WSO2 EI get attachement filename in SOAP request - soap

I need to get the filename of the attachment given in a SOAP request.
The SOAP request looks like this :
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:type="http://some.type/types">
<soap:Header/>
<soap:Body>
<type:RequestName>
<type:Data>...</type:Data>
<!--Optional:-->
<type:myAttachement>cid:AAA</type:myAttachement>
</type:RequestName>
</soap:Body>
</soap:Envelope>
When MTOM is enabled in SOAP UI, I can see the following in the log Wire :
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> " <type:myAttachement><inc:Include href="cid:AAA" xmlns:inc="http://www.w3.org/2004/08/xop/include"/></type:myAttachement>
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> " </type:RequestName>
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> " </soap:Body>[\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "</soap:Envelope>"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "------=_Part_2_1904033954.1651826827378[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "Content-Type: text/plain; charset=us-ascii; name=test.txt[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "Content-Transfer-Encoding: 7bit[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "Content-ID: <AAA>[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "Content-Disposition: attachment; name="test.txt"; filename="test.txt"[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "AAABBBCCCDDD[\r][\n]"
DEBUG {wire} - HTTP-Listener I/O dispatcher-2 >> "------=_Part_2_1904033954.1651826827378--[\r][\n]"
I can see the filename, Content-Type.. When I Debug the request in the sequence, the file content is inline the SOAP Payload :
<type:myAttachment>QUFBQkJCQ0NDRERE</type:myAttachment>
</type:RequestName>
</soap:Body></soap:Envelope>
How can I get in script mediator the attachment filename or at least the Content-Type of the attachment ?

Related

Documents4j - RemoteConverter Invalid Input

We have tried to use Documents4j for converting docx to pdf.
I have tried it with LocalConverter, it runs perfectly as expected. But when i tried to run with RemoteConverter, facing errors "com.documents4j.throwables.ConversionInputException: The input file seems to be corrupt". Same file works in LocalConverter in same machine
To run the RemoteConverter:
java -jar **\Downloads\documents4j-server-standalone-1.1.3-shaded.jar http://127.0.0.1:9998 -log **\Downloads\Documents4jlog.txt -level DEBUG
java -jar **\Downloads\documents4j-client-standalone-1.1.3-shaded.jar http://127.0.0.1:9998 -log **\Downloads\Documents4jlogClient.txt
ERROR:
com.documents4j.throwables.ConversionInputException: The sent input is invalid
Below is the server log:
2020-06-05 18:11:04,939 INFO [pool-3-thread-2] c.d.c.msoffice.MicrosoftWordBridge - Requested conversion from C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0\5b54b28b-b20d-4f41-9647-18b89f154c28\temp3 (application/msword) to C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0\5b54b28b-b20d-4f41-9647-18b89f154c28\temp4 (application/pdf)
2020-06-05 18:11:04,939 DEBUG [pool-3-thread-2] org.zeroturnaround.exec.ProcessExecutor - Executing [cmd, /S, /C, ""C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0\word_convert1288062732.vbs" "C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0\5b54b28b-b20d-4f41-9647-18b89f154c28\temp3" "C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0\5b54b28b-b20d-4f41-9647-18b89f154c28\temp4" "17""] in C:\Users\DIVYAL~2\AppData\Local\Temp\1591360694906-0.
2020-06-05 18:11:04,952 DEBUG [pool-3-thread-2] org.zeroturnaround.exec.ProcessExecutor - Started java.lang.ProcessImpl#8f30115
2020-06-05 18:11:05,189 DEBUG [WaitForProcess-java.lang.ProcessImpl#8f30115] org.zeroturnaround.exec.WaitForProcess - java.lang.ProcessImpl#8f30115 stopped with exit code -2
2020-06-05 18:11:05,196 INFO [pool-3-thread-2] c.d.w.e.AsynchronousConversionResponse - Sending exceptional response for org.glassfish.jersey.server.ServerRuntime$AsyncResponder#250891f5
com.documents4j.throwables.ConversionInputException: The input file seems to be corrupt
at com.documents4j.util.Reaction$ConversionInputExceptionBuilder.make(Reaction.java:159)
at com.documents4j.util.Reaction$ExceptionalReaction.apply(Reaction.java:75)
at com.documents4j.conversion.ExternalConverterScriptResult.resolve(ExternalConverterScriptResult.java:70)
at com.documents4j.conversion.ProcessFutureWrapper.evaluateExitValue(ProcessFutureWrapper.java:48)
at com.documents4j.conversion.ProcessFutureWrapper.get(ProcessFutureWrapper.java:36)
at com.documents4j.conversion.ProcessFutureWrapper.get(ProcessFutureWrapper.java:11)
at com.documents4j.job.AbstractFutureWrappingPriorityFuture.run(AbstractFutureWrappingPriorityFuture.java:78)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Kindly let me know, if I'm missing anything...
Thanks in advance

