How can I know the CLR version of a crash dump?

Question

I have a minidump crashed from a .NET application. Is there any way to know the CLR version (e.g. version of mscorwks.dll) of the fault machine (which generates the crash dump) using either Windbg or some other tool?

Brian Rasmussen · Answer 1 · 2010-08-18T07:42:01.593

In WinDbg: the easiest way is to use the !eeversion command, but if you want additional info you can use the lm command with the v verbose option for the runtime module mscorwks. If you're on .NET 4 the runtime is called clr, so in that case you need to change the command accordingly.

0:026> lm vm mscorwks
start    end        module name
79e70000 7a3ff000   mscorwks T (no symbols)           
    Loaded symbol image file: mscorwks.dll
    Image path: c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
    Image name: mscorwks.dll
    Timestamp:        Wed Oct 24 09:41:29 2007 (471EF729)
    CheckSum:         00597AA8
    ImageSize:        0058F000
    File version:     2.0.50727.1433
    Product version:  2.0.50727.1433
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Hi Brian, I think this command only checks on the debug machine which CLR version is used, not checking on the fault machine's CRL version. Any comments? Another issues is, the version is incomplete, it should not be only 50727, but 50727.xxxx, like 50727.3053. — George2, Mar 24 '09 at 03:30
@George2: lm show the module that is loaded if you're inspecting a dump file as this is part of the memory that was dumped. As for the version number, I would assume this can be read from File and/or Product version. — Brian Rasmussen, Aug 18 '10 at 07:35

score 5 · Answer 2 · answered Oct 27 '09 at 20:34

5

!EEVersion should give the CLR version.

answered Oct 27 '09 at 20:34

Naveen

4,092
29
31

score 3 · Answer 3 · edited Aug 12 '15 at 01:55

Go verbose in WinDbg:

>lm v 
............. (lots of modules).......

687d0000 68d06000   System_Xml_ni   (deferred)             
Image path: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\38b9d09539b67b08ee996db6c71f8a9b\System.Xml.ni.dll
Image name: System.Xml.ni.dll
Has CLR image header, track-debug-data flag not set
Timestamp:        Mon Oct 06 20:43:49 2008 (48EADAF5)
CheckSum:         00000000
ImageSize:        00536000
File version:     2.0.50727.3074
Product version:  2.0.50727.3074
File flags:       0 (Mask 3F)
File OS:          4 Unknown Win32
File type:        2.0 Dll
File date:        00000000.00000000
Translations:     0409.04b0
CompanyName:      Microsoft Corporation
ProductName:      Microsoft® .NET Framework
InternalName:     System.Xml.dll
OriginalFilename: System.Xml.dll
ProductVersion:   2.0.50727.3074
FileVersion:      2.0.50727.3074 (QFE.050727-3000)
FileDescription:  .NET Framework
LegalCopyright:   © Microsoft Corporation.  All rights reserved.
Comments:         Flavor=Retail

Alternatively, load the dump in Visual Studio and use the Debug | Windows | Modules toolwindow to display some of this info.

Examples for two different .Net versions, using the version information of clr.dll:

.Net 4.0(.x?)

Image name: clr.dll
Timestamp:        Thu Mar 18 21:39:07 2010 (4BA21EEB)
...
File version:     4.0.30319.1
Product version:  4.0.30319.1

.Net 4.5.2

Image name: clr.dll
Timestamp:        Fri Nov 07 20:09:21 2014 (545CA861)
...
File version:     4.5.27.0
Product version:  4.0.30319.0

+1 as this works without loading the specific (and hence on that machine potentially unavailable) mscordacwks.dll / sos.dll etc. I also added examples for two more .Net versions for reference. — Evgeniy Berezovsky, Aug 12 '15 at 01:57

How can I know the CLR version of a crash dump?

3 Answers3

Linked

Related