|
| 1 | +--- |
| 2 | +name: windows-dmp-analysis |
| 3 | +description: 分析 Windows 崩溃转储文件(.dmp),诊断 MaaNTE 及其依赖项(MaaFramework、MXU)的崩溃。自动从 GitHub Releases 下载对应版本 PDB 符号,使用 minidump-stackwalk 解析堆栈轨迹并定位崩溃根因。当 issue 日志包或附件中发现 .dmp 文件,或用户要求分析 DMP/崩溃转储时使用。 |
| 4 | +--- |
| 5 | + |
| 6 | +# Windows DMP Analysis |
| 7 | + |
| 8 | +## Scope |
| 9 | + |
| 10 | +- Windows minidump (.dmp) files from MaaNTE. |
| 11 | +- MaaNTE crashes almost always originate in **MaaFramework** (C++) or **MXU** (Rust/Tauri), not MaaNTE's Python code. |
| 12 | +- Only x86_64 covered below; for aarch64, substitute `x86_64` → `aarch64` in all download URLs. |
| 13 | + |
| 14 | +## Prerequisites |
| 15 | + |
| 16 | +在本仓库的 CI workflow 中会安装并确保 `minidump-stackwalk` 和 `dump_syms` 可用。如果你在本地复现或手动运行本流程,需要自行安装这些工具: |
| 17 | + |
| 18 | +```bash |
| 19 | +which minidump-stackwalk && which dump_syms |
| 20 | +``` |
| 21 | + |
| 22 | +If either is missing, install via: |
| 23 | + |
| 24 | +```bash |
| 25 | +curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash |
| 26 | +cargo binstall -y --no-confirm minidump-stackwalk dump_syms |
| 27 | +``` |
| 28 | + |
| 29 | +## Workflow |
| 30 | + |
| 31 | +### 1. Obtain DMP |
| 32 | + |
| 33 | +Download `.dmp` to `.cache/dmp-analysis/issue-<number>/`. |
| 34 | + |
| 35 | +Sources: |
| 36 | + |
| 37 | +- Direct issue attachment (image/file link ending in `.dmp`) |
| 38 | +- Inside `MaaNTE-logs-*.zip` log package |
| 39 | + |
| 40 | +```bash |
| 41 | +WORK=".cache/dmp-analysis/issue-<NUMBER>" |
| 42 | +mkdir -p "$WORK" |
| 43 | +curl -L "<dmp_url>" -o "$WORK/crash.dmp" |
| 44 | +``` |
| 45 | + |
| 46 | +### 2. Quick unsymbolicated analysis |
| 47 | + |
| 48 | +```bash |
| 49 | +minidump-stackwalk "$WORK/crash.dmp" 2>/dev/null |
| 50 | +``` |
| 51 | + |
| 52 | +This gives without any symbols: OS info, exception type, module list with versions, raw stack frames. |
| 53 | + |
| 54 | +Identify the **crashing module** from the exception address or the top stack frame. |
| 55 | + |
| 56 | +### 3. Determine dependency versions |
| 57 | + |
| 58 | +DMP module version info is frequently empty/unavailable. Prefer log and config sources: |
| 59 | + |
| 60 | +| Priority | Source | How | |
| 61 | +| -------- | ------ | --- | |
| 62 | +| 1 | MXU logs | `maa_init success, version: v5.x.x` | |
| 63 | +| 2 | Agent logs | `PI_CLIENT_MAAFW_VERSION` in PI environment log | |
| 64 | +| 3 | Config files from logs package | `interface.json`, config files | |
| 65 | +| 4 | Issue text | User-reported version | |
| 66 | +| 5 | Module list in stackwalk output | Version column (often shows `?`) | |
| 67 | + |
| 68 | +Record: |
| 69 | + |
| 70 | +- **MaaFramework version** (e.g. `5.9.2`) |
| 71 | +- **MXU version** (e.g. `1.21.2`) |
| 72 | + |
