windbg

What is the HostCodeHeap and why are they leaking?

We have .NET application (actually an IronPython app). We noticed that overtime the app becomes bigger in memory and sluggish. Using WINDBG (!eeheap -loader), we noticed the that the LoaderHeap is getting bigger (150MB increase per day). From the !eeheap output it seems that the increase is due to HostCodeHeap (objects?). I'd like to ...

Fastest way to break in WinDbg for specific exception? .net 4.0 app.

Folks, Debugging a .net 4.0 app using WinDbg (I'm a beginner to WinDbg). I'm trying to break when I hit a stack overflow: (NTSTATUS) 0xc00000fd – A new guard page for the stack cannot be created Unfortunately, this overflow happens about 2-hours into a long-running process and logs tells me that it doesn't always happen at the same ti...

Why syncblk is located at -4 and not at 0?

So if you want to look at sync block for an object, under sos you have to look at -4 bytes (on 32 bit machines) before the object address. Does anyone know what is the wisdom for going back 4 bytes? I mean they could have sync block at 0, then type handle at +4 and then object fields at +8. ...

WinDbg alternative to !dumpheap -type?

I got the following line from !dumpheap -stat 000007fee09d6960 441762 835293368 System.String I'm interested to find out what the 441 762 strings are used for. Doing a !dumpheap -type System.String would list all, or am I mistaken? How can I just analyze some of them? ...

windbg !gcroot <address> returns no roots

What does it mean if !gcroot returns an empty thread list? 0:000> !gcroot 0000000010817c50 Note: Roots found on stacks may be false positives. Run "!help gcroot" for more info. Scan Thread 2 OSTHread 15a4 Scan Thread 10 OSTHread 1db4 Scan Thread 11 OSTHread 147c Scan Thread 12 OSTHread 15d4 Scan Thread 14 OSTHread 9dc Scan Thread 15 O...

Help debug a stackoverflow - next steps with repeating stack?

Folks, I've got a stack overflow in my .net 4.0 app. using WinDbg I've found the following chunk of stack-info repeated 110 times (with different memory addresses of course), which leads me to believe that this is the case of the overflow. The issue is that none of this seems like my code! Any suggestions on how to proceed with debug...

Windbg, !heap output to .foreach

Doing some debugging in windbg, and I'd like to be able to go through each heap allocation of a given size and then do some analysis on that (just dd for now). Problem is !heap doesnt throw out stuff very cleanly. I know I can skip the first X or every Y tokens with .foreach flags, but can't seem to get this to work. Basically looking...

Silverlight application under IE attached to Windbg

Is it possible to attach Windbg to a Silverlight based application running under internet explorer ( or any other browser)? If its possible, then will I have to attach windbg to the browser and this will get me into that mini CLR under Internet explorer? ...

Dump file analysis of Java process?

If I take dump, using Windbg, of Java process running on Windows Can I analyze (easly?) the Java heap, objects, and threads? Just like I could do with SOS for .Net process? Otherwise - how can I offline debug a problem happening on production systems? Thanks! ...

64 or 32 bit version of WinDBG?

I have a 64 bit host OS and a 32 bit guest OS running inside VMWare. I want to use WinDBG to debug 32 bit guest OS from my 64 bit host OS. Which version of WinDBG should I install? 32 or 64 bit? ...

Can I use DbgEng extension DLL in custom application?

Hi all, I am curious can I use DbgEng extension without WinDbg. For example is it possible to use DbgEng extension from managed .NET application? Regards, Remsy ...

Windbg native call stack trace does not make sense

I have a simple test program causing an infinite wait on lock. public class SyncBlock { } class Program { public static SyncBlock sync = new SyncBlock(); private static void ThreadProc() { try { Monitor.Enter(sync); } catch (Exception) { //Monitor.Exit(sync)...

What is Unloaded Type in Windbg ?

I am trying to debug a memory dump and I am looking at one type as being labelled as 2c172a8c 1313427 1040234184 <Unloaded Type> Does anyone know what this means exactly? TIA Andrew ...

How to get thread stack information on Windows?

Hello, I enumerate all threads in a process through CreateToolhelp32Snapshot function. I would like to get some basic stack information for each thread. More specifically I would like to get stack bottom address and if possible I would like to get current stack top address. Basically this is the information displayed with ~*k command in...

inspect field on all instances in memory dump

I have a memory dump that I'm using to troubleshoot a client issue. This is a .NET (C#) application. The problem with my application is that too many instances of a particular class are being created. There are 6300 instances of this class when there should be something like 20. I want to loop through all of those instances and call ...

Retrieve contents of session from dump of ASP.net 3.5 process in Windbg

Hi, I have taken a dump of W3wp.exe process and am trying to retrieve the contents of session using Windbg. My test application is ASP.net 3.5 running on Windows 7 64 bit and the session is inprocess. I can retrieve the contents of various other objects but am struggling to find where session contents is located. Yes I know storing stu...

Setting break point using source code line number in WinDBG

Hi all I am aware of setting breakpoint base on function name in WinDBG using bp, bm commands is there a way to set break point break on source code line number say <some command> 20 means it should set breakpoint at line 20 Thanks in advance ...

Is there a 64 bit version of psscor2?

I'm trying to debug a .NET 3.5, 32 bit application running on Windows 7/64 bit with WinDbg. I'd like to use psscor2, but I can't load it. I can't load sos, either. When I try to load psscor2, I get this error: > .load psscor2 The call to LoadLibrary(psscor2) failed, Win32 error 0n193 "%1 ist keine zulässige Win32-Anwendung." Pleas...

symbols mismatch, ida/windbg

Hi! Recently I was trying to learn more about Windows Kernel. I downloaded right symbols for my sys(win7 x64 free). I run IDA and open ntoskrnl.exe. IDA asked whether to attach pdb file. But most of functions were not resolved - sub_XXXXXX. So I ran Windbg, I unassembled randomly chosen function which has to be in ntoskrnl - KiSystemCall...

Can debugging symbols be built after-the-fact?

We have hundreds of MSVC 9.0 C++ projects. One DLL slipped out into the public without the correct compiler/linker settings to generate symbols, and we are getting mini-dumps back that point to an exception in this DLL. We have the exact source code used to generate this DLL. Can it be compiled to produce symbols that we can use to debug...