Defrag Tools #110 - Writing a CLR Debugger Extension Part 2

Sign in to queue

Description

In this episode of Defrag Tools, Andrew Richards finishes a two part series on writing a Debugger Extension in C# for the Debugging Tools for Windows. The series follows on from the recent 9 part series on writing a Debugger Extension in C++.

The C# code utilizes the Microsoft.Diagnostics.Runtime (CLRMD) and DllExports packages, available on NuGet.

Resources:
.NET Framework Blog - .NET Crash Dump and Live Process Inspection
NuGet - CLR Memory Diagnostics (CLRMD)
NuGet - Unmanaged Exports (DllExport for .Net)
OneDrive - Code Sample (DebuggerExtensionCSharp.zip)

Timeline:
[00:00] - Analyzing the CLR runtime using the Microsoft.Diagnostics.Runtime namespace
[03:04] - Microsoft.Diagnostics.Runtime.DataTarget class
[03:55] - Microsoft.Diagnostics.Runtime.ClrRuntime class
[07:40] - !myruntime - display some ClrRuntime members
[12:30] - !mystats - display ClrRuntime.GetHeap statistics using LINQ
[17:27] - Recap
[19:22] - Email us your issues at defragtools@microsoft.com

Embed

Download

The Discussion

  • User profile image
    paul

    I am not able to run !myrunetime command. After playing around I modified the line to execute .cordll -l with following line

    control.Execute(DEBUG_OUTCTL.AMBIENT_TEXT, ".cordll -l", DEBUG_EXECUTE.DEFAULT);
    It reports following error now.

    CLR DLL status: ERROR: Unable to load DLL mscordacwks_AMD64_x86_4.0.30319.34011.dll, Win32 error 0n87

    Couple of questions.

    1. I am running x64 version of Windbg with a x64 version of application. I also have version 30319.34011 of mscordacwks.dll at C:\Windows\Microsoft.NET\Framework64\v4.0.30319.
    However I don't have mscordacwks_AMD64_x86_4.0.30319.34011.dll file present in the path. Given I have right version of mscordacwks.dll in .NET framework, do I still have to have mscordacwks_AMD64_x86_4.0.30319.34011.dll file?

    2. I also have question about naming convention of mscordacwks_AMD64_x86_4.0.30319.34011.dll file. Acording to following link
    https://blogs.msdn.com/b/dougste/archive/2009/02/18/failed-to-load-data-access-dll-0x80004005-or-what-is-mscordacwks-dll.aspx

    "Once you have it, check its file properties for the version number. It should be something like 2.0.50727.xxxx. Then rename it to mscordacwks_AAA_AAA_2.0.50727.xxxx.dll
    where xxxx is the appropriate bit of the version number and AAA is either x86 or AMD64 depending on whether you are dealing with a 32-bit or a 64-bit application dump"

    Does this mean that AAAA should be same in file name which means that either this file will be mscordacwks_AMD64_AMD64_4.0.30319.34011.dll or mscordacwks_x86_x86_4.0.30319.34011.dll?

  • User profile image
    paul

    If I do copy mscordacwks_AMD64_x86_4.0.30319.34011.dll in path, below is what I get/

    0:004> !myruntime
    CLR DLL status: Loaded DLL mscordacwks_AMD64_x86_4.0.30319.34011.dll
    Exception: Failure loading DAC: CreateDacInstance failed 0x80131c39

  • User profile image
    daun

    I am getting same error. Andrew any ideas or thoughts about it? I know you mentioned that its not currently supported. Let me know if there is any point of reporting any issues encountered on this forum.

  • User profile image
    Robin Caron

    @paul @daun You are getting that error because of a limitation of CLR debugging: you cannot use the x64 debugger to debug an x86 executable (or vice versa). You know this is happening from the error -- note the mix of AMD64 and x86.

    If you switch from the x64 debugger to the x86 debugger or if you recompile your executable to be x64 you should have success.

Add Your 2 Cents