WinDbgでコールスタックにUnhandledExceptionFilterが含まれる場合の解析方法

0:001:x86> !analyze -v　// ★解析開始
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


FAULTING_IP: 
ntdll!DbgBreakPoint+0
db3ec6b0 cc              int     3

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00007ff8db3ec6b0 (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 0000000000000000

FAULTING_THREAD:  0000000000001190

DEFAULT_BUCKET_ID:  STACKIMMUNE

PROCESS_NAME:  WinDbgTest.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - {

EXCEPTION_PARAMETER1:  0000000000000000

MOD_LIST: 

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 0000000077aef3ec

PRIMARY_PROBLEM_CLASS:  STACKIMMUNE

BUGCHECK_STR:  APPLICATION_FAULT_STACKIMMUNE_ZEROED_STACK

STACK_TEXT:  
00000000`00000000 00000000`00000000 windbgtest.exe+0x0


SYMBOL_NAME:  windbgtest.exe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: windbgtest

DEBUG_FLR_IMAGE_TIMESTAMP:  5503f279

STACK_COMMAND:  ** Pseudo Context ** ; kb

BUCKET_ID:  X64_APPLICATION_FAULT_STACKIMMUNE_ZEROED_STACK_windbgtest.exe

IMAGE_NAME:  C:\Users\Test\Documents\Visual Studio 2008\Projects\WinDbgTest\Debug\WinDbgTest.exe

FAILURE_BUCKET_ID:  STACKIMMUNE_80000003_C:_Users_Test_Documents_Visual_Studio_2008_Projects_WinDbgTest_Debug_WinDbgTest.exe!Unknown

FOLLOWUP_IP: 
WinDbgTest!__ImageBase+0
00120000 4d              dec     ebp

Followup: MachineOwner
---------

0:001:x86> !pe
No export pe found
0:001:x86> lmvm WinDbgTest
start             end                 module name
00120000 0013b000   WinDbgTest C (private pdb symbols)  C:\Users\Test\Documents\Visual Studio 2008\Projects\WinDbgTest\Debug\WinDbgTest.pdb
    Loaded symbol image file: C:\Users\Test\Documents\Visual Studio 2008\Projects\WinDbgTest\Debug\WinDbgTest.exe
    Image path: C:\Users\Test\Documents\Visual Studio 2008\Projects\WinDbgTest\Debug\WinDbgTest.exe
    Image name: WinDbgTest.exe
    Timestamp:        Sat Mar 14 17:34:01 2015 (5503F279)
    CheckSum:         00000000
    ImageSize:        0001B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0:001:x86> ~*kv

//
//　コールスタックに、UnhandledExceptionFilter関数が含まれている
//

   0  Id: 22b4.1700 Suspend: 1 Teb: 7eddb000 Unfrozen
ChildEBP RetAddr  Args to Child              
002aec00 75f7ea7f 00000003 002aedc8 00000001 ntdll_77ab0000!ZwWaitForMultipleObjects+0xc (FPO: [5,0,0])
002aed84 75b99188 00000000 002aedc8 00000000 KERNELBASE!WaitForMultipleObjectsEx+0xdc (FPO: [SEH])
002aeda0 75beb399 00000003 002aedc8 00000000 KERNEL32!WaitForMultipleObjects+0x19 (FPO: [Non-Fpo])
002af1dc 75beae92 00000000 00000001 00000000 KERNEL32!WerpReportFaultInternal+0x4e8 (FPO: [Non-Fpo])
002af1ec 75bcd7bf 002af280 75ff96fd 002af2b0 KERNEL32!WerpReportFault+0x74 (FPO: [0,0,4])
002af1f4 75ff96fd 002af2b0 00000001 7ac27da3 KERNEL32!BasepReportFault+0x19 (FPO: [Non-Fpo])
002af280 77b5366d 002af2b0 77aef7b4 fffffffe KERNELBASE!UnhandledExceptionFilter+0x1d1 (FPO: [Non-Fpo])　// ★UnhandledExceptionFilterが呼び出されている
002afa14 77afa8a1 ffffffff 77aef68a 00000000 ntdll_77ab0000!__RtlUserThreadStart+0x58dc6
002afa24 00000000 0013108c 7edde000 00000000 ntdll_77ab0000!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

#  1  Id: 22b4.1190 Suspend: 1 Teb: 7ecad000 Unfrozen
ChildEBP RetAddr  Args to Child              
01e5fafc 00000000 00000000 00000000 00000000 ntdll_77ab0000!RtlUserThreadStart (FPO: [0,2,0])

//
//　UnhandledExceptionFilter関数の第一引数(002af2b0)はEXCEPTION_POINTERS型なので、
//　Args to Childの１つ目の002af2b0をEXCEPTION_POINTERS型にキャストして内容を確認する
//

0:001:x86> dt EXCEPTION_POINTERS 002af2b0　// ★EXCEPTION_POINTERSを確認
WinDbgTest!EXCEPTION_POINTERS
   +0x000 ExceptionRecord  : 0x002af3e8 _EXCEPTION_RECORD
   +0x004 ContextRecord    : 0x002af438 _CONTEXT　// ★コンテキスト


0:001:x86> dt _EXCEPTION_RECORD 0x002af3e8　// ★_EXCEPTION_RECORDを確認
WinDbgTest!_EXCEPTION_RECORD
   +0x000 ExceptionCode    : 0n-1073741676 // ★NTSTATUSエラーコード = STATUS_INTEGER_DIVIDE_BY_ZERO(０除算)
   +0x004 ExceptionFlags   : 0
   +0x008 ExceptionRecord  : (null) 
   +0x00c ExceptionAddress : 0x00131580 Void
   +0x010 NumberParameters : 0
   +0x014 ExceptionInformation : [15] 0


0:001:x86> .cxr 0x002af438　// ★コンテキストを切り替える
eax=0000000a ebx=7edde000 ecx=00000000 edx=00000000 esi=002af8a0 edi=002af898
eip=00131580 esp=002af79c ebp=002af898 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
WinDbgTest!Crush002+0x30:
00131580 f77df8          idiv    eax,dword ptr [ebp-8] ss:002b:002af890=00000000


0:001:x86> kb　// ★コールスタックを確認する
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
002af898 00131430 00000000 00000000 7edde000 WinDbgTest!Crush002+0x30 [c:\users\Test\documents\visual studio 2008\projects\windbgtest\windbgtest\test001.cpp @ 28]　// ★ここで落ちている
002af96c 00131b28 00000001 01d57f68 01d59658 WinDbgTest!wmain+0x40 [c:\users\Test\documents\visual studio 2008\projects\windbgtest\windbgtest\windbgtest.cpp @ 20]
002af9bc 0013196f 002af9d0 75b9919f 7edde000 WinDbgTest!__tmainCRTStartup+0x1a8 [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 583]
002af9c4 75b9919f 7edde000 002afa14 77afa8cb WinDbgTest!wmainCRTStartup+0xf [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 403]
002af9d0 77afa8cb 7edde000 78872540 00000000 KERNEL32!BaseThreadInitThunk+0xe
002afa14 77afa8a1 ffffffff 77aef68a 00000000 ntdll_77ab0000!__RtlUserThreadStart+0x20
002afa24 00000000 0013108c 7edde000 00000000 ntdll_77ab0000!_RtlUserThreadStart+0x1b

//
//　★解析完了
//　　WinDbgTest!Crush002+0x30の位置で０除算で落ちています。
//　　test001.cppの28行目を確認します。
//