1

我想以编程方式从用户转储文件中检索堆栈跟踪。在已知位置有这个用户转储，我想从中提取堆栈跟踪并将其放入纯文本文件中 - 有没有办法做到这一点？

注意：我可以手动完成 - 打开 windbg 并输入“k”命令 - 但正如我之前提到的，我想以编程方式执行此操作。

谢谢

4

2 回答 2

2

您应该检查windbg sdk 子文件夹，其中包含有关如何以编程方式使用 dbgeng.dll 的示例。
代码示例：

 PSTR g_DumpFile;
 PSTR g_ImagePath;
 PSTR g_SymbolPath;

 ULONG64 g_TraceFrom[3];

 IDebugClient* g_Client;
 IDebugControl* g_Control;
 IDebugSymbols* g_Symbols;

  void CreateInterfaces(void)
  {
    HRESULT Status;

    // Start things off by getting an initial interface from
    // the engine.  This can be any engine interface but is
    // generally IDebugClient as the client interface is
    // where sessions are started.
    if ((Status = DebugCreate(__uuidof(IDebugClient),
                              (void**)&g_Client)) != S_OK)
    {
        Exit(1, "DebugCreate failed, 0x%X\n", Status);
    }

    // Query for some other interfaces that we'll need.
    if ((Status = g_Client->QueryInterface(__uuidof(IDebugControl),
                                           (void**)&g_Control)) != S_OK ||
        (Status = g_Client->QueryInterface(__uuidof(IDebugSymbols),
                                           (void**)&g_Symbols)) != S_OK)
    {
        Exit(1, "QueryInterface failed, 0x%X\n", Status);
    }
 }

 void
 DumpStack(void)
 {
    HRESULT Status;
    PDEBUG_STACK_FRAME Frames = NULL;
    int Count = 50;

    printf("\nFirst %d frames of the call stack:\n", Count);

    if (g_TraceFrom[0] || g_TraceFrom[1] || g_TraceFrom[2])
    {
        ULONG Filled;

        Frames = new DEBUG_STACK_FRAME[Count];
        if (Frames == NULL)
        {
            Exit(1, "Unable to allocate stack frames\n");
        }

        if ((Status = g_Control->
             GetStackTrace(g_TraceFrom[0], g_TraceFrom[1], g_TraceFrom[2],
                           Frames, Count, &Filled)) != S_OK)
        {
            Exit(1, "GetStackTrace failed, 0x%X\n", Status);
        }

        Count = Filled;
    }

    // Print the call stack.
    if ((Status = g_Control->
         OutputStackTrace(DEBUG_OUTCTL_ALL_CLIENTS, Frames,
                          Count, DEBUG_STACK_SOURCE_LINE |
                          DEBUG_STACK_FRAME_ADDRESSES |
                          DEBUG_STACK_COLUMN_NAMES |
                          DEBUG_STACK_FRAME_NUMBERS)) != S_OK)
    {
        Exit(1, "OutputStackTrace failed, 0x%X\n", Status);
    }

    delete[] Frames;
 }


 void __cdecl main(int Argc, __in_ecount(Argc) char** Argv)
 {
    CreateInterfaces();

    ParseCommandLine(Argc, Argv);

    ApplyCommandLineArguments();

    DumpStack();

    Exit(0, NULL);
 }
于 2009-05-08T11:33:43.193 回答
1

几年前，我在 DDJ 上写了一篇关于在 C/C++ 中使用 Windows 和 Unix/Linux 转储堆栈的文章。它不使用cordump，但它会将堆栈帧写入日志文件、内部错误或操作系统确定应用程序故障时。

也许它可以帮助你：

见http://www.ddj.com/architect/185300443

于 2009-05-08T10:24:23.720 回答