WinDbg - Problem with 'Open Executable'

Question

Hello,

I tried to debug a .NET console app using WinDbg. I normally do this by File -> Open Executable, then WinDbg would load up the selected exe. This was working for the .NET app mentioned. But now I get the following output every time:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\xxxxxxx\MultiTS\bin\Release\SimepleTS.exe"
Symbol search path is: D:\xxxxxx\Debug
Executable search path is: 
ModLoad: 00400000 00408000   SimepleTS.exe
Unable to insert breakpoint 0 at 036a3ff7, Win32 error 0n299
    "Only part of a ReadProcessMemory or WriteProcessMemory request was completed."
bp0 at 036a3ff7 failed
WaitForEvent failed
eax=00402f7e ebx=7ffd8000 ecx=7c910060 edx=7c90e920 esi=0079faa0 edi=00d4f558
eip=7c810705 esp=0012fffc ebp=7c91005d iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000200
7c810705 ??              ???

Start the app first and attach to process doesn't work too. However, opening other .NET executable, e.g. the WinForm project I have, is still working correctly.

Any clue what's wrong here?

Answer 1

Hi there.

Is your .NET app compiled as a 32bit or 64bit app? I'm reading a lot of stuff on the web about this error, and one popular situation is people getting stuck trying to debug 64bit images using 32bit WinDbg (well, that's what it looks like).

http://winprogger.com/?p=26

http://translate.google.co.uk/translate?hl=en&sl=zh-CN&u=http://www.cnblogs.com/boyd4y/archive/2009/11/19/1606041.html&ei=w4tqS8WWCIX80wT1qtncBA&sa=X&oi=translate&ct=result&resnum=1&ved=0CAgQ7gEwADgK&prev=/search%3Fq%3Dwindbg%2BOnly%2Bpart%2Bof%2Ba%2BReadProcessMemory%2Bor%2BWriteProcessMemory%2Brequest%2Bwas%2Bcomplete%26hl%3Den%26rlz%3D1C1___enGB359GB359%26sa%3DN%26start%3D10

http://stackoverflow.com/questions/842569/windbg-dump-command-fails-with-error-0x8007012b

Cheers. Jas.

Answer 2

my guess is that you have an old breakpoint used before on a module which is getting loaded at a different address as before. Since the workspace has been saved, so was the bp (it must have been a bu - these get saved into workspace). Clear the bp (bc0) and re-save the workspace (if necessary).