WinDbg sosex unable to debug

Question

I am trying to debug managed code. .exe file is build for x64

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace DebugTutorial
{
    class Program
    {
        public static void Foo2()
        {
            Console.WriteLine("Foo2");
        }

        public static void Foo1()
        {
            Console.WriteLine("Foo1");
        }

        public static void Parent()
        {
            Foo1();
            Console.WriteLine("Parent");
        }

        static void Main(string[] args)
        {
            Foo1();
            Foo2();
            Parent();
        }
    }
}

I am doing next commands:

0:000> .load C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
0:000> .load C:\Users\Anton\Downloads\sosex_64\sosex.dll
0:000> .symfix
0:000> .reload /f
Reloading current modules
.*** WARNING: Unable to verify checksum for DebugTutorial.exe
....
0:000> lm
start             end                 module name
00000252`916b0000 00000252`916b6000   DebugTutorial C (pdb symbols)          C:\ProgramData\dbg\sym\DebugTutorial.pdb\B430DC1915A0462AB2D21E18458D70E71\DebugTutorial.pdb
00007ffb`233a0000 00007ffb`23404000   MSCOREE    (pdb symbols)          C:\ProgramData\dbg\sym\mscoree.pdb\02E66277C518120A967A3BFBC1850C941\mscoree.pdb
00007ffb`30280000 00007ffb`304f3000   KERNELBASE   (pdb symbols)          C:\ProgramData\dbg\sym\kernelbase.pdb\CD6C76E6120253287103CD7E22CC0A5D1\kernelbase.pdb
00007ffb`32900000 00007ffb`329b1000   KERNEL32   (pdb symbols)          C:\ProgramData\dbg\sym\kernel32.pdb\CA130BEBF44E36EAC20C5E95752843F61\kernel32.pdb
00007ffb`33ca0000 00007ffb`33e81000   ntdll      (pdb symbols)          C:\ProgramData\dbg\sym\ntdll.pdb\95927C40B68E505CD22742795247114C1\ntdll.pdb
0:000> !mbp DebugTutorial Foo1
The CLR has not yet been initialized in the process.
Breakpoint resolution will be attempted when the CLR is initialized.
0:000> .load C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
0:000> .reload /f
Reloading current modules
.*** WARNING: Unable to verify checksum for DebugTutorial.exe
....
0:000> !mbp DebugTutorial Foo1
The breakpoint could not be set because a breakpoint has already been specified for this source location.

If I place breakpoin with F9 hotkey I see next

0:000> g
Unable to insert breakpoint 0 at 00000252`916b002e, Win32 error 0n998
    "Invalid access to memory location."
bp0 at 00000252`916b002e failed
WaitForEvent failed
ntdll!LdrpDoDebuggerBreak+0x31:
00007ffb`33d6c93d eb00            jmp     ntdll!LdrpDoDebuggerBreak+0x33 (00007ffb`33d6c93f)

Win32 error 0n998

Why? What is happening? How to debug .net with windbg?

[This](https://stackoverflow.com/a/12018376/4137916) has some useful things to try out/consider. — Jeroen Mostert, May 03 '19 at 10:21

Thomas Weller · Accepted Answer · 2019-05-03T13:14:21.200

.load ...\clr.dll is attempting to load the .NET framework as a plugin for WinDbg. That won't work. The .NET plugin for WinDbg is called SOS and you usually do .loadby sos clr. However, that should not matter much for the rest of the session.

First, you're using !mbp, which is used with source file and line number. However, you use it with module and method.

Second, even for !mbm, the parameters DebugTutorial Foo1 are incorrect. The format is module!namespace.class.method. Luckily you can use wildcards. Try !mbm *!*method

Third, IMHO you get a better feedback of whether your command works or not, if the .NET framework is already loaded and about jitting. Use sxe ld clrjit to achieve that.

So here we go:

ntdll!LdrpDoDebuggerBreak+0x30:
00007ffd`fe112cfc cc              int     3
0:000> sxe ld clrjit
0:000> *** Wait until .NET is loaded
0:000> g

(3bc4.33bc): Unknown exception - code 04242420 (first chance)
ModLoad: 00007ffd`d2530000 00007ffd`d265b000   C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
ntdll!NtMapViewOfSection+0x14:
00007ffd`fe0dfb94 c3              ret
0:000> .load E:\...\sosex.dll
0:000> !mbm *!*Foo1
0:000> !mbl
0 e : disable *!*FOO1 ILOffset=0: pass=1 oneshot=false thread=ANY
    SODebugMBP!DebugTutorial.Program.Foo1() (PENDING JIT)

0:000> g

Breakpoint: JIT notification received for method DebugTutorial.Program.Foo1() in AppDomain 0000028c1a58ea00.
Breakpoint set at DebugTutorial.Program.Foo1() in AppDomain 0000028c1a58ea00.
Breakpoint 2 hit
00007ffd`730804e8 90              nop
0:000> !clrstack
OS Thread Id: 0x13d4 (0)
        Child SP               IP Call Site
000000d4d8afeaa0 00007ffd730804e8 DebugTutorial.Program.Foo1() [C:\...\Program.cs @ 14]
000000d4d8afead0 00007ffd730804a2 DebugTutorial.Program.Main(System.String[]) [C:\...\Program.cs @ 26]
000000d4d8afed30 00007ffdd2666da3 [GCFrame: 000000d4d8afed30]

WinDbg sosex unable to debug

1 Answers1