From .Net Framework 2.0, Dr. Watson is able to generate dump compatible with .Net framework. This means, dumps with heap data generated by Dr. Watson contains information about managed heap so they can be analyzed with sos.dll. Some update to Dr.Watson is necessary to make this happen. Dumps generated...

64 bit Windows can run both 32 bit process and 64 bit process. For debugging though, you want to use 32 bit debugger to debug 32 bit process, and 64 bit debugger for 64 bit process. Otherwise it won’t be pretty. Occasionally, I receive a 32 bit process dump generated by a 64 bit debugger. When...

On our stress run, we saw our process’ handle count steadily increases until certain point, then it stabilizes. However the number of handles is high. Most of those handles are Event handles. We are concerned about it. So we went off and did some investigation. Turns out the Event handles are coming...

Windbg Debugger’s !htrace extension is very handy to debug handle leak. The process essentially boils down to the following simple steps: 1. Enable trace 2. Take a snapshot 3. Run scenario 4. Show the diff On step 4, !htrace will show all the extra opened handles after the last snapshot...

We are seeing a NullReferenceException in our stress program. The investigation process may be helpful to some folks. Thread 22 is showing a Watson dialog. This is a register corruption. 0:022> kp ChildEBP RetAddr 091bc9a0 76961220 ntdll!ZwWaitForSingleObject(void)+0x15 ...

When debug a memory dump, the dump may not in the right exception context when it is first loaded in the debugger. However, we can figure out the right context from the dump. Let's load the dump. c:\debuggers>cdb -z c:\temp\foo.dmp Symbol search path is: *** Invalid *** *****************...

Sos.dll does not have a command to tell the size of each GC generation. However, you can calculate the size based on the output of !eeheap -gc. For example, 0:000> !eeheap -gc Number of GC Heaps: 1 generation 0 starts at 0x1da6c430 generation 1 starts at 0x1da5c240 generation...

when debugging a managed memory dump, we can use Sos.dll to inspect managed objects inside the dump. for example, we can do !dumpheap to list the managed objects in GC Heap, we can also use !gcroot to figure out the reference path to a particular object. However, if we want to understand the whole...

I was always wondering what is happening between an application throws an unhandled exception, and a debugger attached to the process. Apparently the information is right under my nose, but I was blind. Windows Debugger's documentation about post-mortem debugging has all the details you want to know...

If you are developing software, most likely you have encountered the "mismatched pdbs" debugger error. It usually happens when you point the debugger to the wrong symbol path. But there are times you are confident that the symbols you point to are the correct symbols, and it left you wondering why...

I accidentally stumble on these two registry keys. And the expert in Windows Debugger team answers my question. -----Original Message----- From: Subject: RE: managed minidump Auxiliary DLLs are loaded inside of MiniDumpWriteDump when it finds a registered auxiliary DLL for a module in the target...

From .Net framework 2.0, CLR creates a debugger helper dll mscordacwks.dll. The dll is used by Windows Debugger to enumerate CLR data structures. Mscordacwks.dll is part of .Net framework redist. C:\Windows\Microsoft.NET\Framework\v2.0.50727>dir mscordacwks.dll Volume in drive C is Vista...

MSDN and Microsoft support web site have some great information on how to find memory leaks, both for managed application and native applications. Unmanaged: How to use Umdh.exe to find memory leaks http://support.microsoft.com/kb/268343 Managed: Debugging Memory Problems http://msdn2.microsoft.com/en...

If you attach windows debugger to a .Net framework application, occasionally you may see debug spew of unknown exception 0xe0434f4e. (cfc.1244): Unknown exception - code e0434f4e (first chance) 0xe0434f4e is defined as EXCEPTION_HIJACK. (Copied from Rotor 2.0 sources corexcep.h) #define EXCEPTION_HIJACK...

In Windows Debugger, we can break on C++ exception by doing " sxe eh ". We can also break on CLR exception by doing " sxe clr ". But sometimes you may see the following debug spew: (94c.960): C++ EH exception - code e06d7363 (first chance) (94c.960): Unknown exception - code e0434352 (first chance...

Virtual Machine completely changes how people test software (Well, definitely me.). Create a virtual machine, enable undo disk, install your changes, test it. Does not work? Throw away the undo disk, and you have a brand new machine to work with. For people working on drivers or critical system services...

Many people have experienced unexpected computer restarts. Unexpected restarts can be caused by bugs in Windows Kernel, bugs in critical Windows Services, bugs in drivers, among other things. When Windows experiences an unexpected restart request, it will create a mini dump capturing the minimum information...