Deciphering the .NET clr20r3 exception parameters P1..P10

Question

i'm trying to decipher the meaning on the P1...P10 parameters associated with a clr20r3 that is written to the event log when my application experiences an exception.

The best i've been able to find is:

• P1: the hosting process (e.g. w3wp.exe)
• P2: the hosting process version (e.g. 6.0.3790.1830)
• P3: ??? (e.g. 42435be1)
• P4: the assembly from which the exception was raised (e.g. mrtables.webservice)
• P5: the assembly version (e.g. 2.1.2.0)
• P6: ??? (e.g. 4682617f)
• P7: ??? (e.g. 129)
• P8: ??? (e.g. 50)
• P9: the exception type raised (e.g. system.argumentexception)
• P10: ??? (e.g. NIL)

Googling for clr20r3 provides thousands of sample parameter values, from which someone can try to derive a pattern.

But i'm hoping for documentation on the parameter meanings, as opposed to educated guesses.

---

Edit: While i can hope for canonical documentation, really i'd be happy to see the exception being thrown, at what line, complete with a stack trace.

Answer 1

Here is the information on Watson Buckets

1. Exe File Name
2. Exe File assembly version number
3. Exe File Stamp
4. Exe file full assembly name
5. Faulting assembly version
6. Faulting assembly timestamp
7. Faulting assembly method def
8. Faulting method IL Offset within the faulting method
9. Exception type

And also here is a MSDN article on the same.

Answer 2

P7 and P8 are the important ones to find out where the P9 exception was raised. Use P4 to know what assembly to look for. Run ildasm.exe and open that assembly. File + Dump, tick the "Token values" checkbox, OK and save the .il file somewhere.

Open the file in a text editor. P7 gives you the method token, it starts with 0x06. Convert yours to hex (129 = 0x81), producing token value "06000081". Search for:

.method /*06000081*/

Which gives you the method name, look up from there to find the .class, that gives you the class name.

P8 gives you the IL offset, convert it to hex (50 = 0x32). From the found .method, look for IL_0032 for the instruction that raised the exception. Mapping it back to your source code is a bit tricky but you'll probably figure it out. Use Reflector if necessary.

In general, write an event handler for AppDomain.UnhandledException to avoid the pain of reverse-engineering these Watson crash buckets. Log the value of e.ExceptionObject.ToString() to get both the exception message and a stack trace.