WinSCP SSH error Unknown command 'ssh-rsa'

Context: I have CSV files I'm outputting from SQL Server through BCP. I'm trying to securely transfer the files to a remote SFTP folder using WinSCP.
Details: When I execute the batch file below through powershell I raise an error 'Unknown command 'ssh-rsa' with the log file showing an exit code = 1 which is failure.
Here is what my synchronization file looks like...
option batch abort
option confirm off
open sftp://username:password#sftp.redacted.com -hostkey="ssh-rsa 2048 redacted=ssh-rsa 2048 redacted"
synchronize remote D:\redactedDaily_Reports\redacted_Catalog_New_Item /upload/redacted_catalog
exit
and & my batch file...
winscp.com /script=SyncTo_redacted_catalog.txt /log=D:\redacted_Daily_Reports\winscp_log_catalog.txt
pause
Here is a snippet of my powershell output and log file...
powershell output
. 2019-03-06 23:39:28.379 Access granted
. 2019-03-06 23:39:28.379 Opening session as main channel
. 2019-03-06 23:39:28.447 Opened main channel
. 2019-03-06 23:39:28.583 Started a shell/command
. 2019-03-06 23:39:28.583 --------------------------------------------------------------------------
. 2019-03-06 23:39:28.584 Using SFTP protocol.
. 2019-03-06 23:39:28.584 Doing startup conversation with host.
> 2019-03-06 23:39:28.584 Type: SSH_FXP_INIT, Size: 5, Number: -1
< 2019-03-06 23:39:28.769 Type: SSH_FXP_VERSION, Size: 95, Number: -1
. 2019-03-06 23:39:28.769 SFTP version 3 negotiated.
. 2019-03-06 23:39:28.769 Unknown server extension posix-rename#openssh.com="1"
. 2019-03-06 23:39:28.769 Supports statvfs#openssh.com extension version "2"
. 2019-03-06 23:39:28.769 Unknown server extension fstatvfs#openssh.com="2"
. 2019-03-06 23:39:28.769 We believe the server has signed timestamps bug
. 2019-03-06 23:39:28.769 We will use UTF-8 strings until server sends an invalid UTF-8 string as with SFTP version 3 and older UTF-8 strings are not mandatory
. 2019-03-06 23:39:28.769 Limiting packet size to OpenSSH sftp-server limit of 262148 bytes
. 2019-03-06 23:39:28.769 Getting current directory name.
. 2019-03-06 23:39:28.769 Getting real path for '.'
> 2019-03-06 23:39:28.769 Type: SSH_FXP_REALPATH, Size: 10, Number: 16
< 2019-03-06 23:39:28.837 Type: SSH_FXP_NAME, Size: 23, Number: 16
. 2019-03-06 23:39:28.837 Real path is '/'
. 2019-03-06 23:39:28.837 Startup conversation with host finished.
< 2019-03-06 23:39:28.837 Script: Active session: [1] redacted#sftp.redacted.com
> 2019-03-06 23:39:28.838 Script: ssh-rsa 2048 redacted
< 2019-03-06 23:39:28.838 Script: Unknown command 'ssh-rsa'.
. 2019-03-06 23:39:28.838 Script: Failed
. 2019-03-06 23:39:28.838 Script: Exit code: 1
. 2019-03-06 23:39:28.838 Closing connection.
. 2019-03-06 23:39:28.838 Sending special code: 12
. 2019-03-06 23:39:28.838 Sent EOF message
Questions:
Why am I raising this error & how do I fix it?
Is this error trying to tell me that I'm using an incorrect key-fingerprint -- If so, why is that the case when a) I obtained this key directly from the server when I connected successfully the first time and b) the log file appears to show the initial connection was successful?
Please help Any tips or recommendations greatly appreciated -- responses will probably reach a decent sized audience given that winscp is a pretty popular utility. I've done my research here, here, here, here, here, here and here & haven't found a suitable solution.
This is nonsense:
-hostkey="ssh-rsa 2048 redacted=ssh-rsa 2048 redacted"
(where have you seen such a strange syntax?)
It should be like:
-hostkey="ssh-rsa 2048 xxxxxxxxxxx...="
Though it does not really explain the error message you are getting – unless there are some special characters (like double quotes) in the redacted part.
In general, the easiest way is to have WinSCP GUI generate correct script template for you.
Or, if you want to go a manual way, see:
Where do I get SSH host key fingerprint to authorize the server?
Particularly the section "Automatic host key verification" (though you will want to read the article from the beginning).
I'm aware that you refer to this article yourself. But then I do not understand how you could have arrived to your strange syntax.

