WinDbg and .Net 2.0 Windows Error Reporting MiniDump

Shawn M.

unread,

Dec 20, 2006, 10:37:00 AM12/20/06

to

I am having some problems with a Windows Error Reporting MiniDump.

I am unable to run WinDbg on the machine the dump occurred since it is a
production machine. The dump is from a w3wp.exe using .Net 2.0 Framework. I
copied the .cab to another machine which I was going to analyze the dump.
The framework is the same version number on both machines.

The dump in question was found in this directory
C:\WINDOWS\PCHealth\ERRORREP\QSIGNOFF

I extracted the mdmpmem.hdmp from the .cab file and loaded into WindDbg,
here is the ouput and command issued.

Loading Dump File [D:\1071_logs\7C1D731C\mdmpmem.hdmp]
User Mini Dump File: Only registers, stack and portions of memory are
available

Windows Server 2003 Version 3790 (Service Pack 1) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer SingleUserTS
Debug session time: Thu Dec 14 23:24:34.000 2006 (GMT-6)
System Uptime: not available
Process Uptime: 1 days 5:02:26.000
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
..........................................................................................................................................................................................................................................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(ed4.74c): Access violation - code c0000005 (first/second chance not
available)
eax=00ab0000 ebx=77e670b2 ecx=00000019 edx=0000001c esi=000042a8 edi=00000000
eip=7c82ed54 esp=0006e688 ebp=0006e6f8 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet:
7c82ed54 c3 ret
0:000> .loadby sos mscorwks
------------------------------------------------------------
sos.dll needs a full memory dump for complete functionality.
You can create one with .dump /ma <filename>
------------------------------------------------------------
0:000> !clrstack
Unable to load image
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for mscorwks.dll
*** ERROR: Module load completed but symbols could not be loaded for
mscorwks.dll
PDB symbol for mscorwks.dll not loaded
Failed to load data access DLL, 0x80004005
Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
2) the file mscordacwks.dll that matches your version of
mscorwks.dll is
in the version directory
3) or, if you are debugging a dump file, verify that the file
mscordacwks_<arch>_<arch>_<version>.dll is on your symbol
path.
4) you are debugging on the same architecture as the dump file.
For example, an IA64 dump file must be debugged on an IA64
machine.

You can also run the debugger command .cordll to control the debugger's
load of mscordacwks.dll. .cordll -ve -u -l will do a verbose reload.
If that succeeds, the SOS command should work on retry.

If you are debugging a minidump, you need to make sure that your executable
path is pointing to mscorwks.dll as well.

-------------------------------------------------------------------------------
It seems to be some sort of problem reading/parsing the dump from another
machine. Because when I load a dump in WinDbg from the same machine I am
running WinDbg and issue the same commands, it displays the stack with
!clrstack instead of the error message.

Any help would be great.

Thanks.

Oleg Starodumov

unread,

Dec 21, 2006, 5:46:47 AM12/21/06

to

> 0:000> .loadby sos mscorwks
> ------------------------------------------------------------
> sos.dll needs a full memory dump for complete functionality.
> You can create one with .dump /ma <filename>
> ------------------------------------------------------------
> 0:000> !clrstack
> Unable to load image
> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll, Win32 error 2
> *** WARNING: Unable to verify timestamp for mscorwks.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> mscorwks.dll
> PDB symbol for mscorwks.dll not loaded
> Failed to load data access DLL, 0x80004005

The problem is that WinDbg could not find and load mscorwks.dll that matches the dump.
Try to determine why it happens, using the following commands:

!sym noisy
.reload /f mscorwks.dll
!lmi mscorwks.dll
lmvm mscorwks

You can post here the output of these commands, if necessary.

May be you need to explicitly add the directory with mscorwks.dll (.NET runtime
installation directory) to the image search path (.exepath+ command).

--
Oleg
[VC++ MVP http://www.debuginfo.com/]

Shawn M.

unread,

Dec 21, 2006, 9:27:00 AM12/21/06

to

That worked. I added the path of the framework to the image file path.

Thanks for the help!!!

"Oleg Starodumov" wrote:

> > 0:000> .loadby sos mscorwks
> > ------------------------------------------------------------
> > sos.dll needs a full memory dump for complete functionality.
> > You can create one with .dump /ma <filename>
> > ------------------------------------------------------------
> > 0:000> !clrstack
> > Unable to load image
> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll, Win32 error 2
> > *** WARNING: Unable to verify timestamp for mscorwks.dll
> > *** ERROR: Module load completed but symbols could not be loaded for
> > mscorwks.dll
> > PDB symbol for mscorwks.dll not loaded
> > Failed to load data access DLL, 0x80004005
>
> The problem is that WinDbg could not find and load mscorwks.dll that matches the dump.
> Try to determine why it happens, using the following commands:
>
> !sym noisy

> ..reload /f mscorwks.dll