References

Tasks

Debuggee control:

  • go: g
  • detach: .detach
  • break: press <ctrl-break/pause>

Load sos extension

.loadby sos clr

For details about loading SOS, refer here and the following section on failure to load SOS.

List CLR stack

!CLRStack

Inspect objects (sos)

  • !DumpHeap
  • !DumpObj
  • !DumpArray
  • !DumpClass

Break on (first chance) exceptions. See sxe doc, "Event Definitions and Defaults".

sxe <eh|clr|...>

Inspect an exception (sos):

!PrintException <exception_address>

Collect a mini dump

.dump /mA

Symbol debugging:

!sym noisy
.reload

Failure Loading SOS

Sometimes loading SOS can fail when debugging dumps:

0:009> .cordll -ve -u -l
CLRDLL: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll:4.7.2115.00 f:8
doesn't match desired version 4.7.2117.00 f:8
CLRDLL: Unable to find mscordacwks_AMD64_AMD64_4.7.2117.00.dll by mscorwks search
CLRDLL: Unable to find 'mscordacwks_AMD64_AMD64_4.7.2117.00.dll' on the path
CLRDLL: Unable to find clr.dll by search
Cannot Automatically load SOS
CLRDLL: ERROR: Unable to load DLL mscordacwks_AMD64_AMD64_4.7.2117.00.dll, Win32 error 0n2
CLRDLL: Consider using ".cordll -lp <path>" command to specify .NET runtime directory.
CLR DLL status: ERROR: Unable to load DLL mscordacwks_AMD64_AMD64_4.7.2117.00.dll, Win32 error 0n2

That's because the dump is collected from a machine that has different CLR version. The best way to solve this is to copy the following DLLs from the target machine and use them to load SOS:

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\sos.dll

Put them under d:\share, and in WinDbg load with:

0:009> .cordll -lp d:\share
CLRDLL: Loaded DLL d:\share\mscordacwks.dll
Automatically loaded SOS Extension
CLR DLL status: Loaded DLL d:\share\mscordacwks.dll

Here are some useful doc: