Windbg expects different version of mscordacwks.dll

Question

I'm having a very strange issue in trying to debug a minidump file using windbg. I've tried this both on my own machine & by running windbg on the target machine from where the minidump was taken but the result is the same in both cases.

At the start I load the required dlls as shown below, note the same issue occurs if I set the sympath to microsoft symbols server.

0:000> .symfix c:\sos

0:000> .load C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sos

Checking the chain everything looks good, so I now go to run !pe and get an error about mscordacwks, which normally, as far as I know, indicates that I'm using the wrong version of the .net framework. But that really shouldn't be the case here as I running this on the target machine.

I then do a verbose loading

.cordll -ve -u -l

and get the following error message

CLRDLL: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll:4.0.30319.17929 f:8 doesn't match desired version 4.0.30319.296 f:8

What I don't understand is why windbg is looking for an older version of mscordacwks ? It appears that the .296 build is the version of the clr that gets download from the ms symbol server, but I've explicity told windbg to use the local version.

I've tried the approaches suggested here and here but nothing works. Any help is greatly appreciated.

Saran

It seems there are some reports of issues similar to yours when attempting to debug a .NET 4 app using SOS after installing .NET 4.5. See e.g. bottom of: epiwiki.se/tools/windbg/analyze-the-dump-file/… and middle of: wintellect.com/cs/blogs/jrobbins/archive/2012/03/08/… – Septicidal

that may explain it as the very first thing the latest version of debugging tools for windows does is prompt you to install .net 4.5 – Saran

Which version of the debugging tools are you using? – Northeaster

Answer 1

This is because you're debugging a .NET 4.0 dump on a machine with .NET 4.5 installed. The underlying debug APIs changed significantly between 4.0 and 4.5, such that you cannot debug a .NET 4.0 dump with the .NET 4.5 SOS.dll. What I do is to copy a .NET 4.0 SOS to my winext directory and load it explicitly when I'm debugging a .NET 4.0 dump.

Panzer

Answer 2

How did you try the steps of WinDbg x64: Cannot debug a crash dump - failed to load data access DLL?

You are supposed to

1. Copy mscordacwks.dll from the source machine.
2. Rename it to mscordacwks_AMD64_AMD64_4.0.30319.296.dll.
3. Drop this dll to the folder of WinDbg.exe.
4. Reinitialize the debug session (close and re-open WinDbg).

Then very likely you might receive an error message saying WinDbg wants the SOS for that version of .NET 4, and you can

1. Copy sos.dll from the source machine and save it to C:\temp\sos.dll.
2. In WinDbg, instead of calling .loadby sos clr, use .load C:\temp\sos.dll.

I wrote about how you should prepare your own toolbox around WinDbg and .NET in this post.

Disbursement