the unresolved 0x7xfbb03a8 addresses.
Notice the 0x0 address instead of any resolved symbols.
The .NET Assemblies tab shows up for .NET 5 and appears to populate correctly.
The .NET Performance tab shows up for .NET 5, but it has no values.
I opened an issue with Process Hacker on GitHub and it was closed a few days back with a fix in the nightly build. I confirmed that it now works as expected.
For testing purposes I need to force Windows to think that it has battery on workstation PC.
Is there the way to fake/mock/emulate/simulate battery state/low level/charging/discharging in Windows workstation without battery device?
Can I set battery level programmatically on Windows?
tl;dr: Use Windows Driver Testing Framework (WDTF) Runtime Libraries from Windows Driver Kit (WDK)
Long instruction:
Install Visual Studio with Windows Driver Kit (WDK)
Create virtual machine
Seach for WDK Test Target Setup x64-x64_en-us.msi in C:\Program Files (x86)\Windows Kits
Install WDK Test Target Setup x64-x64_en-us.msi on virtual machine.
In Visual Studio, in main menu Driver > Test > Configure Devices add virtual machine to install (WDTF) Runtime Libraries.
From virtual machine copy folder C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\WDTF\RunTime on your workstation
From RunTime folder run as administrator RegisterWDTF.exe
Output:
C:\RunTime>RegisterWDTF.exe
-Delete registry state.
-Get registry path.
-Register COM DLLs.
Process "C:\RunTime\Actions\Deprecated\DeviceManagement.dll".
Process "C:\RunTime\Actions\DeviceSupport\WDTFDeviceSupportAction.dll".
Process "C:\RunTime\Actions\DrvPkgLibExt.dll".
Not a COM DLL
Process "C:\RunTime\Actions\EDT\WDTFEDTAction.dll".
Process "C:\RunTime\Actions\IoSpy\WDTFIoAttackAction.dll".
Process "C:\RunTime\Actions\IoSpy\WDTFIoSpyAction.dll".
Process "C:\RunTime\Actions\SimpleIO\SimpleIO_D3DTest.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFAnySimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFAudioSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFBluetoothSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFCDROMSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMobileBroadbandSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMUTT2STRESSSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMUTT2TCDSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFNetworkSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFVolumeSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWebcamSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWirelessSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWPDSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimulatedBattery\WDTFSimulatedBatterySystemAction.dll".
Process "C:\RunTime\Actions\System\WDTFSystemAction.dll".
Process "C:\RunTime\Actions\WDTFConcurrentIOAction.dll".
Process "C:\RunTime\Actions\WDTFCpuUtilizationSystemAction.dll".
Process "C:\RunTime\Actions\WDTFDriverPackageAction.dll".
Process "C:\RunTime\Actions\WDTFDriverSetupDeviceAction.dll".
Process "C:\RunTime\Actions\WDTFDriverSetupSystemAction.dll".
Process "C:\RunTime\Actions\WDTFDriverVerifierSystemAction.dll".
Process "C:\RunTime\Actions\WDTFFuzzTestAction.dll".
Process "C:\RunTime\Actions\WDTFInterfaces\WDTFInterfaces.dll".
Process "C:\RunTime\Actions\WDTFPNPAction.dll".
Process "C:\RunTime\Actions\WDTFSUPAction.dll".
Process "C:\WDTF.DLL".
-Update registry state.
-Install Drivers.
-Done
WDTF Registration Successful
Now you can use COM object "WDTF2.WDTF" in your program language like in this VBScript example:
'
' Variable defenition
'
Dim WDTF
Dim SimulatedBatterySystemSystemAction
'
' Create WDTF object
'
Set WDTF = CreateObject("WDTF2.WDTF")
'
' Get your newly created SimulatedBatterySystem action interface
'
Set SimulatedBatterySystemSystemAction = WDTF.SystemDepot.ThisSystem.GetInterface("SimulatedBatterySystem")
' enable the simulated battery
SimulatedBatterySystemSystemAction.EnableSimulatedBattery()
' disable real batteries
SimulatedBatterySystemSystemAction.DisableRealBatteries()
' set to DC power status
SimulatedBatterySystemSystemAction.SetSimulatedBatteryToDC()
' set to 50% charge level
SimulatedBatterySystemSystemAction.SetSimulatedBatteryChargePercentage(50)
WScript.Sleep 10000
' set to AC power status
SimulatedBatterySystemSystemAction.SetSimulatedBatteryToAC()
' enable real batteries
SimulatedBatterySystemSystemAction.EnableRealBatteries()
' disable the simulated battery
SimulatedBatterySystemSystemAction.DisableSimulatedBattery()
Here all WDTF reference: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/content/_dtf/
Just in case, Linux Fake battery module: https://github.com/hoelzro/linux-fake-battery-module
Oleg's answer was fairly straightforward to follow but I was unable to make it simulate a battery - the actions to disable and enable the real battery did succeed.
