A Mutable Log

Post-mortem debugging of .NET applications using WinDbg

Debugging is a skill you usually learn under pressure, when things are going awry with an application or service just gone live. It is never a pleasure to encounter such bugs because, although they happen quite frequently in your production environment, they are particularly hard to reproduce in your test environment.

For managed applications, you can learn a new skill that will save you some face, called post-mortem debugging. WinDbg is a splendid tool that is often used to debug running processes, but can also be used to analyze process crash dumps.

Dump process memory

User mode process memory dumps can be obtained through several means

You need to have enough disk space because dmp files can be rather big.

WinDbg commands

Once you have the crash dump file, you can open it with WinDbg, and examine it using several useful commands

Symbol files

You can run .sympath C:\SymbolCache to download and load symbols from a specified path. To load symbols from Microsoft and Nuget.org, run .sympath srv*C:\SymbolCache*https://msdl.microsoft.com/download/symbols;srv*C:\SymbolCache*https://symbols.nuget.org/download/symbols.

Run .reload /f to force debugger to reload symbols for all modules from the specified path. Run .symopt +0x40 followed by .reload /f, or .reload /i, if you want to load a symbol file even if it does not match the module. This can be useful if you want to use a symbol file built from the same source code.

Run !chksym Module to check symbol information for a particular module, and !chksym Module Symbol to check if a module matches a symbol file. Use an underscore character for each space character in the module name, or symbol path.

Run !sym noisy if you want to see detailed symbol loading information when these commands are run.

Extensions

WinDbg is most useful for debugging managed application using the following extensions

SOS extension

The SOS extension has several useful commands, particularly

SOSEX extension

The SOSEX extension has the following commands that are particularly useful

Psscor2 extension

The Psscor2 extension has one particularly useful command, among several others, that can come in handy when troubleshooting network related issues

This short post is meant to whet your appetite for post-mortem debugging and to point you in the right direction.

Enjoy!