Notes from a dark corner

1433

This is a number that is going to become very familiar to me over the coming months and probably years. It'll join a hall of fame, along with 42, 832, 2032, 288,6018. Why? Is it my ATM pin? My new car registration? No, neither of these.

It is in fact the "Revision part" of the version number of most DLLs in service pack 1 of .NET Framework 2.0. I tend to refer to it as the QFE or hotfix build number as it is the bit we increment when we release a new hotfix. You can see how they progress in this list of CLR hotfixes that we have released, for example.

When you spend your day looking at dump files of .NET applications from lots of different systems you very quickly become familiar with the most common QFE build numbers. It's important because you can work out what fixes the system in question already has. For example if I got a new dump in today and saw this in the debugger:

0:050> lmvmmscorwks
start    end        module name
79e70000 7a3d1000   mscorwks   (deferred)            
    Image path: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
    Image name: mscorwks.dll
    Timestamp:        Fri Sep 23 12:33:00 2005 (4333E7EC)
    CheckSum:         0055FD21
    ImageSize:        00561000
    File version:     2.0.50727.42
    Product version:  2.0.50727.42
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® .NET Framework
    InternalName:     mscorwks.dll
    OriginalFilename: mscorwks.dll
    ProductVersion:   2.0.50727.42
    FileVersion:      2.0.50727.42 (RTM.050727-4200)
    FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
    LegalCopyright:   © Microsoft Corporation.  All rights reserved.
    Comments:         Flavor=Retail

I would immediately know that the customer's system was on the RTM (Release To Manufacturing == first, final, non-beta release) of the .NET 2.0 Framework. I would therefore know that not only do they not have the service pack we just released but they also do not have the MS07-040  security patch we released in July or any of the other hotfixes we've released for the CLR.

So almost the first thing I do when I open a dump is check the version of mscorwks.dll.

Not every file in the framework/runtime gets patched in a service pack or hotfix, only those that need to be (taking into account dependencies and files updated in previous fixes). Most files do get updated in a service pack and mscorwks.dll is the core DLL of the CLR/runtime so that gets patched in any CLR hotfix.

The following table summarises some of the key build numbers for the CLR:

When I was preparing this blog post I came across this cool web page by Frank Dzaebel  who provides a neat batch file for checking the version information on your system and a reference table for comparison. There are also a couple of other .NET version pages that Frank links to, here at TMG Development and here at Pluralsight.

HTH

Doug