支持的同事反應，前端某用戶使用系統時，在登錄頁面點擊輸入文本框，會崩潰。抓取到一個dmp文件
打開Windbg 加載該dmp
Windows 10 Version 18362 MP (12 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS Personal
18362.239.x86fre.19h1_release_svc_prod1.190628-1641
Machine Name:
Debug session time: Thu Jul 2 16:24:57.000 2020 (UTC + 8:00)
System Uptime: 3 days 1:03:52.119
Process Uptime: 0 days 0:09:18.000
................................................................
................................................................
................................................................
....................................................
Loading unloaded module list
.........................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(3cc0.435c): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
eax=00000000 ebx=00000000 ecx=00000000 edx=00d7025c esi=00000003 edi=00000003
eip=771823dc esp=0fd6e7c8 ebp=0fd6e958 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
ntdll!NtWaitForMultipleObjects+0xc:
771823dc c21400 ret 14h
根據加載信息可知，在id=435c的線程發生了內存訪問違例。
加載完后，windbg自動切換到了異常線程
輸入kv查看當前棧
0:011> kv
# ChildEBP RetAddr Args to Child
00 0fd6e7c4 7660c843 00000003 0fd6e9f8 00000001 ntdll!NtWaitForMultipleObjects+0xc (FPO: [5,0,0])
01 0fd6e958 7660c6f8 00000003 0fd6e9f8 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x133 (FPO: [SEH])
02 0fd6e974 76765ba7 00000003 0fd6e9f8 00000000 KERNELBASE!WaitForMultipleObjects+0x18 (FPO: [Non-Fpo])
03 0fd6ea20 767657d8 00000000 00000000 0fd6eb14 kernel32!WerpReportFaultInternal+0x3b7 (FPO: [Non-Fpo])
04 0fd6ea3c 7673c229 0fd6eae4 766abb8b 0fd6eb14 kernel32!WerpReportFault+0x9d (FPO: [Non-Fpo])
05 0fd6ea44 766abb8b 0fd6eb14 00000001 0934db8a kernel32!BasepReportFault+0x19 (FPO: [Non-Fpo])
06 0fd6eae4 771b29b8 0fd6eb14 771863d2 0fd6f828 KERNELBASE!UnhandledExceptionFilter+0x29b (FPO: [Non-Fpo])
07 0fd6f828 77177bf4 ffffffff 77198ff2 00000000 ntdll!__RtlUserThreadStart+0x3adc3
08 0fd6f838 00000000 0142d370 0f4953c8 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
輸入dd 0fd6eb14
0:011> dd 0fd6eb14
0fd6eb14 0fd6ec54 0fd6eca4 772163b8 00000001
0fd6eb24 772163a8 0011dae0 0fd6eb4c 7718a060
0fd6eb34 77233360 77183f60 0fd6ec54 0fd6f818
0fd6eb44 0fd6eca4 0fd6ebdc 0fd6eb70 77198e72
0fd6eb54 0fd6ec54 0fd6f818 0fd6eca4 0fd6ebdc
0fd6eb64 0fd6f818 77198e90 0fd6f818 0fd6ec3c
0fd6eb74 77198e44 0fd6ec54 0fd6f818 0fd6eca4
0fd6eb84 0fd6ebdc 7718a040 0fd6f818 0fd6ec54
輸入 exr 0fd6ec54查看異常記錄信息
0:011> .exr 0fd6ec54
ExceptionAddress: 3913910d (freeime!ImeToAsciiEx+0x00000ebd)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008
可知，在模塊freeime的ImeToAsciiEx的偏移0x00000ebd處內存訪問違例
輸入lmDvmfreeime查看freeime模塊信息
0:011> lmDvmfreeime
Browse full module list
start end module name
39110000 391ce000 freeime (export symbols) freeime.ime
Loaded symbol image file: freeime.ime
Image path: C:\Windows\System32\freeime.ime
Image name: freeime.ime
Browse all global symbols functions data
Timestamp: Fri Dec 30 19:40:06 2011 (4EFDA316)
CheckSum: 000AE352
ImageSize: 000BE000
File version: 7.1.5.0
Product version: 7.1.5.0
File flags: 8 (Mask 3F) Private
File OS: 40000 NT Base
File type: 3.B Driver
File date: 00000000.00000000
Translations: 0804.04b0
Information from resource tables:
CompanyName: 極點五筆工作室
ProductName: 極點五筆 紀念版
InternalName: 極點五筆 紀念版
OriginalFilename: freeime.ime
ProductVersion: 7.1.5.0
FileVersion: 7.1.5.0
FileDescription: 極點五筆 紀念版
LegalCopyright: Copyright (C) 極點五筆工作室 2001-2011
可知這個模塊是輸入法的動態庫
輸入.cxr 0fd6eca4;kv查看異常棧
0:011> .cxr 0fd6eca4;kv
eax=00000000 ebx=0f352248 ecx=00000000 edx=00d7025c esi=45fd57e0 edi=00000000
eip=3913910d esp=0fd6f184 ebp=0f2b8ea8 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210246
freeime!ImeToAsciiEx+0xebd:
3913910d 8b5808 mov ebx,dword ptr [eax+8] ds:002b:00000008=????????
*** Stack trace for last set context - .thread/.cxr resets it
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0fd6f1c8 7628e5e3 00000000 00000001 0fd6f30c freeime!ImeToAsciiEx+0xebd
01 00000000 00000000 00000000 00000000 00000000 user32!CallNextHookEx+0x93 (FPO: [Non-Fpo])
可知是用戶在點擊文本輸入框時，輸入法模塊下鈎子發生了沖突，我們既無法修改輸入法，也無法修改瀏覽器，后台也來不急修改，只好遠程用戶機幫他先卸載輸入法看看。
當遠程后，發現用戶機上有多個輸入法，很可能是在裝不明軟件時，順帶裝上的，把用戶機器上不用的輸入法都卸載了，就正常了。