Unicodedecode Error when pushing to CouchDB: 'utf8' codec can't decode byte 0xe9

I am using couchdb and couchapp on windows.
I'm working on an ongoing project of a professor https://github.com/Hypertopic/Tire-a-part. I'm currently trying to set up the app on my computer.
When I do:
couchapp push http://127.0.0.1:5984/tire-a-part
I get an error:
Traceback (most recent call last):
File "couchapp\dispatch.pyc", line 48, in dispatch
File "couchapp\dispatch.pyc", line 92, in _dispatch
File "couchapp\commands.pyc", line 79, in push
File "couchapp\localdoc.pyc", line 123, in push
File "couchapp\client.pyc", line 294, in save_doc
File "json\__init__.pyc", line 231, in dumps
File "json\encoder.pyc", line 201, in encode
File "json\encoder.pyc", line 264, in iterencode
UnicodeDecodeError: 'utf8' codec can't decode byte 0xe9 in position 1:
invalid continuation byte
My professor and my friends all have mac and don't have this problem.
After a few hours on the net trying to search for similar problems I understand that it is an encoding error but i don't understand what is not correctly encoded and what should I do.
Thanks
Edit: I have discovered the debug option of couchapp. It gives much more detail but i still don't really understand as it is my first time with couchapp and couchdb. This is the last part of the debug as i don't think the begining is important:
2018-04-14 12:42:16 [DEBUG] push spec/samples/scopus.bib
2018-04-14 12:42:16 [DEBUG] push spec/spec_helper.rb
2018-04-14 12:42:16 [DEBUG] Resource uri: http://127.0.0.1:5984/tire-a-part
2018-04-14 12:42:16 [DEBUG] Request: GET _design/Tire-a-part
2018-04-14 12:42:16 [DEBUG] Headers: {'Accept': 'application/json', 'User-
Agent': 'couchapp/0.7.5'}
2018-04-14 12:42:16 [DEBUG] Params: {}
2018-04-14 12:42:16 [DEBUG] Start to perform request: GET 127.0.0.1:5984
/tire-a-part/_design/Tire-a-part
2018-04-14 12:42:16 [DEBUG] Send headers: ['GET /tire-a-part/_design/Tire-a-
part HTTP/1.1\r\n', 'Host: 127.0.0.1:5984\r\n', 'User-Agent:
restkit/3.0.4\r\n', 'Accept-Encoding: identity\r\n', 'Accept:
application/json\r\n']
2018-04-14 12:42:16 [DEBUG] Start to parse response
2018-04-14 12:42:16 [DEBUG] Got response: 404 Object Not Found
2018-04-14 12:42:16 [DEBUG] headers: [MultiDict([('X-CouchDB-Body-
Time','0'),('X-Couch-Request-ID', '5ab9eee6cb'), ('Server', 'CouchDB/2.1.1
(Erlang OTP/18)'), ('Date', 'Sat, 14 Apr 2018 10:42:16 GMT'), ('Content-
Type','application/json'), ('Content-Length', '41'), ('Cache-Control',
'must-revalidate')])]
2018-04-14 12:42:16 [DEBUG] return response class
2018-04-14 12:42:16 [DEBUG] release connection
2018-04-14 12:42:16 [DEBUG] C:\Users\jules\Desktop\LO10 projet\Tire-a-
part\vendor don't exist
2018-04-14 12:42:16 [CRITICAL] 'utf8' codec can't decode byte 0xe9 in
position
1: invalid continuation byte
I compared this with what my friend got on mac and it is the exact same except for the [CRITICAL] line. after the 'vendordon't exist' couchapp put _design/Tire-a-part
It really seem it was an encoding error of 'é'. There were 2 files with 'é' in their name. After changing it to 'e' the push command work. The app don't work but that's a story for another day....
I don't have the answer, but I tried something: I started a Python3.5 command line, and declared a variable byte='\xe9' and then printed the variable with print(byte). As can be seen below, the 0xe9 byte looks like to be the é character:
$ python3.5
Python 3.5.2 (default, Nov 23 2017, 16:37:01)
[GCC 5.4.0 20160609] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> byte='\xe9'
>>> print(byte)
é
>>>
I'm not sure why Windows has problem with the é character but macOS works fine.
On Linux shell command-line, when I put the é character in a file and take a hex-dump of the file, I see that the é character is actually equal to c3 a9, notice that the 0a is the new-line or line-feed:
$ echo 'é' > file
$ cat file
é
$ hd file
00000000 c3 a9 0a |...|
00000003
Therefore, I think the problem is that the é character is encoded with one byte of 0xe9 rather than two bytes of 0xc3 0xa9.
I played around with Go to see where the e9 comes from and I notice that the Unicode for é is actually \u00e9 and it is corresponding the two bytes of \xc3\xa9 i.e. 0xc3 and 0xa9, as shown below. Therefore, on your Windows machine, somehow the Unicode is mixed up with the hexadecimal bytes.

