Microsoft Diagnostics Runtime crash.dmp analysis (C#)

Question

I'm trying to read in a crash.dmp using the functionality in Microsoft.Diagnostics.Runtime .NET componenet (also known as ClrMD).

I have a crash.dmp in a known location (in a string called pathToFile) so that's not the issue. The rest of the code looks like this.

DataTarget dataTarget = DataTarget.LoadCrashDump(pathToFile);
ClrInfo clrInfo = dataTarget.ClrVersions[0];
string dacLocation = clrInfo.TryGetDacLocation();

When testing this code, I get the following error in the command window:

Error processing directory: System.ArgumentOutOfRangeException. Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index.

I'm assuming it's something to do with the ClrVersions[0] bit but can't for the life of me pin it down.

Any help would be appreciated.

Current Status When running the following command (which fails)

ClrRuntime rt = dataTarget.CreateRuntime("path\to\mscordawks.dll");

I receive the following error in cmd mismatched architecture between this process and the dac

Cheers

Anyone?

Answer 1

I followed this artificial to get the mscordacwks.dll when dealing with platform differences between where the dmp file was taken and the machine doing the analysis.

http://chentiangemalc.wordpress.com/2014/04/16/obtaining-correct-mscordacwks-dll-for-net-windbging/#comment-3380 and followed the steps including renaming the file to include the architecture and version information.

After that I just http://chentiangemalc.wordpress.com/2014/04/16/obtaining-correct-mscordacwks-dll-for-net-windbging/#comment-3380ut the full path of the file as dacLocation in the script.

After that it worked!

I suspect that putting it on the path could be made to work.

Answer 2

If the TryGetDacLocation succeeded then you should be able to do ClrRuntime rt = dataTarget.CreateRuntime(dacLocation); so you get the correct dacLocation.

Was the dump you are analysing generated on same machine where you are analysing it? Also what are the bitnesses of the process the dump was generated from, the process in which the CLRMD code is running and the debugger utility used to generate the dump?

Generally you want to be matching the bitnesses all round (x86/x64).

Doug

Answer 3

I was having the same issue reading a dump file generated on the same computer. There were two problems, first bitness (should have been 64, was running in 32) and the second harder problem that the proper DLL could not be located. To fix the second problem I created a method that tries all of the properly named DLLs it can find:

private static ClrRuntime GetRuntime(DataTarget target)
{
    ClrInfo version = target.ClrVersions[0];

    string dacLocation = version.TryGetDacLocation();

    // If we don't have the dac installed, we will use the long-name dac in the same folder.
    if (!string.IsNullOrEmpty(dacLocation))
        dacLocation = version.DacInfo.FileName;

    try  // try the one it should be
    {
        return target.CreateRuntime(dacLocation);
    }
    catch (Exception e)
    {
    }

    // can't find the one it should be, try'em all
    string fileName = "mscordacwks.dll";
    string[] searchLocations = new[]
    {
        @"C:\Windows\Microsoft.NET\",
        @"C:\Windows\winsxs\"
    };

    foreach (string searchLocation in searchLocations)
    {
        foreach (string file in Directory.GetFiles(searchLocation, fileName, SearchOption.AllDirectories))
        {
            try
            {
                return target.CreateRuntime(file);
            }
            catch (Exception e)
            {
            }
        }
    }
    throw new Exception("No found valid runtimes");            
}