Search code examples
windbgasp.net-3.5sos

Which version of sos and clr/mscorwks.dll to load?


I have a 32-bit application (targeting .NET 3.5) hosted on a 64-bit machine. I want to analyze the memory dump of this 32-bit application. I captured the memory dump using 32-bit adplus and cdb. I am loading the memory dump into 32-bit windbg. When I load .net 2.0 sos.dll and .net 2.0 mscorwks.dll into windbg and execute !clrstack, I get the following error: "Failed to find runtime DLL (mscorwks.dll), 0x80004005 Extension commands need mscorwks.dll in order to have something to do." What am I doing wrong?

Info as requested in the comments

ADPlus command line:

adplus -hang -quiet -p 2440 -o C:\temp

WinDbg commands:

0:000> .load <fullpathto>\sos.dll

0:000> lmvm mscorwks
start    end        module name

0:000> .exr -1
ExceptionAddress: 00000000
   ExceptionCode: 80000007 (Wake debugger)
  ExceptionFlags: 00000000
NumberParameters: 0

Solution

  • The dump indicates that no .NET 2 was loaded. Otherwise the output of lmvm mscorwks should show the details of the .NET runtime, like this:

    0:003> lmvm mscorwks
    start    end        module name
    61bc0000 6216e000   mscorwks   (deferred)             
        Image path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
        ...
        File version:     2.0.50727.5485
        ...
    

    You mentioned that you loaded SOS by full path. If the dump was taken on your machine, you would typically load it using

    0:003> .loadby sos mscorwks    
    

    In your case, this should already give you the hint that .NET was not loaded:

    Unable to find module 'mscorwks'
    

    If you're not so sure about the .NET version, try

    .loadby sos clr; *** .NET 4
    .loadby sos coreclr; *** Silverlight / Universal Apps
    

    Maybe you had a typo in your AdPlus command line and specified the wrong process ID. If that PID accidentally exists, you got a wrong dump. Use | to check the process name

    0:003> |
    .  0    id: 1e78    attach  name: E:\...\NET2x32.exe
    

    BTW: The -quiet parameter of ADPlus is obsolete, you can omit it.