Unable to load SOS in WinDbg

Question

Background: I'm new to WinDbg and trying to get it running for the first time. I want to examine a memory dump I took from a running ASP.NET 4 site hosted in IIS 7 on Windows Server 2008 (x86) and downloaded to my local machine.

I installed the debugging tools and launched WinDbg for the first time, opening the crash dump. I went to File | Symbol File Path and set the path to *srv*c:\symbols*http://msdl.microsoft.com/download/symbols* and waited for all the symbols to load.

When trying to load SOS, I ran into problems. First, I tried the following command...

.loadby sos mscorwks

...and received the response Unable to find module 'mscorwks'.

After scouring the web, I tried to load mscorwks by executing the following command...

sxe ld mscorwks.dll
g

...and received the response "No runnable debuggees error in 'g'"

I copied SOS.dll (from C:\Windows\Microsoft.NET\Framework\v4.0.30319) into the WinDbg directory, then tried...

.load sos

...and received the error...

The call to LoadLibrary(sos) failed, Win32 error 0n193
    "%1 is not a valid Win32 application."
Please check your debugger configuration and/or network access.

I'm not quite sure how to proceed. I just want to load SOS and dig around this dump file. Any help would be greatly appreciated.

Fyi...I am trying to open the dump file on a 64-bit version of Windows 7 with the 64-bit version of Windbg.

Answer 1

The CLR runtime dll was renamed to clr.dll with .NET 4. So in order to load the correct version of SOS you need to adjust your .loadby command. I.e.

.loadby sos clr

Also, if you're on 64 bit, you should install the 32 bit version of Debugging Tools for Windows as well in order to debug 32 bit apps. They install side-by-side, so there's no problem in having both the 32 bit and the 64 bit version on the same machine.

I would advice against copying SOS.dll. SOS needs to match the exact version of the framework, so as long as you load it from the framework directory using .loadby, you're all set.

Answer 2

The WinDbg command 'g' means [Continue]

Since you're opening a dump-file there is no way to 'continue', it only contains the process memory.

So the message " No runnable debuggees error in 'g' " is logical in your case since the process is not running.

Concerning loading the correct version of SOS use the following command depending on the .NET version.

.NET 4 and higher .loadby sos

.NET 3.5 and 2 .loadby sos mscorwks

.NET 1.0 and 1.1 .load clr10\sos

Answer 3

Answers above need improvement, since over the course of time things has been easier to handle sos loading.

JOHN ROBBINS has nice article around it, See that Microsoft symbol servers are configured in symbol file path and run !analyze -v on windbg prompt, this will do the trick it will download relevant sos files. To verify run .chain on the prompt and you will see the loaded dll.

Answer 4

Just came across a similar issue loading SOS and was getting "specified module could not be found". Came up with a different solution so if the solutions here don't help you, try this out:

.loadby sos clr - specified module could not be found