分析C# dump时报错版本不匹配

最新推荐文章于 2024-04-11 11:00:57 发布

原创最新推荐文章于 2024-04-11 11:00:57 发布 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

总结专栏收录该内容

10 篇文章

订阅专栏

在使用Windbg分析C# dump文件时遇到版本不匹配错误，无法加载mscordacwks.dll。通过检查mscorwks.dll的版本为2.0.50727.5448，找到对应版本的mscordacwks_x86_x86_2.0.50727.5448.dll，并将其放在Windbg目录下。执行`.cordll -ve -u –l`命令后，成功加载并能查看线程栈。

.load C:\Windows\Microsoft.NET\Framework\v2.0.50727\sos.dll

!threads

报错：

0:058> !threads
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mscorwks.dll -
PDB symbol for mscorwks.dll not loaded
Failed to load data access DLL, 0x80004005
Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
            2) the file mscordacwks.dll that matches your version of mscorwks.dll is
                in the version directory
            3) or, if you are debugging a dump file, verify that the file
                mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
            4) you are debugging on the same architecture as the dump file.
                For example, an IA64 dump file must be debugged on an IA64
                machine.

You can also run the debugger command .cordll to control the debugger's
load of mscordacwks.dll. .cordll -ve -u -l will do a verbose reload.
If that succeeds, the SOS command should work on retry.

If you are debugging a minidump, you need to make sure that your executable
path is pointing to mscorwks.dll as well.

看来是版本不匹配

查看mscorwks.dll的版本信息：

0:058> lmvm mscorwks
start    end        module name
027f0000 02d9b000   mscorwks   (export symbols)       mscorwks.dll
    Loaded symbol image file: mscorwks.dll
    Image path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
    Image name: mscorwks.dll
    Timestamp:        Thu Jul 07 14:01:50 2011 (4E154BCE)
    CheckSum:         005ACA70
    ImageSize:        005AB000
    File version:     2.0.50727.5448
    Product version: 2.0.50727.5448
    File flags:       0 (Mask 3F)

找到与之对应的mscordacwks.dll, 命名为：mscordacwks_x86_x86_2.0.50727.5448.dll

然后放到Windbg目录下（windbg.exe同一目录）

然后

执行下面这个命令再次加载：

.cordll -ve -u –l

再查看线程栈：!threads

成功