Not able to proceed with Windbg analysis of AppCrash_w3wp

I am doing a memory dump analysis for AppCrash_w3wp.
When I do an !analyze -v I get the following result.
Is there any problem in my symbol setup? Or is this analysis pointing to some actual issue? Could somebody please guide me on how to analyze this further?
====:>
*** WARNING: Unable to verify timestamp for webengine4.dll
Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\54c5d3ee1f311718f3a2feb337c5fa29\mscorlib.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\987d450520ea6e815c63db8aecba0761\System.Data.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Data.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Mvc\9f9155f1c13562534f6cb370b0ad8381\System.Web.Mvc.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Web.Mvc.ni.dll
*** ERROR: Module load completed but symbols could not be loaded for System.Web.Mvc.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\cb6d38da3ca9a62afed46123b693899e\System.Web.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.Web.ni.dll
Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_64\System\4598449d72d7ebbd53952399ed5fc710\System.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for System.ni.dll
*** WARNING: Unable to verify timestamp for alk_dalkutil64.dll
*** ERROR: Module load completed but symbols could not be loaded for alk_dalkutil64.dll
FAULTING_IP:
KERNELBASE!RaiseException+39
000007fe`fda8940d 4881c4c8000000 add rsp,0C8h
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fefda8940d (KERNELBASE!RaiseException+0x0000000000000039)
ExceptionCode: e0434352 (CLR exception)
ExceptionFlags: 00000001
NumberParameters: 5
Parameter[0]: ffffffff80004003
Parameter[1]: 0000000000000000
Parameter[2]: 0000000000000000
Parameter[3]: 0000000000000000
Parameter[4]: 000007fefa140000
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000001470000 rbx=000000001791d5d0 rcx=0000000001470000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000002
rip=0000000077be186a rsp=000000001791d498 rbp=0000000000000002
r8=0000000000000000 r9=0000000000000040 r10=0000000000000000
r11=0000000000000286 r12=0000000000000000 r13=000000001791d540
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwWaitForMultipleObjects+0xa:
00000000`77be186a c3 ret
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>
EXCEPTION_PARAMETER1: ffffffff80004003
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_PARAMETER3: 0000000000000000
EXCEPTION_PARAMETER4: 0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: w3wp.exe
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
MANAGED_STACK:
EXCEPTION_OBJECT: !pe 103f98b08
Exception object: 0000000103f98b08
Exception type: System.AccessViolationException
Message: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
InnerException: <none>
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 80004003
MANAGED_OBJECT: !dumpobj ffb11420
Name: System.String
MethodTable: 000007fef8886500
EEClass: 000007fef81a3750
Size: 26(0x1a) bytes
File: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
String:
Fields:
MT Field Offset Type VT Attr Value Name
0000000000000000 40000aa 8 System.Int32 1 instance 0 m_stringLength
0000000000000000 40000ab c System.Char 1 instance 0 m_firstChar
000007fef8886500 40000ac 18 System.String 0 shared static Empty
>> Domain:Value 0000000002488520:NotInit 0000000002576750:NotInit <<
EXCEPTION_MESSAGE: Attempted to read or write protected memory. This is often an indication that other memory is corru
MANAGED_OBJECT_NAME: SYSTEM.ACCESSVIOLATIONEXCEPTION
MANAGED_STACK_COMMAND: ** Check field _remoteStackTraceString **;!do 103f98b08;!do ffb11420
LAST_CONTROL_TRANSFER: from 000007fefa35565b to 000007fefda8940d
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION
STACK_TEXT:
00000000`00000000 00000000`00000000 w3wp!Unknown+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: w3wp!Unknown
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: w3wp
IMAGE_NAME: w3wp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7afa2
STACK_COMMAND: ** Check field _remoteStackTraceString **;!do 103f98b08;!do ffb11420 ; ** Pseudo Context ** ; kb
FAILURE_BUCKET_ID: WRONG_SYMBOLS_e0434352_w3wp.exe!Unknown
BUCKET_ID: X64_APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_w3wp!Unknown
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:wrong_symbols_e0434352_w3wp.exe!unknown
FAILURE_ID_HASH: {419a5b7f-31d5-d77e-cd0e-fe26c9258bfb}
Followup: MachineOwner
===
Edited on September 25
I have set up an environment variable
_NT_SYMBOL_PATH - symsrv*symsrv.dll*C:\Windows\symbols*http://msdl.microsoft.com/download/symbols
I am wondering why isn't it loading all symbols dynamically?
I did a .symfix;.reload
I get the prompt for sometime. Then I get a lot of .... on the screen and the regular prompt is back.
Then I did a "!sym noisy" and did ".symfix;.reload" again...
I get the following messages
DBGHELP: Symbol Search Path: cache*;SRV*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: cache*;SRV*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: cache*;SRV*http://msdl.microsoft.com/download/symbols
..
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\ntdll.dll\51FB164A1a9000\ntdll.dll - OK
DBGENG: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\ntdll.dll\51FB164A1a9000\ntdll.dll - Mapped image memory
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\ntdll.pdb\400F215C54DA404788F84F5C504914952\ntdll.pdb already cached
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\ntdll.pdb\400F215C54DA404788F84F5C504914952\ntdll.pdb already cached
DBGHELP: ntdll - public symbols
C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\ntdll.pdb\400F215C54DA404788F84F5C504914952\ntdll.pdb
..............................................................
................................................................
................................................................
................................................................
................................................................
.....
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\kernel32.dll\51FB167611f000\kernel32.dll - OK
DBGENG: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\kernel32.dll\51FB167611f000\kernel32.dll - Mapped image memory
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\KERNELBASE.dll\51FB16776b000\KERNELBASE.dll - OK
DBGENG: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\KERNELBASE.dll\51FB16776b000\KERNELBASE.dll - Mapped image memory
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\kernelbase.pdb\88D04DC8E39B4CBB9CB12366C2AE475F2\kernelbase.pdb already cached
DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\kernelbase.pdb\88D04DC8E39B4CBB9CB12366C2AE475F2\kernelbase.pdb already cached
DBGHELP: KERNELBASE - public symbols
C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\kernelbase.pdb\88D04DC8E39B4CBB9CB12366C2AE475F2\kernelbase.pdb
Is there any problem in my symbol setup?
Yes. Correct it with the commands
.symfix x:\symbols; * Wherever you want the symbols to be
.reload
Or, if you have other symbol paths already set up:
.symfix+ x:\symbols
.reload
Or is this analysis pointing to some actual issue?
Also. You have a .NET exception which crashes your program. That is an issue.
The type is AccessViolation, something similar to a NullReferenceException. Hopefully, fixing symbols does not make a huge deifference here.
Could somebody please guide me on how to analyze this further?
After fixing the symbols, proceed with
.loadby sos clr
!pe
!clrstack

