Can’t load sos when looking at a dump

I sometimes hear people complain that they tried to open a dump file in windbg, but couldn’t get sos running. First, make sure that you are loading the dump with the corresponding debugger – open an x86 dump with an x86 debugger and an x64 one with the x64 debugger. (To learn more about memory dumps and sos, read Back to Basics - How do I get the memory dumps in the first place? And what is SOS.dll? - great blog entry from Tess).

If you are using the right debugger, the failures to load sos usually happen because the .NET Framework version on your current machine (where you try to open the dump) differs from the .NET Framework version on the machine where the dump was taken (to see the version of the framework in debugger, look at mscorwks module with .lmv m mscorwks) . So when you try to load sos with .loadby sos mscorwks, the debugger looks in the framework directory on the current machine – not good.

The solution is to specify a directory where the initial version of the framework is. To be precise, the debugger needs the right version of mscordackws.dll.

So open the dump in windbg, and type .cordll –u –lp <mscordacwks directory> . This commandtells the debugger to unload the CLR debugging modules (-u) and to load them from the specified directory (-lp). After that, .load mscorwks should do the trick.

Of course, sometimes finding the right framework version can be a challenge in itself. To make things easier, when I take a dump that multiple people need to look at (or I’ll look at from different machines), I also save mscordacwks.dll and mscorwks.dll. The debugger is looking for a file named mscordacwks_Arch_Arch_2.0.50727.3053.dll (eg. mscordacwks_x86_x86_2.0.50727.3053.dll), so I make a copy of mscordacwks.dll and rename it with this format.

Once you have the dumps (eg in c:\dumps\dump.dmp) and the framework dlls (in c:\dumps\FxLibraries), the recipe is simple:

.cordll –u –lp c:\dump\FxLibraries

.load mscorwks

If that doesn’t work, try .load c:\dump\FxLibraries\mscorwk

Et voila, happy sos debugging!