0

I need to do crash dump analysis for a .net exe using Windbg. I read multiple blogs on MSDN to setup my Windbg but looks like it still has issues loading 'mscordacwks.dll'. Upon running this command i get this:

Failed to load data access DLL, 0x80004005 Verify that 1) you have a recent build of the debugger (6.2.14 or newer) 2) the file mscordacwks.dll that matches your version of mscorwks.dll is in the version directory 3) or, if you are debugging a dump file, verify that the file mscordacwks_.dll is on your symbol path. 4) you are debugging on the same architecture as the dump file. For example, an IA64 dump file must be debugged on an IA64 machine.

You can also run the debugger command .cordll to control the debugger's load of mscordacwks.dll. .cordll -ve -u -l will do a verbose reload. If that succeeds, the SOS command should work on retry.

If you are debugging a minidump, you need to make sure that your executable path is pointing to mscorwks.dll as well.

Here are quick details of my environment:

  1. EXE is 32 -bit so using x86 debugger
  2. In the following path: C:\Windows\Microsoft.NET\Framework\v2.0.50727 the two DLLs are located : ->mscorwks.dll ->mscordacwks.dll file version: 2.0.50727.5485
  3. Symbol path is : c:\debug\symbols
  4. Debugging tools(i.e. Windbg installation) is located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86
  5. Copied mscorwks.dll and mscordacwks.dll in this path and renamed to(as per some blog on MSDN) : -> mscordacwks_x86_x86_2.0.50727.5485 -> mscorwks_x86_x86_2.0.50727.5485

Not sure if these names are correct or not.

Still it never worked.

Sandeep
  • 57
  • 1
  • 8
  • What dump type do you have (64 bit or 32 bit)? Note that there's no mixed architecture DLL (64 bit dump but 32 bit executable). See also [How to take a good crash dump for .NET](http://stackoverflow.com/questions/24874027/how-do-i-take-a-good-crash-dump-for-net). FYI: I wrote [a tool](http://debugging.wellisolutions.de/download-mscordacwks-collector/) that does the collection and renaming for you. I also provide many [of those DLLs](http://sos.debugging.wellisolutions.de/) for download (in case you need one which you don't have present). – Thomas Weller May 23 '16 at 12:48
  • If the command `lm m wow64` results in addresses, you have the wrong type of dump. – Thomas Weller May 23 '16 at 12:54

0 Answers0