Son of Strike - SOS is a debugging extension that lets developers peer into the internal workings of the Common Language Runtime (CLR) in real time and in mini dumps.
The following FAQ is compiled from the output from Son of Strike - SOS debugger extension.
.load sos !help faq
>> Where can I get the right version of SOS for my build?
If you are running version 1.1 or 2.0 of the CLR, SOS.DLL is installed in the same directory as the main CLR dll (MSCORWKS.DLL). Newer versions of the Windows Debugger provide a command to make it easy to load the right copy of SOS.DLL:
.loadby sos mscorwks
That will load the SOS extension DLL from the same place that MSCORWKS.DLL is loaded in the process. You shouldn’t attempt to use a version of SOS.DLL that doesn’t match the version of MSCORWKS.DLL. You can find the version of MSCORWKS.DLL by running "lm v m mscorwks" in the debugger.
If you are using a dump file created on another machine, it is a little bit more complex. You need to make sure the mscordacwks.dll file that came with that install is on your symbol path, and you need to load the corresponding version of sos.dll (typing .load rather than using the .loadby shortcut). Within the Microsoft corpnet, we keep tagged versions of mscordacwks.dll, with names like mscordacwks__.dll that the Windows Debugger can load. If you have the correct symbol path to the binaries for that version of the Runtime, the Windows Debugger will load the correct mscordacwks.dll file.
>> I have a chicken and egg problem. I want to use SOS commands, but the CLR isn’t loaded yet. What can I do?
In the debugger at startup you can type: "sxe clrn" Let the program run, and it will stop with the notice
"CLR notification: module 'mscorlib' loaded"
At this time you can use SOS commands. To turn off spurious notifications, type: "sxd clrn"
>> I got the following error message. Now what?
0:000> .loadby sos mscorwks 0:000> !DumpStackObjects Failed to find runtime DLL (mscorwks.dll), 0x80004005 Extension commands need mscorwks.dll in order to have something to do. 0:000>
This means that the CLR is not loaded yet, or has been unloaded. You need to wait until your managed program is running in order to use these commands. If you have just started the program a good way to do this is to type bp mscorwks!EEStartup "g @$ra"
in the debugger, and let it run. After the function EEStartup is finished, there will be a minimal managed environment for executing SOS commands.
>> I have a partial memory minidump, and !DumpObj doesn’t work. Why?
In order to run SOS commands, many CLR data structures need to be traversed. When creating a minidump without full memory, special functions are called at dump creation time to bring those structures into the minidump, and allow a minimum set of SOS debugging commands to work. At this time, those commands that can provide full or partial output are:
CLRStack Threads Help PrintException EEVersion
For a minidump created with this minimal set of functionality in mind, you will get an error message when running any other commands. A full memory dump (obtained with “.dump /ma ” in the Windows Debugger) is often the best way to debug a managed program at this level.
>> What other tools can I use to find my bug?
Turn on Managed Debugging Assistants. These enable additional runtime diagnostics, particularly in the area of PInvoke/Interop. Adam Nathan has written some great information about that: Http://blogs.gotdotnet.com/anathan/categoryview.aspx/Debugging