none
WinDbg - Crash Dump - unable to load proper sos.dll version RRS feed

  • Question

  • Hi,

    I have taken a memory dump from a 32-bit .NET application, running on Windows 7 64-bit. The .NET framework version used by the application on the Windows 7 system is 4.0.30319.18444.

    Using WinDbg I want to debug this memory dump on a Windows XP 32-bit SP3, which has installed .NET framework version 4.0.30319.1022.

    I am using WinDbg version 6.12.0002.633 X86.

    On the XP system I don't have .NET version 4.0.30319.18444 installed. So, by default, I don't have the proper mscordacwks.dll version that is required for debugging this memory dump I have.

    However the Symbol Search Path in WinDbg is set to SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols, and it seems that the proper mscordacwks.dll version is downloaded here: C:\Symbols\mscordacwks_x86_x86_4.0.30319.18444.dll\52717E8469b000\mscordacwks_x86_x86_4.0.30319.18444.dll

    After opening the crash dump, I executed following commands in WinDbg

    0:000> !sym noisy
    noisy mode - symbol prompts on
    0:000> .cordll -ve -u -l
    CLR DLL status: No load attempts

    "No load attempts"? Does this indicate an error? Does it mean that there has not been an attempt to load the DAC dll? Anyway, I think the ".cordll -ve -u -l" command is supposed to load the mscordacwks DLL. And if I understand correctly, also the SOS dll should be loaded.

    Here's the command to list the debugger extensions. But there's no trace of SOS.dll

    0:000> .chain
    Extension DLL search Path:
        C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\Microsoft SDK\include;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;D:\Program Files\Perforce;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Program Files\Microsoft SDK\Bin\;C:\Program Files\Microsoft SDK\Bin\WinNT;D:\Tools\VCG
    Extension DLL chain:
        dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 21:08:26 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
        ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:31 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]
        exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:24 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]
        uext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:23 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\uext.dll]
        ntsdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 21:08:08 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]


    So, following command also fails, as expected, because SOS dll is not loaded.

    0:000> !dumpheap
    No export dumpheap found


    So, why is SOS.dll not loaded, and what does "No load attempts" mean when trying to load the DAC?

    This command shows which clr version was loaded for the application that was running on the Windows 7 app. Version 4.0.30319.18444. Same version as the mscordacwks dll on the symbol path.

     

    0:000> lmv -mclr
    Unknown option '-'
    start    end        module name
    74150000 747eb000   clr        (deferred)             
        Image path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
        Image name: clr.dll
        Timestamp:        Wed Oct 30 22:47:48 2013 (52717E84)
        CheckSum:         0069CCD3
        ImageSize:        0069B000
        File version:     4.0.30319.18444
        Product version:  4.0.30319.18444
        File flags:       8 (Mask 3F) Private
        File OS:          4 Unknown Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® .NET Framework
        InternalName:     clr.dll
        OriginalFilename: clr.dll
        ProductVersion:   4.0.30319.18444
        FileVersion:      4.0.30319.18444 built by: FX451RTMGDR
        PrivateBuild:     DDBLD259
        FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
        LegalCopyright:   © Microsoft Corporation.  All rights reserved.
        Comments:         Flavor=Retail


    However, what I didn't find anywhere on the symbol path, is the a SOS.dll with the proper version. Is the SOS.dll something that should be downloaded to the symbol path automatically at some point? The proper DAC dll was downloaded to the symbol path automatically.

    Anyway I did manually copy the proper version of SOS.dll to my system. But I don't find a way of loading this specific version of the SOS.dll. I tried copying it under the same folder as the WinDbg exe

    0:000> .load C:\Program Files\Debugging Tools for Windows (x86)\sos.dll
    The call to LoadLibrary(C:\Program Files\Debugging Tools for Windows (x86)\sos.dll) failed, Win32 error 0n127
        "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.


    I tried renaming it as follows

    0:000> .load C:\Program Files\Debugging Tools for Windows (x86)\SOS_x86_x86_4.0.30319.18444.dll
    The call to LoadLibrary(C:\Program Files\Debugging Tools for Windows (x86)\SOS_x86_x86_4.0.30319.18444.dll) failed, Win32 error 0n127
        "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.


