Microsoft KB Archive/81142

{|
 * width="100%"|

An Annotated Dr. Watson Log File

 * }

Q81142

-

The information in this article applies to:


 * Microsoft Windows Software Development Kit (SDK) 3.1

-

SUMMARY
Dr. Watson is a utility that logs information about applications that fail. This article presents a sample log file and explains what the various entries signify. Comments in the log file start with pound sign (#).

MORE INFORMATION
This article annotates a log file for the BICHO application, which tests Windows by faulting in the various ways. Bicho is Bolivian slang for &quot;bug&quot; or &quot;critter.&quot;

# Dr. Watson writes the following line each time it starts execution
 * 1) unless the [dr. watson] section of the WIN.INI file contains the
 * 2) line SkipInfo=time:

Start Dr. Watson 0.80 - Thu Sep 26 10:51:28 1991


 * 1) These lines mark the beginning of a Dr. Watson failure report
 * 2) They report the version of Dr. Watson and the date and time of the
 * 3) reported event.

Dr. Watson 0.80 Failure Report - Thu Sep 26 10:51:36 1991


 * 1) The next line reports that an application named &quot;BICHO&quot; encountered
 * 2) an &quot;Exceed Segment Bounds&quot; fault while reading memory. The precise
 * 3) point of failure was also in BICHO, 0x6b bytes after the start of
 * 4) the DoCommand function.

BICHO had a 'Exceed Segment Bounds (Read)' fault at BICHO _DoCommand+006b


 * 1) The following line repeats the previous information formatted for
 * 2) automatic parsing code. It also includes the instruction that caused
 * 3) the fault (a push instruction in this case).

$tag$BICHO$Exceed Segment Bounds (Read)$BICHO _DoCommand+006b$push word ptr [fffe]$Thu Sep 26 10:51:36 1991


 * 1) The following lines report the contents of the CPU registers:

CPU Registers (regs)


 * 1) The 16-bit registers are listed first. This information can be
 * 2) useful to determine what address an instruction modified when the
 * 3) fault occurred.

ax=1e54 bx=0014  cx=0d7f  dx=0111  si=1e54  di=0111


 * 1) The next items are the instruction pointer (otherwise known as the
 * 2) program counter), stack pointer, and base pointer. This line also
 * 3) lists the state of the flag bits. In this example, the Overflow,
 * 4) Direction, Sign, Zero, and Carry bits are Clear (0), while the
 * 5) Interrupt, Auxcarry, and Parity bits are Set (1).

ip=02fd sp=230c  bp=237a  O- D- I+ S- Z- A+ P+ C-


 * 1) The code segment selector is 0e57, linear address is 8059fbc0. The
 * 2) code segment's limit is 83f. (Enhanced mode linear addresses often
 * 3) start with 8xxx.) Accessing a code or data segment beyond its limit
 * 4) is a common cause of GP faults.

cs = 0e57 8059fbc0:083f Code Ex/R


 * 1) The next line provides information about the stack segment selector.

ss = 0d7f 8059d5e0:25df Data R/W


 * 1) The following line provides information about the data segment
 * 2) selector. Note that the limit is 25df, while the application
 * 3) attempted to read the value at fffe, which is beyond the segment's
 * 4) limit.

ds = 0d7f 8059d5e0:25df Data R/W


 * 1) The following line provides information about the extra segment
 * 2) selector:

es = 0d7f 8059d5e0:25df Data R/W


 * 1) The next lines provide information about the 32-bit registers.
 * 2) If a selector is 0, it corresponds to the null pointer. Attempting
 * 3) to use a null pointer is another common cause of GP faults.

CPU 32 bit Registers (32bit) eax = 00001e54 ebx = 00000014  ecx = ffff0d7f  edx = 00000111 esi = 00001e54 edi = 00000111  ebp = 0000237a  esp = 800422fc fs = 0000        0:0000 Null Ptr gs = 0000        0:0000 Null Ptr eflag = 00000002


 * 1) The next lines provide information about the Windows installation.