| 73 | +### 4. Download PDB symbols |
| 74 | + |
| 75 | +#### MaaFramework |
| 76 | + |
| 77 | +```bash |
| 78 | +MAA_VER="<version>" # e.g. 5.9.2 |
| 79 | +curl -sL "https://github.com/MaaXYZ/MaaFramework/releases/download/v${MAA_VER}/MAA-win-x86_64-v${MAA_VER}.zip" \ |
| 80 | + -o "$WORK/maa-fw.zip" |
| 81 | +unzip -joq "$WORK/maa-fw.zip" 'symbol/*.pdb' -d "$WORK/pdb/" |
| 82 | +``` |
| 83 | + |
| 84 | +PDB files inside `symbol/`: |
| 85 | + |
| 86 | +| PDB | Corresponding Module | |
| 87 | +| --- | -------------------- | |
| 88 | +| MaaFramework.pdb | MaaFramework.dll — core pipeline runtime | |
| 89 | +| MaaUtils.pdb | MaaUtils.dll — utility library | |
| 90 | +| MaaToolkit.pdb | MaaToolkit.dll — toolkit | |
| 91 | +| MaaWin32ControlUnit.pdb | MaaWin32ControlUnit.dll — Win32 controller | |
| 92 | +| MaaAdbControlUnit.pdb | MaaAdbControlUnit.dll — ADB controller | |
| 93 | +| MaaAgentServer.pdb | MaaAgentServer.dll — agent server | |
| 94 | +| MaaAgentClient.pdb | MaaAgentClient.dll — agent client | |
| 95 | +| MaaPiCli.pdb | MaaPiCli.exe — CLI entry | |
| 96 | + |
| 97 | +#### MXU |
| 98 | + |
| 99 | +```bash |
| 100 | +MXU_VER="<version>" # e.g. 1.21.2 |
| 101 | +curl -sL "https://github.com/MistEO/MXU/releases/download/v${MXU_VER}/MXU-win-x86_64-v${MXU_VER}.zip" \ |
| 102 | + -o "$WORK/mxu.zip" |
| 103 | +unzip -joq "$WORK/mxu.zip" 'mxu.pdb' -d "$WORK/pdb/" |
| 104 | +``` |
| 105 | + |
| 106 | +### 5. Convert PDB → Breakpad .sym |
| 107 | + |
| 108 | +```bash |
| 109 | +mkdir -p "$WORK/symbols" |
| 110 | +for pdb in "$WORK/pdb/"*.pdb; do |
| 111 | + name=$(basename "$pdb" .pdb) |
| 112 | + header=$(dump_syms "$pdb" 2>/dev/null | head -1) |
| 113 | + debug_id=$(echo "$header" | awk '{print $4}') |
| 114 | + dest="$WORK/symbols/${name}.pdb/${debug_id}" |
| 115 | + mkdir -p "$dest" |
| 116 | + dump_syms "$pdb" > "$dest/${name}.sym" 2>/dev/null |
| 117 | +done |
| 118 | +``` |
| 119 | + |
| 120 | +### 6. Full symbolicated stack walk |
| 121 | + |
| 122 | +```bash |
| 123 | +minidump-stackwalk "$WORK/crash.dmp" "$WORK/symbols" 2>/dev/null |
| 124 | +``` |
| 125 | + |
| 126 | +### 7. Analyze results |
| 127 | + |
| 128 | +#### What to focus on |
| 129 | + |
| 130 | +1. **Crashing thread** — read stack top-down. |
| 131 | +2. **Exception type**: |
| 132 | + - `EXCEPTION_ACCESS_VIOLATION` (0xC0000005) — null/dangling pointer, use-after-free |
| 133 | + - `EXCEPTION_STACK_OVERFLOW` (0xC00000FD) — infinite recursion or oversized stack allocation |
| 134 | + - `EXCEPTION_ILLEGAL_INSTRUCTION` (0xC000001D) — corrupted code or wrong CPU feature |
| 135 | + - `STATUS_STACK_BUFFER_OVERRUN` (0xC0000409) — **NOT always a real buffer overrun.** Check the first exception parameter: |