    I tried manually creating a folder under my symbol path for the dll

    0:000> .load C:\Symbols\SOS_x86_x86_4.0.30319.18444\52717E8469b000\SOS_x86_x86_4.0.30319.18444.dll
    The call to LoadLibrary(C:\Symbols\SOS_x86_x86_4.0.30319.18444\52717E8469b000\SOS_x86_x86_4.0.30319.18444.dll) failed, Win32 error 0n127
        "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.


    What does this SOS.dll need? I know it is normally located under the C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 folder. But, I don't have the 4.0.30319.18444 version .NET files under there. So, there's no use in trying to put the 4.0.30319.18444 SOS.dll there. As illustrated:

    0:000> .load C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS_x86_x86_4.0.30319.18444.dll
    The call to LoadLibrary(C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS_x86_x86_4.0.30319.18444.dll) failed, Win32 error 0n127
        "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.


    The only SOS dll that I seem to be able to load is the 4.0.30319.1022 version which goes allong the .NET version I have installed on the XP system.

    0:000> .load C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS.dll


    nd now I have an SOS dll loaded. But not the one I need.

    0:000> .chain
    Extension DLL search Path:
        C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\Microsoft SDK\include;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;D:\Program Files\Perforce;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Program Files\Microsoft SDK\Bin\;C:\Program Files\Microsoft SDK\Bin\WinNT;D:\Tools\VCG
    Extension DLL chain:
        C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS.dll: image 4.0.30319.1022, API 1.0.0, built Wed Jan 08 08:29:42 2014
            [path: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS.dll]
        dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 21:08:26 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
        ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:31 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]
        exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:24 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]
        uext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:23 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\uext.dll]
        ntsdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 21:08:08 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]


    So, it's still not working. As expected.

    0:000> !dumpheap
    DBGHELP: clr - public symbols  
             c:\symbols\clr.pdb\5182A0CFB60D40DB90EEF44DEC7ACB932\clr.pdb
    CLRDLL: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll:4.0.30319.1022 f:8
    doesn't match desired version 4.0.30319.18444 f:8
    DBGHELP: c:\symbols\mscordacwks_x86_x86_4.0.30319.18444.dll\52717E8469b000\mscordacwks_x86_x86_4.0.30319.18444.dll - OK
    CLRDLL: LoadLibrary(c:\symbols\mscordacwks_x86_x86_4.0.30319.18444.dll\52717E8469b000\mscordacwks_x86_x86_4.0.30319.18444.dll) failed, Win32 error 127
    CLRDLL: LoadLibrary(C:\Program Files\Debugging Tools for Windows (x86)\mscordacwks_x86_x86_4.0.30319.18444.dll) failed, Win32 error 127
    DBGHELP: G:\v4.0.30319\clr.dll - OK
    CLRDLL: Unable to get version info for 'G:\v4.0.30319\mscordacwks_x86_x86_4.0.30319.18444.dll', Win32 error 0n87
    CLRDLL: ERROR: Unable to load DLL mscordacwks_x86_x86_4.0.30319.18444.dll, Win32 error 0n87
    Failed to load data access DLL, 0x80004005
    Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
                2) the file mscordacwks.dll that matches your version of clr.dll is 
                    in the version directory
                3) or, if you are debugging a dump file, verify that the file 
                    mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
                4) you are debugging on the same architecture as the dump file.
                    For example, an IA64 dump file must be debugged on an IA64
                    machine.
    You can also run the debugger command .cordll to control the debugger's
    load of mscordacwks.dll.  .cordll -ve -u -l will do a verbose reload.
    If that succeeds, the SOS command should work on retry.
    If you are debugging a minidump, you need to make sure that your executable
    path is pointing to clr.dll as well.

    I have tried other things, such as copying all v4.0.30319.18444 files to a G:\v4.0.30319 folder.

    Unload the SOS dll I don't need.

    0:000> .unload
    Unloading C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SOS.dll extension DLL

    Then

    0:000> .cordll -ve -I clr -lp G:\v4.0.30319 CLR DLL status: No load attempts

    0:000> .chain
    Extension DLL search Path:
        C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\Microsoft SDK\include;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;D:\Program Files\Perforce;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Program Files\Microsoft SDK\Bin\;C:\Program Files\Microsoft SDK\Bin\WinNT;D:\Tools\VCG
    Extension DLL chain:
        dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 21:08:26 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
        ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:31 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]
        exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:24 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]
        uext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:23 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\uext.dll]
        ntsdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 21:08:08 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]

    0:000> !dumpheap
    No export dumpheap found

    0:000> .load G:\v4.0.30319\sos.dll
    The call to LoadLibrary(G:\v4.0.30319\sos.dll) failed, Win32 error 0n127
        "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.


