SOS Debugging Extension (SOS.dll)
The SOS Debugging Extension (SOS.dll) helps you debug managed programs in the WinDbg.exe debugger and in Visual Studio by providing information about the internal common language runtime (CLR) environment.
![command] [options]
Commands
| Command | Description |
|---|---|
BPMD [<module name> <method name>] [-md <MethodDesc>] |
Creates a breakpoint at the specified method in the specified module. If the specified module and method have not been loaded, this command waits for a notification that the module was loaded and just-in-time compiled before creating a breakpoint. |
CLRStack [-a] [-l] [-p] |
Provides a stack trace of managed code only. The -p option shows arguments to the managed function. The -l option shows information on local variables in a frame. The SOS Debugging Extension cannot retrieve local names, so the output for local names is in the format <local address> = <value>. The -a (all) option is a shortcut for -l and -p combined. The SOS Debugging Extension does not display Transition Frames on x64 and IA-64-based platforms. |
COMState |
Lists the COM apartment model for each thread and a Context pointer, if available. |
DumpArray [-start <startIndex>] [-length <length>] [-details] [-nofields] <array object address> -or- DA [-start <startIndex>] [-length <length>] [-detail] [-nofields] array object address> |
Examines elements of an array object. The -start option specifies the starting index at which to display elements. The -length option specifies how many elements to show. The -detail option displays details of the element using the DumpObj and DumpVC formats. The -nofields option prevents arrays from displaying. This option is available only when the -detail option is specified. |
DumpAssembly <Assembly address> |
Displays information about an assembly. The DumpAssembly command lists multiple modules, if they exist. You can get an assembly address using the DumpDomain command. |
DumpClass <EEClass address> |
Displays information about the EEClass structure associated with a type. The DumpClass command displays static field values but does not display nonstatic field values. Use the DumpMT, DumpObj, Name2EE, or Token2EE commands to get an EEClass structure address. |
DumpDomain [<Domain address>] |
Enumerates each Assembly object loaded within the specified AppDomain object address. When called with no parameters, the DumpDomain command lists all AppDomain objects in a process. |
DumpHeap [-stat] [-min <size>][-max <size>] [-thinlock] [-mt <MethodTable address>] [-type <partial type name>][start [end]] |
Displays information about the garbage-collected heap and collection statistics about objects. The DumpHeap command displays a warning if it detects excessive fragmentation in the garbage collector heap. The -stat option restricts the output to the statistical type summary. The -min option ignores objects that are less than the size parameter, specified in bytes. The -max option ignores objects that are larger than the size parameter, specified in bytes. The -thinlock option reports ThinLocks. For more information, see the SyncBlk command. The -mt option lists only those objects that correspond to specified the MethodTable structure. The -type option lists only those objects whose type name is a substring match of the specified string. The start parameter begins listing from the specified address. The end parameter stops listing at the specified address. |
DumpIL [<DynamicMethod address>] [<DynamicMethodDesc address>] [<MethodDesc address>] |
Displays the intermediate language (IL) associated with a managed method. Note that dynamic IL is emitted differently than IL loaded from an assembly. Dynamic IL refers to objects in a managed object array rather than to metadata tokens. |
DumpLog [<Filename>] |
Writes the contents of an in-memory stress log to the specified file. If you do not specify a name, this command creates a file called Stresslog.txt in the current directory. The common language runtime provides an in-memory stress log that helps you diagnose stress failures. The log allows you to diagnose failures without using locks or I/O. To enable the stress log, set the following registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework: (DWORD) StressLog = 1 (DWORD) LogFacility = 0xffffffff (DWORD) StressLogSize = 65536 |
DumpMD <MethodDesc address> |
Displays information about a MethodDesc structure at the specified address. You can use the IP2MD command to get the MethodDesc structure address from a managed function. |
DumpMT [-MD] <MethodTable address> |
Displays information about a method table at the specified address. Specifying the -MD option displays a list of all methods defined with the object. Each managed object contains a method table pointer. |
DumpMethodSig <sigaddr> <moduleaddr> |
Displays information about a MethodSig structure at the specified address. |
DumpModule [-mt] <Module address> |
