ANSWER: POP QUIZ: SOS not loading

So this was a multi-part quiz.  The answers to the 4 questions posed are:

What is going on here?

We are trying to load the mscordacwks file that corresponds with the dump.  If we are unable to load this file, sos won’t work.  This is for .NET 2.0, in 1.x we had BIN files that served a similar purpose.

The reason we see this error is that the dump is being opened on a machine different then where the dump was captured.  The debugger will automatically look for the file in the path of .NET that is in the dump.

Why can’t we run sos commands on this dump?

Since we can’t find the mscordacwks file we need, things won’t work.  Looking at the error, it is looking for mscordacwks_AMD64_AMD64_2.0.50215.312.dll.  This version of the file cannot be found.  We look for a version of this file that matches the version of .NET that was used in the process we captured the dump.

What is mscordacwks?

A file used to allow us to find the correct data in the dump.  This file helps us to find the offsets of data that we need to find in the dump.

How do we fix it?

To fix this error, we need to get that mscordacwks which matches the version where the dump was taken.  The easiest way to get this is to look in the .NET Framework folder on the machine where the dump came from.  If we copy that file and rename it with version information as we see in the debugger output, then the debugger can use it.  We just place it in a directory included in our symbol path and the .cordll command will work.

Additional Trivia

This error shows a file being looked for of mscordacwks_x86_AMD64_2.0.50727.926.dll.  We have to use the same architecture version of the debugger as the process being debugged.  So a 64-bit dump, must be opened in a 64-bit debugger and the same with a 32-bit dump.

Comments

• Anonymous
  April 09, 2008
  Thanks for posting the answers. Helpful! Josh Coswell http://riverasp.net