Loading SOS

I am starting up Windbg and trying to load SOS and I get the error:

0:000> .loadby sos.dll mscorwks
The call to LoadLibrary(C:\Program Files\Debugging Tools for Windows
(x86)\sym\mscorwks.dll\4BEBD49A591000\sos.dll) failed, Win32 error 0n126
“The specified module could not be found.”
Please check your debugger configuration and/or network access.

If I preface the call with

.symfix
.reload
.loadby sos.dll mscorwks

I simply get the warning:

sos.dll needs a full memory dump for complete functionality.
You can create one with .dump /ma

I am not sure what I need to do so that mscorwks starts up without first
having to use the commands .symfix and .reload?

One more question. I copied the sosex.dll to the installation directory
of Debugging Tools for Windows (x86) and I get:

0:000> .load sosex.dll
The call to LoadLibrary(sosex.dll) failed, Win32 error 0n193
“%1 is not a valid Win32 application.”
Please check your debugger configuration and/or network access.

This may have to do with the fact that the sosex.dll assembly is x64. I
am not aware of where x64 for Debugging Tools for Windows is available
so I was assuming that the x86 version will support bot via something
like WOW64?

Are you sure that this is not an .NET 4.0 Process? ‘mscorwrk.dll’ don’t exist anymore. The unmanaged CLR Implementation is now in ‘clr.dll’.

You shall use:
.loadby sos clr

You can first check with
lm
if the ‘clr.dll’ module is loaded.

For .NET 4.0 Debugging you have to use a recent version of windbg (6.12 works for sure, 6.9 not).

Are you attaching to a running process, or starting a new one? If it’s a new process the CLR will not be loaded at the initial Breakpoint. You can eigher use
.load
or wait until you get the Load-Image notification for clr.dll.

GP

It is not a .NET 4.0 process (at least I don’t think it is). I compiled with
VS 2010 but in the project settings I indicated .NET 3.5. So I am pretty
sure that it isn’t. I will check with ‘lm’ just to be sure. Thank you.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@world-direct.at
Sent: Thursday, February 17, 2011 4:07 AM
To: Kernel Debugging Interest List
Subject: RE:[windbg] Loading SOS

Are you sure that this is not an .NET 4.0 Process? ‘mscorwrk.dll’ don’t
exist anymore. The unmanaged CLR Implementation is now in ‘clr.dll’.

You shall use:
.loadby sos clr

You can first check with
lm
if the ‘clr.dll’ module is loaded.

For .NET 4.0 Debugging you have to use a recent version of windbg (6.12
works for sure, 6.9 not).

Are you attaching to a running process, or starting a new one? If it’s a new
process the CLR will not be loaded at the initial Breakpoint. You can eigher
use .load or wait until you get the Load-Image notification
for clr.dll.

GP


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

The Path ‘C:\Program Files\Debugging Tools for Windows
(x86)\sym\mscorwks.dll\4BEBD49A591000\sos.dll’ seems to be strage. Are you debugging the Debugger?

The output of ‘lm’ would be very interesting in this case.

You have not answered if you are attaching to a proces or if you are starting a new one.

GP

The output of ‘lm’ looks like:

0:000> lm
start end module name
00e10000 00e3e000 BulkUploadTool (deferred)
026a0000 02c31000 mscorwks (deferred)
062d0000 067d0000 DocumentFormat_OpenXml (deferred)
10100000 1010e000 lgscroll (deferred)
50c00000 50f2f000 WindowsBase_ni (deferred)
53b40000 546ea000 PresentationCore_ni (deferred)
55290000 5603c000 PresentationFramework_ni (deferred)
5a350000 5a515000 System_Web_Services_ni (deferred)
5a520000 5a6cc000 wpfgfx_v0300 (deferred)
5ce10000 5cefa000 Microsoft_CommerceServer_Catalog (deferred)
5cf00000 5cff1000 System_Configuration_ni (deferred)
5f200000 5f999000 System_ni (deferred)
62810000 62d46000 System_Xml_ni (deferred)
64020000 64033000 mscorsec (deferred)
65a60000 65a90000 Microsoft_CommerceServer_CrossTierTypes (deferred)
65cb0000 667a8000 mscorlib_ni (deferred)
6d020000 6d035000 adialhk (deferred)
70550000 705d0000 uxtheme (deferred)
705d0000 7062b000 mscorjit (deferred)
72440000 724a6000 mscoreei (deferred)
72600000 72613000 dwmapi (deferred)
72710000 7275a000 mscoree (deferred)
73370000 73391000 ntmarta (deferred)
73450000 7345e000 devrtl (deferred)
73510000 73525000 cabinet (deferred)
73530000 73536000 SensApi (deferred)
73540000 7355c000 cryptnet (deferred)
73560000 73576000 gpapi (deferred)
735b0000 735e8000 ncrypt (deferred)
73fd0000 7400d000 bcryptprimitives (deferred)
74010000 74027000 bcrypt (deferred)
74230000 7427b000 apphelp (deferred)
747d0000 7480b000 rsaenh (deferred)
74850000 748eb000 msvcr80 (deferred)
74980000 74996000 cryptsp (deferred)
749c0000 749ce000 RpcRtRemote (deferred)
749d0000 749db000 profapi (deferred)
749e0000 749f7000 userenv (deferred)
74b30000 74b39000 version (deferred)
74b40000 74bc4000 comctl32 (deferred)
74ca0000 74cac000 CRYPTBASE (deferred)
74cb0000 74d10000 sspicli (deferred)
74d80000 74dc6000 KERNELBASE (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\sym\wkernelbase.pdb\74D5C6E200BD410780AD91A62D03C8CA1\wkernelbase.pdb
74dd0000 74e5f000 oleaut32 (deferred)
751c0000 75205000 Wldap32 (deferred)
75210000 752a0000 gdi32 (deferred)
752a0000 75340000 advapi32 (deferred)
75340000 753dd000 usp10 (deferred)
753e0000 753f9000 sechost (deferred)
75480000 7559c000 crypt32 (deferred)
755a0000 756a0000 user32 (deferred)
756a0000 757a0000 kernel32 (deferred)
757a0000 757cd000 wintrust (deferred)
75810000 7581c000 msasn1 (deferred)
75820000 75877000 shlwapi (deferred)
75a80000 75ae0000 imm32 (deferred)
75ae0000 75c3c000 ole32 (deferred)
75c40000 75c4a000 lpk (deferred)
75c50000 75d1c000 msctf (deferred)
75ef0000 75f1a000 imagehlp (deferred)
75f50000 76040000 rpcrt4 (deferred)
76040000 76c89000 shell32 (deferred)
76c90000 76d3c000 msvcrt (deferred)
77140000 772c0000 ntdll (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\sym\wntdll.pdb\FC9DB05873374DB5985BABAA3F8F734F2\wntdll.pdb

Unloaded modules:
75f20000 75f47000 CFGMGR32.dll
750a0000 750b2000 DEVOBJ.dll
74f00000 7509d000 setupapi.dll
60210000 60286000 RichEd20.dll
60340000 60348000 culture.dll

On Fri, Feb 18, 2011 at 6:11 AM, xxxxx@world-direct.at
wrote:

The Path ‘C:\Program Files\Debugging Tools for Windows
(x86)\sym\mscorwks.dll\4BEBD49A591000\sos.dll’ seems to be strage. Are
you debugging the Debugger?

The output of ‘lm’ would be very interesting in this case.

You have not answered if you are attaching to a proces or if you are
starting a new one.

GP

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Hallo Kevin,

sorry for the Delay. I was out of office.

Please provide the output of:

version

lm v m mscorwks

GP

0:000> lm v m mscorwks
start end module name
026a0000 02c31000 mscorwks (deferred)
Mapped memory image file: C:\Program Files\Debugging Tools for
Windows (x86)\sym\mscorwks.dll\4BEBD49A591000\mscorwks.dll
Image path:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
Image name: mscorwks.dll
Timestamp: Thu May 13 05:29:46 2010 (4BEBD49A)
CheckSum: 0059AAE3
ImageSize: 00591000
File version: 2.0.50727.4952
Product version: 2.0.50727.4952
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: mscorwks.dll
OriginalFilename: mscorwks.dll
ProductVersion: 2.0.50727.4952
FileVersion: 2.0.50727.4952 (win7RTMGDR.050727-4900)
FileDescription: Microsoft .NET Runtime Common Language Runtime -
WorkStation
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail

On Wed, Feb 23, 2011 at 5:35 AM, xxxxx@world-direct.at
wrote:

Hallo Kevin,

sorry for the Delay. I was out of office.

Please provide the output of:

version

lm v m mscorwks

GP

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer