4

I'm trying to debug a 32 bit process dump from a process that ran on an x64 machine. I'm running an x86 version of windbg on my x64 laptop. I've followed the recommendations here, but I'm still getting this:

0:000> .cordll -ve -u -l
CLR DLL status: No load attempts
0:000> !clrstack
CLRDLL: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll:4.0.30319.17020 f:8
doesn't match desired version 4.0.30319.237 f:8
CLRDLL: Loaded DLL c:\symbols\public\mscordacwks_x86_x86_4.0.30319.237.dll\4DD234A8670000\mscordacwks_x86_x86_4.0.30319.237.dll
Failed to load data access DLL, 0x80004005
Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
            2) the file mscordacwks.dll that matches your version of clr.dll is 
                in the version directory
            3) or, if you are debugging a dump file, verify that the file 
                mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
            4) you are debugging on the same architecture as the dump file.
                For example, an IA64 dump file must be debugged on an IA64
                machine.

You can also run the debugger command .cordll to control the debugger's
load of mscordacwks.dll.  .cordll -ve -u -l will do a verbose reload.
If that succeeds, the SOS command should work on retry.

If you are debugging a minidump, you need to make sure that your executable
path is pointing to clr.dll as well.

As far as I can determine, mscordacwks_x86_x86_4.0.30319.237.dll is successfully loaded, but I still get the error. What am I missing?

friism
  • 19,068
  • 5
  • 80
  • 116
  • How did you create the dump file? If you use the default tools on a 64 bit box, you get a dump of the 64 bit process including all the WoW64 stuff. – Brian Rasmussen Sep 21 '11 at 09:52
  • I used process-explorer, right-click, on the 64-box. I'm assuming that dumping a 32-bit process yields a 32-bit dump, even if it's running on a 64bit machine? – friism Sep 21 '11 at 14:03
  • Did you get any errors when you loaded SOS? Let me know if you want me to post an answer or comment on how to handle a Wow64 bit dump. – Brian Rasmussen Sep 21 '11 at 18:51
  • 3
    process-explorer on 64-box yields 64-bit dumps of 32-bit procress – plodoc Sep 22 '11 at 16:26
  • @plodoc yes, unless you start the process explorer from the \Windows\SysWOW64 directory. – Brian Rasmussen Sep 26 '11 at 17:06

2 Answers2

3

I resolved the issue by using ProcDump to get 32bit dump of the 32bit process that was running on a 64bit machine. I can successfully examine that using 32bit windbg. There are more details in this blog post.

friism
  • 19,068
  • 5
  • 80
  • 116
  • friism, thx for this. I have the same situation as yours. I created the dump using ProcDump as you suggested. I am able to load sos/psscor2 using 32bit Windbg. But when I issue the !clrstack command the debugger looks for mscordacwks_x86_x86_2.0.50727.4216.dll (which is the version no on my prod server). It also tries to download this dll from the MS symbol server, but fails with message "SYMSRV: http://msdl.microsoft.com/downloads/symbols/mscordacwks_x86_x86_2.0.50727.4216.dll/4E154CEE5a8000/mscordacwks_x86_x86_2.0.50727.4216.dll not found". Can you perhaps suggest something that might work – Raghu May 18 '12 at 07:11
  • You copy the relevant dll off you production server and place it where windbg can find it - I think I also had to do that. – friism May 18 '12 at 16:33
  • 1
    Yup, thats what i ended up doing. It works now. Thanks for the pointer anyway. Cheers. – Raghu May 20 '12 at 04:36
  • None of this helped me. The problem was that the .NET 4.5 SOS.dll is not compatible with the .NET 4.0 mscordacwks.dll. It worked when I tried to load it on a VM that had the 4.0 runtime installed but not the 4.5. – Stefan Dragnev Feb 07 '13 at 06:39
0

It looks like you have a 32-bit dump file - otherwise the error would look like

CLR DLL status: ERROR: Unable to load DLL mscordacwks_AMD64_x86_2.0.50727.3053.dll, Win32 error 0n87

At least that's according to the blog post “Failed to load data access DLL, 0x80004005” – OR – What is mscordacwks.dll? on the Notes from a dark corner blog.

Note the mix of AMD64_x86 vs the x86_x86 in your error message.

For me, it's always because I don't have the correct version of mscordacwks. It's also possible windbg can't find it. See my answer to Problem debugging hang-dump in windbg for one method I've used to find/extract the correct version from security patches. To get windbg to load it, I set set the image path for windbg to point to the directory I've stored it in.

Community
  • 1
  • 1
Tony Lee
  • 5,622
  • 1
  • 28
  • 45