I use windbg to debug a simple C # application that has only an empty form:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
namespace WindowsFormsApp2
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}
private void Form1_Load(object sender, EventArgs e)
{
}
}
}
I compile, run this application, attach to it using windbg, then run in windbg:
0:009> .cordll -ve -u -l
Automatically loaded SOS Extension
CLRDLL: Loaded DLL C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscordacwks.dll
CLR DLL status: Loaded DLL C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscordacwks.dll
And download the SOS extension and make sure it is loaded:
0:009> .loadby sos mscorwks
0:009> .chain
Extension DLL search Path:
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\WINXP;C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext;C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\arcade;C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\pri;C:\Program Files (x86)\Windows Kits\10\Debuggers\x64;C:\Users\username\AppData\Local\Dbg\EngineExtensions;C:\Program Files (x86)\Windows Kits\10\Debuggers\x64;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\PuTTY\;C:\Program Files (x86)\Bitvise SSH Client;C:\Program Files\nodejs\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Program Files\Git\cmd;C:\Users\username\AppData\Local\Android\sdk\platform-tools;C:\Program Files (x86)\Nox\bin\;C:\Users\username\AppData\Local\Microsoft\WindowsApps;C:\Users\username\AppData\Roaming\npm;C:\Program Files (x86)\Nmap;C:\Program Files (x86)\mitmproxy\bin
Extension DLL chain:
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\sos: image 2.0.50727.8794, API 1.0.0, built Tue Jun 20 23:15:41 2017
[path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\SOS.dll]
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\SOS.dll: image 2.0.50727.8794, API 1.0.0, built Tue Jun 20 23:15:41 2017
[path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\SOS.dll]
dbghelp: image 10.0.15063.468, API 10.0.6, built Thu Jan 1 03:00:00 1970
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll]
ext: image 10.0.15063.468, API 1.0.0, built Thu Jan 1 03:00:00 1970
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\ext.dll]
exts: image 10.0.15063.468, API 1.0.0, built Thu Jan 1 03:00:00 1970
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\WINXP\exts.dll]
uext: image 10.0.15063.468, API 1.0.0, built Thu Jan 1 03:00:00 1970
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\uext.dll]
ntsdexts: image 10.0.15063.468, API 1.0.0, built Thu Jan 1 03:00:00 1970
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\WINXP\ntsdexts.dll]
Then I set the path for the debugging symbols to the folder in which it is located .pdb, and the folder with the sources.
But when I open the source file and set a breakpoint in the source line and then continue the process, I get an error in windbg:
0:009> g
Unable to insert breakpoint 3 at 00000000`008f001a, Win32 error 0n998
"Invalid access to memory."
bp3 at 00000000`008f001a failed
WaitForEvent failed
I expected it to break and show me assembler instructions .net, but it does not work all the time. How can you stop a .net application using windbg?