windbg调试多个CLR runtime dump文件,自动加载最新版mscordacwks.dll 的问题

最近碰见的奇怪的问题：

同事在生产环境(win2003 x64)抓取的dump文件，加载SOS.dll调试托管代码，看不到托管信息，经查看dump文件包含多个 .NET runtime:

0:000> lmvm clr
start             end                 module name
00000644`7f100000 00000644`7fa64000   clr        (deferred)             
    Image path: C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\clr.dll
    Image name: clr.dll
    Timestamp:        Sat Jul 09 17:44:20 2011 (4E1822F4)
    CheckSum:         00962B7C
    ImageSize:        00964000
    File version:     4.0.30319.239
    Product version:  4.0.30319.239
    File flags:       8 (Mask 3F) Private
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® .NET Framework
    InternalName:     clr.dll
    OriginalFilename: clr.dll
    ProductVersion:   4.0.30319.239
    FileVersion:      4.0.30319.239 (RTMGDR.030319-2300)
    PrivateBuild:     DDBLD205
    FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
    LegalCopyright:   © Microsoft Corporation.  All rights reserved.
    Comments:         Flavor=Retail

 

0:000> lmvm mscorwks
start             end                 module name
00000642`7f330000 00000642`7fcd3000   mscorwks   (pdb symbols)          c:\symcache\mscorwks.pdb\12C288264FB04776AF30075C27FCC1AB1\mscorwks.pdb
    Loaded symbol image file: mscorwks.dll
    Image path: C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
    Image name: mscorwks.dll
    Timestamp:        Thu Jul 07 09:01:53 2011 (4E150581)
    CheckSum:         00993F54
    ImageSize:        009A3000
    File version:     2.0.50727.3625
    Product version:  2.0.50727.3625
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® .NET Framework
    InternalName:     mscorwks.dll
    OriginalFilename: mscorwks.dll
    ProductVersion:   2.0.50727.3625
    FileVersion:      2.0.50727.3625 (GDR.050727-3600)
    FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
    LegalCopyright:   © Microsoft Corporation.  All rights reserved.
    Comments:         Flavor=Retail

 在加载2.0 SOS.dll 后依然自动加载 .NET 4.0 mscordacwks.dll

0:000> .cordll -ve -u -l
CLR DLL status: No load attempts
0:000> .load clr20\sos.dll
0:000> !threads
CLRDLL: Loaded DLL C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll
Failed to request ThreadStore

 通过使用.cordll命令可以指定加载mscordacwks.dll

.cordll -ve -se -u -I <Start address of the target .NET runtime module> -N

or

.cordll -ve -se -u -I <Start address of the target .NET runtime module> -lp <path of the managed debugging module>

 经过测试，这种方式依然自动加载 Runtime 4.0 mscordacwks.dll

最后经高人指点，可能是由于windbg的版本有关，最开始使用的windbg版本：winDbg:6.11.0001.404 AMD64

下载个老版本 winDbg:6.6.0003.5 AMD64 再次尝试加载 Runtime 2.0 mscordacwks.dll 后调试托管信息成功。

 

 

转载于:https://www.cnblogs.com/debugdotnet/archive/2012/03/07/how-to-load-specified-mscordacwks-dll-for-managed-debugging-when-multiple-net-runtime-in-one-process.html