How to extract debugging information from a crash

Question

If my C++ app crashes on Windows I want to send useful debugging information to our server.

On Linux I would use the GNU backtrace() function - is there an equivalent for Windows?

Is there a way to extract useful debugging information after a program has crashed? Or only from within the process?

(Advice along the lines of "test you app so it doesn't crash" is not helpful! - all non-trivial programs will have bugs)

Answer 1

The function Stackwalk64 can be used to snap a stack trace on Windows.

If you intend to use this function, you should be sure to compile your code with FPO disabled - without symbols, StackWalk64 won't be able to properly walk FPO'd frames.

You can get some code running in process at the time of the crash via a top-level __try/__except block by calling SetUnhandledExceptionFilter. This is a bit unreliable since it requires you to have code running inside a crashed process. Alternatively, you can just the built-in Windows Error Reporting to collect crash data. This is more reliable, since it doesn't require you to add code running inside the compromised, crashed process. The only cost is to get a code-signing certificate, since you must submit a signed binary to the service. https://sysdev.microsoft.com/en-US/Hardware/signup/ has more details.

Answer 2

You can use the Windows API call MiniDumpWriteDump if you wish to roll your own code. Both Windows XP and Vist automate this process and you can sign up at https://winqual.microsoft.com to gain access to the error reports.

Also check out http://kb.mozillazine.org/Breakpad and http://www.codeproject.com/KB/debug/crash_report.aspx for other solutions.

Answer 3

This website provides quite a detailed overview of stack retrieval on Win32 after a C++ exception:

http://www.eptacom.net/pubblicazioni/pub_eng/except.html

Of course, this will only work from within the process, so if the process gets terminated or crashes to the point where it terminates before that code is run, it won't work.