Loadby Mscorwks.dll: Workaround To Debug A 32-Bit Mini Dump File on Windows 8 64-bit

Alright, so lately I’ve been doing a lot of debugging and analyzed dump files, let’s take a quick look at how to debug a DMP file for a 32-bit app on a 64-bit OS like Windows 8 x64

I frequently ran into errors when trying to debug 32-bit apps on 64-bit Windows. However, I noticed that reloading the symbol file path with a new path somehow works for me. Maybe someone can spot my error since I’m relatively new to debugging, but the symbol files are both correct, but only after reloading the path it would actually load the Mscorwks.dll

Open WinDBG x86

1. Step Let’s search for WinDBG – open the Start Screen and hit CTRL + F

App Results For Windbg

2. Step Open WinDBG x86 if you want to debug a 32-bit application

3. Step HIT CTRL + S or click on File then on Symbol File Path

Symbol File Path Windbg.png

4. Step Enter srv*c:\symbolspub*http://msdl.microsoft.com/downloads/symbols without ANY whitespace
Symbol Path For Debugging.png

5. Step Now go to C:\Users\Oliver\AppData\Local\Temp\ and drag and drop any file called *.tmp.mdmp into the WinDBG app

Example: WERDB5.tmp.mdmp

Basic Info: This dump file has an exception of interested stored in it

6. Step This should already give you some basic debugging info – look for anything similar to “This dump file has an exception of interested stored in it

mscorwks.dll: Win32 error 0n87

7. Step Let’s load the cordll mscordacwks.dll entering .cordll -ve -u -l this is required to properly debug your program

Cordll Debug.png

It should output something like:

CLRDLL: Unable to get version info for 'c:\symbolspub\mscorwks.dll\
504A83165ae000\mscordacwks.dll', Win32 error 0n87
CLRDLL: Loaded DLL c:\symbolspub\mscordacwks_x86_x86_2.0.50727.6400.dll\
CLR DLL status: Loaded DLL c:\symbolspub\mscordacwks_x86_x86_2.0.50727.6400.dll\504A83165ae000\

.loadby sos mscorwks: Win32 error 0n126

8. Step The next step is to actually load it entering .loadby sos mscorwks

However I usually would get this error:

0:000> .loadby sos mscorwks
The call to LoadLibrary(c:\symbolspub2\mscorwks.dll\504A83165ae000\sos) failed, Win32 error 0n126
“The specified module could not be found.”
Please check your debugger configuration and/or network access.

The Workaround

9. Step Here is my workaround – Hit CTRL + S and enter this as your new path now and CHECK THE BOX RELOAD


Reloading Symbol File Path.png

10. Step Now enter .loadby sos mscorwks

11. No error? Great, we’re almost there

12. Next enter !clrstack and get what you’re after

The Actual Debug Information We’re After Will Appear After Entering !clrstack

0070ea04 7726dc34 [HelperMethodFrame: 0070ea04]
0070eaa8 72371717 System.Net.Sockets.Socket.DoBind(System.Net.EndPoint,
0070eac0 71e4593e System.Net.Sockets.Socket.Bind(System.Net.EndPoint)
0070eae0 7227b962 System.Net.Sockets.TcpListener.Start(Int32)
0070eaf0 7227b8da System.Net.Sockets.TcpListener.Start()
0070eaf4 696e5faf System.Runtime.Remoting.Channels.
0070eb9c 696f25c3 System.Runtime.Remoting.Channels.Tcp.TcpServerChannel.
0070ebac 696f2917 System.Runtime.Remoting.Channels.Tcp.TcpServerChannel.
0070ebc0 696f1f49 System.Runtime.Remoting.Channels.Tcp.TcpServerChannel..
ctor(System.Collections.IDictionary, System.Runtime.Remoting.Channels.IServerChannelSinkProvider, System.Runtime.Remoting.Channels.IAuthorizeRemotingConnection)
0070ec08 696f10f4 System.Runtime.Remoting.Channels.Tcp.TcpChannel..ctor
(System.Collections.IDictionary, System.Runtime.Remoting.Channels.IClientChannelSinkProvider, System.Runtime.Remoting.Channels.IServerChannelSinkProvider)
0070ec54 6c4d8309 Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.
0070ec70 6c4d6728 Microsoft.VisualBasic.ApplicationServices.