2

I have installed my windbg as default debugger in command prompt with administrator rights.

Then I wrote a program that writes in null pointer so that it causes a crash.

After the crash, a window pops up and shows "debug" or "program close" options.

So I chose "debug", and got the window like the image I uploaded.

Q. Shouldn't it there be windbg for option? Q. There gotta be something I have missed. Can you advice me to troubleshoot with windbg?

enter image description here

백경훈
  • 101
  • 4
  • 3
    You need to register windbg as a [just-in-time debugger](https://msdn.microsoft.com/en-us/library/windows/hardware/ff542967%28v=vs.85%29.aspx). That can be done by running `windbg.exe` with the `-I` switch command line switch. – Sean Cline Feb 09 '16 at 18:37
  • 1
    Possible duplicate of [setup WinDbg as default debugger](http://stackoverflow.com/questions/5638251/setup-windbg-as-default-debugger) – Thomas Weller Feb 11 '16 at 11:33

1 Answers1

3

As Sean Cline suggested in his comment, you probably haven't set WinDbg to be the post-mortem debugger. If you had, WinDbg would launch rather than vsjitdebugger.exe.

Make sure you really ran windbg.exe -I from an elevated command prompt. Did you do that and got the following message box?

WinDbg was successfully installed as the default postmortem debugger.

Edit: Note that on a 64-bit Windows there are separate settings for post-mortem debugger for 64-bit applications and for WOW64 (32-bit) applications. Each version of WinDbg when receiving the -I flag sets itself as the post-mortem debugger for its own bitness. That is, running

C:\WINDOWS\system32>"C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe" -I

will set ...\x64\windbg.exe to be the post-mortem debugger for 64-bit applications but will leave vsjitdebugger.exe as the post-mortem debugger for WOW64 applications.

You can check the current configuration using the REG QUERY command. and your output should be something like this if you ran windbg.exe -I:

C:\Users\conio>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /reg:64

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
    UserDebuggerHotKey    REG_DWORD    0x0
    Debugger    REG_SZ    "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe" -p %ld -e %ld -g
    Auto    REG_SZ    1

But it will probably be something like this if you just installed Visual Studio (and didn't run windbg.exe -I):

C:\Users\conio>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /reg:32

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
    UserDebuggerHotKey    REG_DWORD    0x0
    Debugger    REG_SZ    "C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld

(The /reg:64 and /reg:32 are required to get the "64-bit registry view" and the "32-bit registry view" respectively regardless of whether you're running %WINDIR%\System32\REG.EXE or %WINDIR%\SysWOW64\REG.EXE. This obviously applies only to 64-bit Windows.)

Regarding your question: "Shouldn't it there be windbg for option?"

No. Look at the title. It says "Visual Studio Just-In-Time Debugger". It's not a general utility to choose among different debuggers installed on your system. It just runs Visual Studio, but can choose whether to launch a new instance or use an existing one (and I think it lets you choose VS version if you have several versions installed).

conio
  • 3,681
  • 1
  • 20
  • 34
  • 1
    You need to document that the 64-bit and the 32-bit registry key is important. With the 32-bit key in Wow6432Node being most likely to be relevant. Best to use Regedit.exe, the reg command doesn't help much. – Hans Passant Feb 10 '16 at 15:20
  • You're right about the issue of separate debuggers for 64-bit and WOW64 applications, but the REG command supports working against the "32-bit view" of the registry (i.e. `KEY_WOW64_32KEY`) and that I didn't suggest using using the `REG` command to set the `AeDebug` value but rather only to view it. Setting with `windbg.exe -I` sets the right keys. But I'll add information, though you could have done it. It's a good point and a good edit. I would have approved it. :) – conio Feb 10 '16 at 16:13