| 136 | + - `0x7` = `FAST_FAIL_FATAL_APP_EXIT` — `std::terminate()` / `abort()` was called, typically from an **unhandled C++ exception** (e.g. `cv::Exception` from OpenCV). This is the most common crash pattern. |
| 137 | + - `0x2` = `FAST_FAIL_RANGE_CHECK_FAILURE` |
| 138 | + - Other values: see [FAST_FAIL codes](https://learn.microsoft.com/en-us/windows/win32/debug/fast-fail-constants) |
| 139 | + - `EXCEPTION_BREAKPOINT` (0x80000003) — deliberate crash / assertion failure / Rust panic |
| 140 | +3. **Faulting module ownership**: |
| 141 | + - `Maa*.dll` → MaaFramework → upstream `MaaXYZ/MaaFramework` |
| 142 | + - `mxu.exe` → MXU → upstream `MistEO/MXU` |
| 143 | + - `onnxruntime_maa.dll`, `opencv_world4_maa.dll` → third-party inference/vision |
| 144 | + - `DirectML.dll` → DirectX ML runtime |
| 145 | + - `ntdll.dll`, `KERNELBASE.dll`, `ucrtbase.dll` → OS / CRT; look at the caller frames above |
| 146 | + - If crash address is in `ucrtbase.dll` with code 0xC0000409, the real crash site is in the **caller frames**, not ucrtbase itself |
| 147 | + |
| 148 | +### 8. Cross-reference with source |
| 149 | + |
| 150 | +If the crash is in MaaFramework: |
| 151 | + |
| 152 | +```bash |
| 153 | +git clone --depth 1 --branch "v${MAA_VER}" \ |
| 154 | + https://github.com/MaaXYZ/MaaFramework.git ".cache/upstream-src/MaaFramework" |
| 155 | +``` |
| 156 | + |
| 157 | +If the crash is in MXU: |
| 158 | + |
| 159 | +```bash |
| 160 | +git clone --depth 1 --branch "v${MXU_VER}" \ |
| 161 | + https://github.com/MistEO/MXU.git ".cache/upstream-src/MXU" |
| 162 | +``` |
| 163 | + |
| 164 | +Look up the function and line from the symbolicated stack trace in the cloned source. |
| 165 | + |
| 166 | +## Output Format |
| 167 | + |
| 168 | +```markdown |
| 169 | +## DMP 分析结果 |
| 170 | + |
| 171 | +- DMP 文件:`<filename>` |
| 172 | +- 操作系统:`<OS version>` |
| 173 | +- 异常类型:`<EXCEPTION_*>` |
| 174 | +- 崩溃模块:`<module_name>` (版本 `<version>`) |
| 175 | +- 崩溃函数:`<symbolicated function name>` |
| 176 | + |
| 177 | +## DMP 崩溃分析 |
| 178 | + |
| 179 | +### 崩溃堆栈(crashing thread) |
| 180 | + |
| 181 | +<crashing thread 的全部有效符号化堆栈帧> |
| 182 | + |
| 183 | +### 关键模块版本 |
| 184 | + |
| 185 | +| Module | Version | |
| 186 | +| ---------------- | ------- | |
| 187 | +| mxu.exe | ... | |
| 188 | +| MaaFramework.dll | ... | |
| 189 | +| ... | ... | |
| 190 | + |
| 191 | +### 根因判断 |
| 192 | + |
| 193 | +- 崩溃归属:MaaFramework / MXU / 第三方依赖 / 未知 |
| 194 | +- 分析:... |
| 195 | +- 置信度:高 / 中 / 低 |
| 196 | + |
| 197 | +### 建议 |
| 198 | + |
| 199 | +- 对用户的建议(升级、绕过方案等) |
| 200 | +- 对开发者的建议(上游报告、修复方向) |
| 201 | +``` |
| 202 | + |
| 203 | +## Cleanup |
| 204 | + |
| 205 | +After analysis is complete: |
| 206 | + |
| 207 | +```bash |
| 208 | +rm -rf ".cache/dmp-analysis/issue-<NUMBER>" |
| 209 | +``` |
0 commit comments