    This command succeeds

    0:000> .loadby sos clr

    But it doesn't load the proper version of SOS dll

    0:000> .chain
    Extension DLL search Path:
        C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\Microsoft SDK\include;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;D:\Program Files\Perforce;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Program Files\Microsoft SDK\Bin\;C:\Program Files\Microsoft SDK\Bin\WinNT;D:\Tools\VCG
    Extension DLL chain:
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\sos: image 4.0.30319.1022, API 1.0.0, built Wed Jan 08 08:29:42 2014
            [path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\sos.dll]
        dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 21:08:26 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
        ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:31 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]
        exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:24 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]
        uext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 21:08:23 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\uext.dll]
        ntsdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 21:08:08 2010
            [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]
    0:000> !dumpheap
    CLRDLL: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll:4.0.30319.1022 f:8
    doesn't match desired version 4.0.30319.18444 f:8
    DBGHELP: c:\symbols\mscordacwks_x86_x86_4.0.30319.18444.dll\52717E8469b000\mscordacwks_x86_x86_4.0.30319.18444.dll - OK
    CLRDLL: LoadLibrary(c:\symbols\mscordacwks_x86_x86_4.0.30319.18444.dll\52717E8469b000\mscordacwks_x86_x86_4.0.30319.18444.dll) failed, Win32 error 127
    CLRDLL: LoadLibrary(C:\Program Files\Debugging Tools for Windows (x86)\mscordacwks_x86_x86_4.0.30319.18444.dll) failed, Win32 error 127
    DBGHELP: G:\v4.0.30319\clr.dll - OK
    CLRDLL: Unable to get version info for 'G:\v4.0.30319\mscordacwks_x86_x86_4.0.30319.18444.dll', Win32 error 0n87
    CLRDLL: ERROR: Unable to load DLL mscordacwks_x86_x86_4.0.30319.18444.dll, Win32 error 0n87
    Failed to load data access DLL, 0x80004005
    Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
                2) the file mscordacwks.dll that matches your version of clr.dll is 
                    in the version directory
                3) or, if you are debugging a dump file, verify that the file 
                    mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
                4) you are debugging on the same architecture as the dump file.
                    For example, an IA64 dump file must be debugged on an IA64
                    machine.
    You can also run the debugger command .cordll to control the debugger's
    load of mscordacwks.dll.  .cordll -ve -u -l will do a verbose reload.
    If that succeeds, the SOS command should work on retry.
    If you are debugging a minidump, you need to make sure that your executable
    path is pointing to clr.dll as well.

    Here's what I get if I just press enter without entering a command

    0:000> 
    The version of SOS does not match the version of CLR you are debugging.  Please
    load the matching version of SOS for the version of CLR you are debugging.
    CLR Version: 4.0.30319.18444
    SOS Version: 4.0.30319.1022
    CLRDLL: CLR DLL load disabled

    Does anybody know how I can load the proper SOS.dll?

    Thanks,

    Frederiek

    • Edited by FrederiekD Monday, October 6, 2014 12:45 PM
    Monday, October 6, 2014 12:27 PM

All replies

  • I have the same problem with you.

    I don't know how to load all those dlls properly.

    could you please  help?

    Sunday, November 12, 2017 6:27 AM
  • Hi HaoPeng,

    It's too long ago since I have been dealing with this matter, to remember the details. I'm not even sure if I solved this. But I did retrieve some of my notes on how to prepare for loading symbols with windbg:

    Set the windbg symbol path (I think d:\symbols is the path where to download the symbols, in my case; modify this to fit your situation)
    SRV*d:\symbols*symsrv*http://msdl.microsoft.com/download/symbols

    0:000> .symfix

    0:000> .reload

    0:000> .loadby sos clr

    or

    0:000> .load <path_to_sos>\sos.dll

    Also, if I remember correctly, you should use the x64 version of WinDbg to debug x64 programs, and the x86 version to debug x86 programs.

    Regards,

    Frederiek

    Monday, November 13, 2017 8:51 AM