System Info (info) Windows version 3.10 Debug build # The debug version of windows (from the SDK) was running Windows Build 3.1.048 # This is a prerelease build of Windows, #48 Username Unknown User              # Your Name Here Organization Unknown Organization  # Your Organization Here

System Free Space 7131008


 * 1) The following provides the stack size for the current task:

Stack base 1122, top 9164, lowest 7504, size 8042


 * 1) Dr. Watson records some statistics about the Windows environment:

System resources: USER: 87% free, seg 0777  GDI: 85% free, seg 05d7 LargestFree 6594560, MaxPagesAvail 1610, MaxPagesLockable 267 TotalLinear 1948, TotalUnlockedPages 274, FreePages 52 TotalPages 614, FreeLinearSpace 1611, SwapFilePages 7158 Page Size 4096 4 tasks executing. WinFlags - Math coprocessor 80386 or 80386 SX Enhanced mode Protect mode


 * 1) The following records the contents of the stack to determine what
 * 2) code called the routine that failed:

Stack Dump (stack)


 * 1) Stack frame 0 indicates that the failure occurred in BICHO, 0x6b
 * 2) bytes after the start of the DoCommand function, as reported
 * 3) earlier.

Stack Frame 0 is BICHO _DoCommand+006b       ss:bp 0d7f:237a


 * 1) The offending instruction is disassembled in context, as follows:

0e57:02f0 e9 02b9               jmp    near 05ac 0e57:02f3 6a 00                 push   00 0e57:02f5 9a 8db0 0477          callf  0477:8db0 0e57:02fa e9 02af               jmp    near 05ac (BICHO:_DoCommand+006b) 0e57:02fd ff 36 fffe            push   word ptr [fffe] 0e57:0301 68 0110               push   0110 0e57:0304 e8 fe5d               call   near 0164 0e57:0307 83 c4 04              add    sp, 04


 * 1) The application tried to read a value from memory at address DS:fffe
 * 2) and to push that value on the stack. However, the limit of the DS
 * 3) segment is 25df. The next stack frame documents that the BICHO
 * 4) application MainWndProc called DoCommand:

Stack Frame 1 is BICHO MAINWNDPROC+0027      ss:bp 0d7f:2388

0e57:0670 eb 16                 jmp    short 0688 0e57:0672 ff 76 0a              push   word ptr [bp+0a] 0e57:0675 56                    push   si 0e57:0676  e8 fc19               call   near 0292 (BICHO:MAINWNDPROC+0027) 0e57:0679 83 c4 04              add    sp, 04 0e57:067c 99                    cwd 0e57:067d eb 1f                 jmp    short 069e 0e57:067f 6a 00                 push   00


 * 1) &quot;USER&quot; in the next stack frame is the Windows module USER.EXE. It
 * 2) calls application window and dialog procedures. In this case, USER
 * 3) called the BICHO application's MainWndProc.

Stack Frame 2 is USER IDISPATCHMESSAGE+007e  ss:bp 0d7f:239e


 * 1) In the next stack frame, the BICHO application's WinMain function
 * 2) called DispatchMessage, which called MainWndProc.

Stack Frame 3 is BICHO WINMAIN+0050          ss:bp 0d7f:23bc


 * 1) In the last stack frame, the Windows start-up code calls the
 * 2) application's WinMain function.

Stack Frame 4 is BICHO 1:00a3                ss:bp 0d7f:23ca

System Tasks (tasks)
 * 1) The next lines list all the tasks running in the system when the
 * 2) fault occurred. Dr. Watson itself, the shell application, and the
 * 3) faulting application will always be included.

Task WINEXIT, Handle 0daf, Flags 0001, Info    9248 08-09-90 16:52 FileName C:\MS\WIN\DON\WINEXIT.EXE Task DRWATSON, Handle 0ea7, Flags 0001, Info  26256 09-23-91 12:00 FileName C:\WIN31\DRWATSON.EXE Task PROGMAN, Handle 060f, Flags 0001, Info  110224 09-23-91 12:02 FileName C:\WIN31\PROGMAN.EXE Task   BICHO, Handle 0da7, Flags 0001, Info   16537 09-11-91  8:45 FileName D:\BICHO.EXE


 * 1) The last part of a failure report is any information typed in the
 * 2) &quot;Dr. Watson's Clues&quot; dialog box.

1&gt; I ran a test app that accessed a value 2&gt; beyond the limits of the segment bounds.


 * 1) Dr. Watson writes this line when it shuts down.

Stop Dr. Watson 0.80 - Thu Sep 26 10:52:10 1991 Additional query words: 3.10

Keywords : kb16bitonly

Issue type :

Technology : kbAudDeveloper kbWin3xSearch kbSDKSearch kbWinSDKSearch kbWinSDK310