Displays information about a module at the specified address. The -mt option displays the types defined in a module and the types referenced by the module You can use the DumpDomain or DumpAssembly commands to retrieve a module's address. |
DumpObj <object address> -or- DO <object address> |
Displays information about an object at the specified address. The DumpObj command displays the fields, the EEClass structure information, the method table, and the size of the object. You can use the DumpStackObjects command to retrieve an object's address. Note that you can run the DumpObj command on fields of type CLASS because they are also objects. |
DumpRuntimeTypes |
Displays the runtime type objects in the garbage collector heap and lists their associated type names and method tables. |
DumpStack [-EE] [top stack [bottom stack]] |
Displays a stack trace. The -EE option causes the DumpStack command to display only managed functions. Use the top and bottom parameters to limit the stack frames displayed on x86 platforms. On x86 platforms, the DumpStack command creates a verbose stack trace. On x64 and IA-64-based platforms, the DumpStack command mimics the debugger's K command. The top and bottom parameters are ignored on x64 and IA-64-based platforms. |
DumpSig <sigaddr> <moduleaddr> |
Displays information about a Sig structure at the specified address. |
DumpStackObjects [-verify] [top stack [bottom stack]] -or- DSO [-verify] [top stack [bottom stack]] |
Displays all managed objects found within the bounds of the current stack. The -verify option validates each non-static CLASS field of an object field. Use the DumpStackObject command with stack tracing commands such as the K command and the CLRStack command to determine the values of local variables and parameters. |
DumpVC <MethodTable address> <Address> |
Displays information about the fields of a value class at the specified address. The MethodTable parameter allows the DumpVC command to correctly interpret fields. Value classes do not have a method table as their first field. |
EEHeap [-gc] [-loader] |
Displays information about process memory consumed by internal common language runtime data structures. The -gc and -loader options limit the output of this command to garbage collector or loader data structures. The information for the garbage collector lists the ranges of each segment in the managed heap. If the pointer falls within a segment range given by EEHeap -gc, the pointer is an object pointer. |
EEStack [-short] [-EE] |
Runs the DumpStack command on all threads in the process. The -EE option is passed directly to the DumpStack command. The -short parameter limits the output to the following kinds of threads:
|
EEVersion |
Displays the common language runtime version. |
EHInfo [<MethodDesc address>] [<Code address>] |
Displays the exception handling blocks in a specified method. This command displays the code addresses and offsets for the clause block (the try block) and the handler block (the catch block). |
FinalizeQueue [-detail] |
Displays all objects registered for finalization. The -detail option displays additional information about any SyncBlocks that await cleanup and extra information about any RuntimeCallableWrappers (RCWs) that await cleanup. Both data structures are cached and cleaned up by the finalizer thread. |
FindAppDomain <Object address> |
Determines the application domain of an object at the specified address. |
GCHandles [-perdomain] |
Displays statistics about garbage collector handles in the process. Passing the -perdomain option arranges the statistics by application domain. Use the GCHandles command to find memory leaks caused by garbage collector handle leaks. For example, a memory leak occurs when code retains a large array because a strong garbage collector handle still points to it, and the handle is discarded without freeing it. |
GCHandleLeaks |
Searches memory for any references to strong and pinned garbage collector handles in the process and displays the results. If a handle is found, the GCHandleLeaks command displays the address of the reference. If a handle is not found in memory, this command displays a notification. |
GCInfo <MethodDesc address> <Code address> |
Displays data that indicates when registers or stack locations contain managed objects. If a garbage collection occurs, the collector must know the locations of references to objects so it can update them with new object pointer values. |
GCRoot [-nostacks] <Object address> |
Displays information about references (or roots) to an object at the specified address. The GCRoot command examines the entire managed heap and the handle table for handles within other objects and handles on the stack. Then, each stack is searched for pointers to objects and the finalizer queue is also searched. This command does not determine whether a stack root is valid or is discarded. Use the CLRStack and U commands to disassemble the frame that the local or argument value belongs to in order to determine if the stack root is still in use. The -nostacks option restricts the search to garbage collector handles and freachable objects. |
help [<command>] [<faq>] |
Displays all available commands when no parameter is specified or displays detailed help information about the specified command. The faq parameter displays answers to frequently asked questions. |
IP2MD <Code address> |
Displays the MethodDesc structure at the specified address in code that has been just-in-time (JIT) compiled. |
MinidumpMode [0] [1] |
Prevents running unsafe commands when using a minidump. Pass 0 to disable this feature or 1 to enable this feature. By default, the MinidumpMode value is set to 0. Minidumps created with the .dump /m command or .dump command have limited CLR-specific data and allow you to run only a subset of SOS commands correctly. Some commands may fail with unexpected errors because required areas of memory are not mapped or are only partially mapped. This option protects you from running unsafe commands against minidumps. |
Name2EE <module name> <type or method name> -or- Name2EE <module name>!<type or method name> |
Displays the MethodTable structure and EEClass structure for the specified type or method in the specified module. The specified module must be loaded in the process. To get the proper type name, browse the module using the MSIL Disassembler (Ildasm.exe). You can also pass * as the module name parameter to search all loaded managed modules. The module name parameter can also be the debugger's name for a module, such as This command supports the Windows debugger syntax of <module>!<type>. The type must be fully qualified. |
ObjSize [<Object address>] |
Displays the size of the specified object. With no parameters, the ObjSize command displays the size of all objects found on managed threads, displays all garbage collector handles in the process, and totals the size of any objects pointed to by those handles. The ObjSize command includes the size of all child objects in addition to the parent. |
PrintException [-nested] [<Exception object address>] -or- PE [-nested] [<Exception object address>] |
Displays and formats fields of any object derived from the Exception class at the specified address. If you do not specify an address, the PrintException command displays the last exception thrown on the current thread. The -nested option displays details about nested exception objects. You can use this command to format and view the _stackTrace field, which is a binary array. |
ProcInfo [-env] [-time] [-mem] |
Displays environment variables for the process, kernel CPU time, and memory usage statistics. |
RCWCleanupList <RCWCleanupList address> |
Displays the list of runtime callable wrappers at the specified address that are awaiting cleanup. |
SaveModule <Base address> <Filename> |
Writes an image, which is loaded in memory at the specified address, to the specified file. |
StopOnException [-derived] [-create | -create2] <Exception> <Pseudo-register number> |
Causes the debugger to stop when the specified exception is thrown, but to continue running when other exceptions are thrown. The -derived option catches the specified exception and every exception that derives from the specified exception. |
SyncBlk [-all | <syncblk number>] |
Displays the specified SyncBlock structure or all SyncBlock structures. If you do not pass any arguments, the SyncBlk command displays the SyncBlock structure corresponding to objects that are owned by a thread. A SyncBlock structure is a container for extra information that does not need to be created for every object. It can hold COM interop data, hash codes, and locking information for thread-safe operations. |
ThreadPool |
Displays information about the managed thread pool including the number of work requests in the queue, the number of completion port threads, and the number of timers. |
Token2EE <module name> <token> |
Turns the specified metadata token in the specified module into a MethodTable structure or MethodDesc structure. You can pass * for the module name parameter to find what that token maps to in every loaded managed module. You can also pass the debugger's name for a module, such as |
Threads [-live] [-special] |
Displays all managed threads in the process. The Threads command displays the debugger shorthand ID, the common language runtime thread ID, and the operating system thread ID. Additionally, the Threads command displays a Domain column that indicates the application domain in which a thread is executing, an APT column that displays the COM apartment mode, and an Exception column that displays the last exception thrown in the thread. The -live option displays threads associated with a live thread. The -special option displays all special threads created by the CLR. Special threads include garbage collection (GC) threads (in concurrent GC and server GC), Debugger helper threads, Finalizer threads, AppDomain Unload threads, and Threadpool timer threads. |
TraverseHeap [-xml] <filename> |
Writes heap information to the specified file in a format understood by the CLR Profiler. The -xml option causes the TraverseHeap command to format the file as XML. You can download the CLR Profiler from: https://www.microsoft.com/downloads/details.aspx?familyid=86CE6052-D7F4-4AEB-9B7A-94635BEEBDDA |
U [-gcinfo] [-ehinfo] <MethodDesc address> | <Code address> |
Displays an annotated disassembly of a managed method specified by a MethodDesc structure pointer for the method or by a code address within the method body. The U command displays the entire method from start to finish, with annotations that convert metadata tokens to names. The -gcinfo option causes the U command to display the GCInfo structure for the method. The -ehinfo option displays exception information for the method. You can also obtain this information with the EHInfo command. |
VerifyHeap |
Checks the garbage collector heap for signs of corruption and displays any errors found. Heap corruptions can be caused by platform invoke calls that are constructed incorrectly. |
VMMap |
Traverses the virtual address space and displays the type of protection applied to each region. |
VMStat |
Provides a summary view of the virtual address space, ordered by each type of protection applied to that memory (free, reserved, committed, private, mapped, image). The TOTAL column displays the result of the AVERAGE column multiplied by the BLK COUNT column. |
Remarks
Use the SOS Debugging Extension by loading it into the WinDbg.exe Debugger, or into Visual Studio 2005 or earlier. You can execute commands within WinDgb.exe or within the Immediate Window of Visual Studio.
The SOS Debugging Extension allows you to view information about code running inside the common language runtime. For example, you can use the SOS Debugging Extension to display information about the managed heap, look for heap corruptions, display internal data types used by the runtime, and view information about all managed code running inside the runtime.
Loading the SOS Debugging Extension
To load the SOS Debugging Extension in the WinDbg.exe Debugger, run the following command in the tool; to load the SOS Debugging Extension in Visual Studio, run the following command in the Immediate Window while debugging:
.loadby sos
You must enable unmanaged debugging in the project settings of your solution before you can load the SOS Debugging Extension. For some languages, unmanaged debugging is disabled by default.
Note To display the Immediate Window in Visual Studio 2005, click the Debug menu, click the Windows menu, and then click the Immediate option. You can also open the Immediate Window in Visual Studio by selecting CTRL-ALT-I.
WinDbg.exe and Visual Studio use a version of SOS.dll that corresponds to the version of Mscorwks.dll currently in use. In versions 1.1 and 2.0 of the .NET Framework, SOS.dll is installed in the same directory as Mscorwks.dll. By default, you should use the version of SOS.dll that matches the current version of Mscorwks.dll.
To use a dump file created on another computer, make sure the Mscorwks.dll file that came with that installation is in your symbol path, and load the corresponding version of SOS.dll.
To load a specific version of SOS.dll, type the following command into the Windows Debugger:
.load <full path to sos.dll>
Examples
The following command displays the contents of an array at the address 00ad28d0. The display starts from the second element and continues for five elements.
!dumparray -start 2 -length 5 -detail 00ad28d0
The following command displays the contents of an assembly at the address 1ca248.
!dumpassembly 1ca248
The following command displays information about the garbage collector heap.
!dumpheap
The following command writes the contents of the in-memory stress log to a file called Stresslog.txt in the current directory.
!DumpLog
The following command displays the MethodDesc structure at the address 902f40.
!dumpmd 902f40
The following command displays information about a module at the address 1caa50.
!dumpmodule 1caa50
The following command displays information about an object at the address a79d40.
!DumpObj a79d40
The following command displays the fields of a value class at the address 00a79d9c using the method table at the addresses 0090320c.
!DumpVC 0090320c 00a79d9c
The following command displays the process memory used by the garbage collector.
!eeheap -gc
The following command displays all objects scheduled for finalization.
!finalizequeue
The following command determines the application domain of an object at the address 00a79d98.
!findappdomain 00a79d98
The following command displays all garbage collector handles in the current process.
!gcinfo 5b68dbb8
The following command displays the MethodTable and EEClass structures for the Main method in the class MainClass in the module unittest.exe.
!name2ee unittest.exe MainClass.Main
The following command displays information about the metadata token at the address 02000003 in the module unittest.exe.
!token2ee unittest.exe 02000003