PS C:\RunTime> .\RegisterWDTF.exe
This version of WDTF is compatible with Windows Build 17763.
-Delete registry state.
-Get registry path.
-Register COM DLLs.
Process "C:\RunTime\Actions\Deprecated\DeviceManagement.dll".
Process "C:\RunTime\Actions\DeviceSupport\WDTFDeviceSupportAction.dll".
Process "C:\RunTime\Actions\DrvPkgLibExt.dll".
Not a COM DLL
Process "C:\RunTime\Actions\EDT\WDTFEDTAction.dll".
Process "C:\RunTime\Actions\IoSpy\WDTFIoAttackAction.dll".
Process "C:\RunTime\Actions\IoSpy\WDTFIoSpyAction.dll".
Process "C:\RunTime\Actions\SimpleIO\SimpleIO_D3DTest.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFAnySimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFAudioSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFBluetoothSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFCDROMSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMobileBroadbandSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMUTT2STRESSSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFMUTT2TCDSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFNetworkSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\wdtfsensorsiosimpleioaction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFVolumeSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWebcamSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWirelessSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimpleIO\WDTFWPDSimpleIoAction.dll".
Process "C:\RunTime\Actions\SimulatedBattery\WDTFSimulatedBatterySystemAction.dll".
Process "C:\RunTime\Actions\System\WDTFSystemAction.dll".
Process "C:\RunTime\Actions\WDTFConcurrentIOAction.dll".
Process "C:\RunTime\Actions\WDTFCpuUtilizationSystemAction.dll".
Process "C:\RunTime\Actions\WDTFDriverPackageAction.dll".
Process "C:\RunTime\Actions\WDTFDriverSetupDeviceAction.dll".
Process "C:\RunTime\Actions\WDTFDriverSetupSystemAction.dll".
Process "C:\RunTime\Actions\WDTFDriverVerifierSystemAction.dll".
Process "C:\RunTime\Actions\WDTFFuzzTestAction.dll".
Process "C:\RunTime\Actions\WDTFInterfaces\WDTFInterfaces.dll".
Process "C:\RunTime\Actions\WDTFPNPAction.dll".
Process "C:\RunTime\Actions\WDTFSUPAction.dll".
Process "C:\RunTime\WDTF.DLL".
-Update registry state.
-Install Drivers.
-Done
WDTF Registration Successful
PS C:\RunTime> cscript.exe .\fake-battery.vbs
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.
Loading Wex.Logger.dll from systemdata.cpp linep 922 failed.
WDTF_TARGET : INFO : - GetInterface("SimulatedBatterySystem")
WDTF_TARGET : INFO : Target: ORANGE
WDTF_SIMBATT : INFO : DisableRealBatteries()
WDTF_SIMBATT : INFO : EnableSimulatedBattery()
WDTF_SIMBATT : ERROR : SimulatedBatterySystem critical error installing battbus device. HRESULT=0xE0000203
C:\RunTime\fake-battery.vbs(22, 1) WDTF.SimulatedBatterySystem.1: SimulatedBatterySystem critical error installing battbus device. HRESULT=0xE0000203
Unfortunately there is no information that I could find on the public Internet about these errors. Hopefully someone out there comes across this and knows what to do next!
--
edit: it appears as though Visual Studio installs various drivers in addition to the testing framework so simply copying RunTime folder is insufficient. I ended up adding my workstation as a full target using VS from another workstation. This then let me simulate the battery.
I am running a sample code from windows driver samples and it gives me the following error :
1>------ Rebuild All started: Project: ObCallbackTestCtrl, Configuration: Release x64 ------
2>------ Rebuild All started: Project: ObCallbackTest, Configuration: Release x64 ------
1> Building 'ObCallbackTestCtrl' with toolset 'WindowsApplicationForDrivers10.0' and the 'Desktop' target platform.
1> pchsrc.cpp
2> Building 'ObCallbackTest' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform.
2> pchsrc.c
2> callback.c
1> main.cpp
2> tdriver.c
2> util.c
2> Generating Code...
1> utils.cpp
1> Generating Code...
2> ObCallbackTest.vcxproj -> C:\Users\me\Desktop\obcallback\driver\x64\Release\ObCallbackTest.sys
1> ObCallbackTestCtrl.vcxproj -> C:\Users\me\Desktop\obcallback\control\x64\Release\ObCallbackTestCtrl.exe
2> Done Adding Additional Store
2> Successfully signed: C:\Users\me\Desktop\obcallback\driver\x64\Release\ObCallbackTest.sys
2>
2> Inf2Cat task was skipped as there were no inf files to process
2>
========== Rebuild All: 2 succeeded, 0 failed, 0 skipped ==========
I am not sure if its a warning or intended to be, but nothing happens when I run the program. I run the program with "-install" arguments and it doesn't give any error. Then no other commands have any effect. "-reject xyz" doesn't stop the execution of the xyz process, and "-name" "-deprotect" don't seem to work either. They don't work or throw any error either.
I have read the other related thread on the same issue but I don't have that update installed on my system.
I am running Windows 7 and VS 2015.
Would appreciate any help, thanks!
You need to load the kernel-mode device driver which is used for the kernel-mode callback; the user-mode program is nothing but a a console program which will communicate with the kernel-mode device driver via IOCTL. The kernel-mode device driver is responsible for actually providing the functionality.
ObCallbackTest.sys was successfully built according to the log you posted, therefore go into your analysis environment, copy across ObCallbackTest.sys and ObCallbackTestCtrl.exe and then load ObCallbackTest.sys with the Service Manager (e.g. OSRLOADER will be fine for testing). After the kernel-mode device driver is active, run ObCallbackTestCtrl.exe with administrator rights and see if it then works.
Don't do it on your Host environment because BSOD crashes can cause data corruption, and that can have devastating effects on your real Host environment. Instead, use a physical machine for testing kernel-mode software, or a Virtual Machine. You also need to setup remote kernel debugging support so you can debug your kernel-mode software for investigation to ensure things are working as they should, and to help you diagnose the source of bugs in your device driver projects.
The installation of the master component stops because the Prerequisite Check tool fails to run.
Error message:
37 INFO 02:30.96 executePRScript(/tmp/IMC_01010000,prs.tws.script.cfg.unix): Enter.
38 INFO 02:32.52 PRS command used for execution:echo IMC=IMC >> /tmp/IMC_01010000/
codename.cfg&&chmod -R 755/tmp/IMC_01010000&&/tmp/IMC_01010000/prereq_checker.sh
IMC detail outputDir=/tmp/IMC_01010000
39 ERROR 02:32.53 PRS job is finished. Results are not available.
40 WARNING 02:32.53 Error occurred while executing executePRScript.
Running manually the prereq_checker.sh I receive the following error message:
CTGPR2514E: Ensure that the binary for bc is available on the local system and is set
in the PATH environment variable.
The binary for bc is missing on your system. It must be installed before you run the Prerequisite Check.
bc 1.06.95
Copyright 1991-1994, 1997, 1998, 2000, 2004, 2006 Free Software Foundation, Inc.
This is free software with ABSOLUTELY NO WARRANTY.
For additional information, see: https://www.gnu.org/software/bc/manual/html_mono/bc.html#SEC2
The installation processed in a couple of hours then it tells me errors has occurred and needs to rollback.
Here is the error :
Action: Performing Action on Exe at Y:\NDP40-KB2468871.exe
Error launching CreateProcess with command line = NDP40-KB2468871.exe /q /norestart /pipe SectionName_1343615874 /log "C:\Users\NHATTH~1\AppData\Local\Temp"Error performing inpage operation.
CreateProcess returned error = Error performing inpage operation.
Original exit code: Y:\NDP40-KB2468871.exe returned non-MSI error code: 0x3e7 - Error performing inpage operation.
Modified exit code: Y:\NDP40-KB2468871.exe returned error code: 0x643 - Fatal error during installation.
Exe (Y:\NDP40-KB2468871.exe) failed with 0x80070643 - Fatal error during installation. .
PerformOperation on exe returned exit code 1603 (translates to HRESULT = 0x80070643)
Action complete
OnFailureBehavior for this item is to Rollback.
What is NDP40-KB2468871.exe about ?
try reinstall dotNetFx4.0
I had a similar problem.
Look for some kind of damage on the disk or dvd. It happens to me before and that what the cost.
Another posibility is that performing inpage operation occours because the file on the provide by the instalation cd is corrupted.
hope my words can help
My post is unlrelated but mght help others, I got a 0x80070643 error on instaling visual studio 2010 sp1 on Visual studio express 2010. The error was due to lack of diskspace in C drive.
Such a trivial issue and I overlooked. This could happen to anyone
Sibi