Windbg wrong symbols msvcr80

I'm investigating a w3wp crash on our production machines, I'm loading the crashdump with windbg with the following settings:
SRV*C:\MicrosoftSymbols*http://msdl.microsoft.com/download/symbols;C:\MySymbols
sym noisy
(also tried symbol path http://msdn.microsoft.com/en-us/windows/hardware/gg463028)
Why can't it still not load the msvcr80 symbols?
0:025> !analyze -v
*
Exception Analysis *
*
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\w3wp.exe\45D6968E5000\w3wp.exe - OK DBGENG:
C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\w3wp.exe\45D6968E5000\w3wp.exe - Mapped
image memory DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorwks.dll\4889DC18590000\mscorwks.dll -
OK DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorwks.dll\4889DC18590000\mscorwks.dll -
Mapped image memory SYMSRV: mscorwks.pdb from
http://msdl.microsoft.com/download/symbols: 4599999 bytes - copied
DBGHELP: mscorwks - public symbols
c:\microsoftsymbols\mscorwks.pdb\37AFE5AF09D54705B6B685CBCD2208FC2\mscorwks.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- mismatched DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- mismatched DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found SYMSRV: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- file not found DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found SYMSRV:
c:\microsoftsymbols\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll not
found SYMSRV:
http://msdl.microsoft.com/download/symbols/mscorlib.ni.dll/4889DC80af7000/mscorlib.ni.dll
not found DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found DBGHELP: mscorlib.ni.dll not found in c:\mysymbols
DBGHELP: mscorlib.ni.dll not found in c:\mysymbols DBGENG:
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll - Couldn't map image from disk. Unable to load image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll,
Win32 error 0n2 DBGENG: mscorlib.ni.dll - Partial symbol image load
missing image info DBGHELP: Module is not fully loaded into memory.
DBGHELP: Searching for symbols using debugger-provided data. SYMSRV:
mscorlib.pdb from http://msdl.microsoft.com/download/symbols: 117111
bytes - copied
* WARNING: Unable to verify timestamp for mscorlib.ni.dll DBGHELP: mscorlib_ni - public symbols
c:\microsoftsymbols\mscorlib.pdb\E47AF49130474776AF6C5994C50088421\mscorlib.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\kernel32.dll\49C51F0A102000\kernel32.dll -
OK DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\kernel32.dll\49C51F0A102000\kernel32.dll -
Mapped image memory SYMSRV: kernel32.pdb from
http://msdl.microsoft.com/download/symbols: 416879 bytes - copied
DBGHELP: kernel32 - public symbols
c:\microsoftsymbols\kernel32.pdb\BE496DC9472F4438B080C70594D8F9CC2\kernel32.pdb
SYMSRV: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll not
found SYMSRV: user32.dll from
http://msdl.microsoft.com/download/symbols: 266731 bytes - copied
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll already
cached DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll already
cached DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll - OK
DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll -
Mapped image memory SYMSRV: user32.pdb from
http://msdl.microsoft.com/download/symbols: 293451 bytes - copied
DBGHELP: user32 - public symbols
c:\microsoftsymbols\user32.pdb\B29B53A483EA4F5DAF2BF0FB1A4E7DB92\user32.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\ole32.dll\45D70AA5139000\ole32.dll - OK
DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\ole32.dll\45D70AA5139000\ole32.dll - Mapped
image memory SYMSRV: ole32.pdb from
http://msdl.microsoft.com/download/symbols: 1014574 bytes - copied
DBGHELP: ole32 - public symbols
c:\microsoftsymbols\ole32.pdb\DC8A079CAE0B4A0C89EC5A936EAF1F7F2\ole32.pdb
FAULTING_IP: msvcr80!terminate+4d 781346b4 e820460000 call
msvcr80!_SEH_epilog4 (78138cd9)
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 781346b4 (msvcr80!terminate+0x0000004d)
ExceptionCode: 40000015 ExceptionFlags: 00000000 NumberParameters: 0
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0x40000015 - {Fatal Application Exit} %hs
EXCEPTION_CODE: (NTSTATUS) 0x40000015 (1073741845) - {Fatal
Application Exit} %hs
APP: w3wp.exe
MANAGED_STACK: !dumpstack -EE No export dumpstack found
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 00000000 to 781346b4
STACK_TEXT: 14b98e30 00000000 00000000 00000000 00000000
msvcr80!terminate+0x4d
FOLLOWUP_IP: msvcr80!terminate+4d 781346b4 e820460000 call
msvcr80!_SEH_epilog4 (78138cd9)
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: msvcr80!terminate+4d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: msvcr80
IMAGE_NAME: msvcr80.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4889d619
STACK_COMMAND: ~25s; .ecxr ; kb
FAILURE_BUCKET_ID: WRONG_SYMBOLS_40000015_msvcr80.dll!terminate
BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_msvcr80!terminate+4d
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOne/w3wp_exe/6_0_3790_3959/45d6968e/msvcr80_dll/8_0_50727_3053/4889d619/40000015/000046b4.htm?Retriage=1
WATSON_IBUCKET: 977211931
WATSON_IBUCKETTABLE: 1
Followup: MachineOwner
Regards,
Michel
Sometimes Windbg need access to .dll file itself to be able to locate the .pdb
(if the actual dump don’t contain enough of the header)
Find the msvcr80.dll from the crashed machine, and locate it by
File->Image File Path, and .reload