How to set a breakpoint when .NET 2 or .NET 4 is loaded?

Question

Sometimes I'm debugging .NET applications but I don't know whether they will use .NET 2 or .NET 4. I want to break in when .NET gets loaded, so I do

sxe -c ".echo .NET4 loaded" ld clr
sxe -c ".echo .NET2 loaded" ld mscorwks

Unfortunately there can only be one such breakpoint and in above example, mscorwks overwrites clr and in case of .NET4, it will not hit the breakpoint.

Is there a way to break on multiple different load events?

I really don't want to fiddle around with my non-working incomprehensible try of

sxe -c".foreach /ps 5 /pS 99 (token {.lastevent}) {.if ($spat(\"[0-9a-z.:\\]*\\clr.dll\",\"${token}\")) {.echo clr;} .elsif ($spat(\".*\mscorwks.dll\",\"${token}\")) {.echo mscorwks} .else {}}" ld

Selfdeceit

Answer 1

Using pykd, I came up with the following solution:

First, write a Python script (loadModule.py in my example) with the following content:

from pykd import *
import sys

event = lastEvent()
if event != eventType.LoadModule:
    sys.exit()

# get module load event details in string format
details = dbgCommand(".lastevent")

# remove the debugger time
details = details.split("\n")[0]

# get everything behind "Load module"
details = details.split("Load module ")[1]

# remove address
details = details.split(" at ")[0]

# remove full path
details = details.split("\\")[-1]

# remove extension
details = ".".join(details.split(".")[0:-1])

# compare case-insensitive
details = details.upper()

if details in [x.upper() for x in sys.argv[1:]]:
    breakin()

Then set a breakpoint on the load event like this:

sxe -c "!py loadModule.py clr mscorwks coreclr;g" ld

This will execute the Python script on every module load event. The script breaks into the debugger (breakin() in Python script) if the module is found, otherwise it continues (g in WinDbg).

You can use any number of modules. The comparison is performed case insensitive.

Please note that this may not be the most elegant solution. There seems to be another way: subclassing eventHandler::onModuleLoad.

Selfdeceit

Answer 2

You can set two breakpoints

bu mscorwks!EEStartup

bu clr!EEStartup

(for example bu clr!EEStartup ".echo Breaking into debugger on clr loaded") and only one of them will work

Porte

@sta-sh: Thanks for this answer. In many cases it will be sufficient. However, it answers only the question of the headline, not the more general question on how to break on multiple load events, which is e.g. needed if we include Silverlight (coreclr.dll) in this list. – Selfdeceit