An Annotated Dr. Watson Log File

The information in this article applies to:

• Microsoft Windows Software Development Kit (SDK) version 3.1

SUMMARY

Dr. Watson is a utility that logs information about applications that fail. This article presents a sample log file and explains what the various entries signify. Comments in the log file start with pound sign (#).

This article annotates a log file for the BICHO application, which tests Windows by faulting in the various ways. Bicho is Bolivian slang for "bug" or "critter."

MORE INFORMATION

# Dr. Watson writes the following line each time it starts execution # unless the [dr. watson] section of the WIN.INI file contains the # line SkipInfo=time:

Start Dr. Watson 0.80 - Thu Sep 26 10:51:28 1991

# These lines mark the beginning of a Dr. Watson failure report # They report the version of Dr. Watson and the date and time of the # reported event.

********************************************************************** Dr. Watson 0.80 Failure Report - Thu Sep 26 10:51:36 1991

# The next line reports that an application named "BICHO" encountered # an "Exceed Segment Bounds" fault while reading memory. The precise # point of failure was also in BICHO, 0x6b bytes after the start of # the DoCommand function.

BICHO had a 'Exceed Segment Bounds (Read)' fault at BICHO _DoCommand+006b

# The following line repeats the previous information formatted for # automatic parsing code. It also includes the instruction that caused # the fault (a push instruction in this case).

$tag$BICHO$Exceed Segment Bounds (Read)$BICHO _DoCommand+006b$push word ptr [fffe]$Thu Sep 26 10:51:36 1991

# The following lines report the contents of the CPU registers:

CPU Registers (regs)

# The 16-bit registers are listed first. This information can be # useful to determine what address an instruction modified when the # fault occurred.

ax=1e54 bx=0014 cx=0d7f dx=0111 si=1e54 di=0111

# The next items are the instruction pointer (otherwise known as the # program counter), stack pointer, and base pointer. This line also # lists the state of the flag bits. In this example, the Overflow, # Direction, Sign, Zero, and Carry bits are Clear (0), while the # Interrupt, Auxcarry, and Parity bits are Set (1).

ip=02fd sp=230c bp=237a O- D- I+ S- Z- A+ P+ C-

# The code segment selector is 0e57, linear address is 8059fbc0. The # code segment's limit is 83f. (Enhanced mode linear addresses often # start with 8xxx.) Accessing a code or data segment beyond its limit # is a common cause of GP faults.

cs = 0e57 8059fbc0:083f Code Ex/R

# The next line provides information about the stack segment selector.

ss = 0d7f 8059d5e0:25df Data R/W

# The following line provides information about the data segment # selector. Note that the limit is 25df, while the application # attempted to read the value at fffe, which is beyond the segment's # limit.

ds = 0d7f 8059d5e0:25df Data R/W

# The following line provides information about the extra segment # selector:

es = 0d7f 8059d5e0:25df Data R/W

# The next lines provide information about the 32-bit registers. # If a selector is 0, it corresponds to the null pointer. Attempting # to use a null pointer is another common cause of GP faults.

CPU 32 bit Registers (32bit) eax = 00001e54 ebx = 00000014 ecx = ffff0d7f edx = 00000111 esi = 00001e54 edi = 00000111 ebp = 0000237a esp = 800422fc

fs = 0000         0:0000 Null Ptr
gs = 0000         0:0000 Null Ptr

# The next lines provide information about the Windows installation.

System Info (info) Windows version 3.10 Debug build # The debug version of windows (from the SDK) was running Windows Build 3.1.048 # This is a prerelease build of Windows, #48

Username Unknown User               # Your Name Here
Organization Unknown Organization   # Your Organization Here

# The following provides the stack size for the current task:

Stack base 1122, top 9164, lowest 7504, size 8042

# Dr. Watson records some statistics about the Windows environment:

System resources: USER: 87% free, seg 0777 GDI: 85% free, seg 05d7 LargestFree 6594560, MaxPagesAvail 1610, MaxPagesLockable 267 TotalLinear 1948, TotalUnlockedPages 274, FreePages 52 TotalPages 614, FreeLinearSpace 1611, SwapFilePages 7158 Page Size 4096 4 tasks executing. WinFlags -

  Math coprocessor
  80386 or 80386 SX
  Enhanced mode
  Protect mode

Stack Dump (stack)

# Stack frame 0 indicates that the failure occurred in BICHO, 0x6b # bytes after the start of the DoCommand function, as reported # earlier.

Stack Frame 0 is BICHO _DoCommand+006b        ss:bp 0d7f:237a

0e57:02f0  e9 02b9               jmp    near 05ac
0e57:02f3  6a 00                 push   00
0e57:02f5  9a 8db0 0477          callf  0477:8db0
0e57:02fa  e9 02af               jmp    near 05ac

0e57:02fd  ff 36 fffe            push   word ptr [fffe]
0e57:0301  68 0110               push   0110
0e57:0304  e8 fe5d               call   near 0164
0e57:0307  83 c4 04              add    sp, 04

Stack Frame 1 is BICHO MAINWNDPROC+0027       ss:bp 0d7f:2388

0e57:0670  eb 16                 jmp    short 0688
0e57:0672  ff 76 0a              push   word ptr [bp+0a]
0e57:0675  56                    push   si
0e57:0676  e8 fc19               call   near 0292

0e57:0679  83 c4 04              add    sp, 04
0e57:067c  99                    cwd
0e57:067d  eb 1f                 jmp    short 069e
0e57:067f  6a 00                 push   00

Stack Frame 2 is USER IDISPATCHMESSAGE+007e   ss:bp 0d7f:239e

Stack Frame 3 is BICHO WINMAIN+0050           ss:bp 0d7f:23bc

Stack Frame 4 is BICHO 1:00a3                 ss:bp 0d7f:23ca

Task  WINEXIT, Handle 0daf, Flags 0001, Info    9248 08-09-90 16:52
  FileName C:\MS\WIN\DON\WINEXIT.EXE
Task DRWATSON, Handle 0ea7, Flags 0001, Info   26256 09-23-91 12:00
  FileName C:\WIN31\DRWATSON.EXE

  FileName C:\WIN31\PROGMAN.EXE
Task    BICHO, Handle 0da7, Flags 0001, Info   16537 09-11-91  8:45
  FileName D:\BICHO.EXE

1> I ran a test app that accessed a value 2> beyond the limits of the segment bounds.

# Dr. Watson writes this line when it shuts down.

Stop Dr. Watson 0.80 - Thu Sep 26 10:52:10 1991