Wednesday, October 10, 2012

Getting the correct versions of .Net Framework for WinDbg

To debug a minidump of a .Net application created by Windows Error Reporting, it is essential that you have the correct version of the following 3 dll's
sos.dll
mscorwks.dll
mscordacwks.dll
The correct version being the version of the .Net framework that the user was running at the time the minidump was generated. For example, if the minidump was created using the framework 2.0.50727.4971, then you need the 2.0.50727.4971 version of the dll's mentioned above to debug this. Chances are this is NOT the version you currently have on your machine, it may not even be a valid version for your OS (XP, Vista, 7, 8) or architecture (x86, x64). As far as I'm aware, there is no central repository where you can go an grab the correct version of these libraries from, so one has to attempt to find them the hard way.
The .Net framework is initially deployed with our application, however, it is regularly updated, once installed, by Windows Update, to ensure that security vulnerabilities and major defects are patched. If your application is only installed on a single server (or server farm), this is not really a challenge, however, if your application is installed as a desktop application on nearly quater of a million PC's world wide, finding the correct version of the framework requires some sleuthing skills, and a bit of luck. The first step is to try and find the Microsoft support knowledge base article that describes the update. To do this I've found the following query typed into google, usually gets the result you want.

.Net framework 2.0.50727.4971 site:support.microsoft.com

It is usually the first hit, but it may be further down. Validate this by searching the resulting page (Ctrl+F) for the framework version (e.g. 2.0.50727.4971) and make sure SOS.dll one of the binaries with this version number.
clip_image001
Go to the download information section of this website and click on the provided link. This should take you to the Download Center page where you should see the following options
clip_image002
Click to download the architecture you require. This will download the .msu file for the update. You can use the command-line Expand utility to extract the files in this update package.
expand.exe -D .\Windows6.1-KB2604114-x86.msu
Will list all the files in the package, in this case there are 4,
.\windows6.1-kb2604114-x86.msu: WSUSSCAN.cab
.\windows6.1-kb2604114-x86.msu: Windows6.1-KB2604114-x86.cab
.\windows6.1-kb2604114-x86.msu: Windows6.1-KB2604114-x86-pkgProperties.txt
.\windows6.1-kb2604114-x86.msu: Windows6.1-KB2604114-x86.xml
You want to extract the Windows6.1-KB2604114-x86.cab file to do this use
expand.exe -F:Windows6.1-KB2604114-x86.cab .\Windows6.1-KB2604114-x86.msu .\
You can then use expand.exe to interrogate and extract the contents of this .cab file.
To extract the files you want use
expand.exe -F:sos.dll .\Windows6.1-KB2604114-x86.cab .\
expand.exe -F:mscorwks.dll .\Windows6.1-KB2604114-x86.cab .\
expand.exe -F:mscordacwks.dll .\Windows6.1-KB2604114-x86.cab .\
Each of these statements will usually result in 2 folders named something like the following
x86_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7600.16992_none_e878512ab7239f09
You'll need to check both dll's and make sure you get the version you are after.
Simply copy these into a common folder, and you can then use the following windbg commands to set the exepath and load the correct sos.dll
.exepath+ C:\MyFrameworkFolder\fwx86_2.0.50727.4927
.load C:\MyFrameworkFolder\fwx86_2.0.50727.4927\sos.dll
Happy debugging.