How can I get full stack traces for mini masks in mixed mode when native WPF images are involved?

Question

I have a mixed C ++ / CLI application that uses WPF. Failures from our customers are reported as mini-drives to our own server.

When I try to explore the mini drive using the commands! pe or! clrstack from sb extension windbg, I often get incomplete information for stack frames from WPF collectors, for example.

SP IP Function 0013E370 564618E3 PresentationFramework_ni!Unknown+0x1bf 0013E3A4 56461258 PresentationFramework_ni!Unknown+0x58 0013E3CC 5634C6D8 PresentationFramework_ni!Unknown+0x18 0013E3D8 55C04AA2 PresentationFramework_ni!Unknown+0x502 ... 

In this case, decoding the stack trace also becomes very slow.

Using! sym noisy shows a lot of messages from

 SYMSRV: C:\Symbols\PresentationFramework.ni.dll\488F142Edab000\PresentationFramework.ni.dll not found SYMSRV: http://msdl.microsoft.com/download/symbols/PresentationFramework.ni.dll/488F142Edab000/PresentationFramework.ni.dll not found DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\PresentationFramework.ni.dll - file not found DBGHELP: PresentationFramework.ni.dll not found in c:\Windows\System32 SYMSRV: C:\Symbols\PresentationFramework.ni.dll\488F142Edab000\PresentationFramework.ni.dll not found SYMSRV: http://msdl.microsoft.com/download/symbols/PresentationFramework.ni.dll/488F142Edab000/PresentationFramework.ni.dll not found DBGENG: C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\PresentationFramework.ni.dll - Couldn't map image from disk. SYMSRV: C:\Symbols\PresentationFramework.dll\488F142E50e000\PresentationFramework.dll not found SYMSRV: http://msdl.microsoft.com/download/symbols/PresentationFramework.dll/488F142E50e000/PresentationFramework.dll not found DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\PresentationFramework.dll - file not found DBGHELP: PresentationFramework.dll not found in c:\Windows\System32 SYMSRV: C:\Symbols\PresentationFramework.dll\488F142E50e000\PresentationFramework.dll not found SYMSRV: http://msdl.microsoft.com/download/symbols/PresentationFramework.dll/488F142E50e000/PresentationFramework.dll not found DBGENG: C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll image header does not match memory image header. DBGENG: C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll - Couldn't map image from disk. 

I used

C: \ Windows \ System32, SRV * C: \ Symbols * Http://msdl.microsoft.com/download/symbols

as a windbg symbol and image path.

As I understand it, this only happens for native .NET images if the machine that crashed and the machine with the debugger is different in terms of the Windows version, .NET version of SP. I saw this mainly for my own WPF images.

What can I do to avoid this problem?

Update original question:

I forgot to mention that I was struggling with a similar problem with different versions of the mscordacwks dll. To use SOS, the version of mscordacwks.dll used on the failed computer is needed on the computer for degradation. So I began to compile different versions of this DLL from different combinations of Windows and SP and put them on our own character server. This, of course, is quite inconvenient, and all the more so because they need to be called by special agreement (eg. Mscordacwks_x86_x86_2.0.50727.4952.dll).

If I understand that Rick answered correctly from below, I should do something similar for my own .NET assembly images that we reference. I tried this manually with one example (WindowsBase.ni.dll), but I could not store this DLL on our symbol server easily. It seems that the native images are not understood by symstore. Error message from symstore:

 SYMSTORE MESSAGE: Skipping file .\WindowsBase.ni.dll - not a known file type. 

So, I tried to put it in an additional directory and added it to my path to a character or image, and then SOS correctly decoded WindowsBase_ni frames.

But all this seems like a lot of annoying manual settings: getting all your own images for different versions of .NET (as for SP and security updates) by manually setting up the debugger, because symstore cannot be used, ...

Is this really the only way?

This is probably not such a problem if you can control the environment of your customers. But this is like a posthumous debugging nightmare for orgnizations that create mixed-mode applications for large user bases.

Answer 1

The output of the symbol server indicates that it is having problems loading images , not the symbols for these images. While Microsoft is pretty good at ensuring that the symbols for all released files go to the symbol server, in this case the DLLs themselves were not.

The reason WinDbg wants the original DLLs to be added to characters is because in order to keep the mini-bank small, most of the memory image is not taken into account. In this case, the computer on which minidump was created uses a different version of the .NET Framework than is installed on the computer on which WinDbg is running. Let's say that the computer with the error has .NET3.5 running Windows XP, and the analysis computer is .NET3.5 running on Windows 7. They may be the same version, but Windows 7 received its own special version of .NET3. 5 as can be seen here:

• . Net Framework Libraries

The solution is to put DLLs that cannot be downloaded from the symbol server anywhere on the symbol path. However, I don’t see an easy way to download and install only reference assemblies for the specific version of .NET you want. But since you meant that .loadby sos mscorwks worked for you, the DLLs you want may already be on your computer.

First you need to create a mini-drive of your program on a test computer that you can control what creates these symptoms in WinDbg. I suggest trying Windows XP. Then use Process Explorer to find the full path to PresentationFramework.DLL on the test computer. Then compare the file size and date with the DLL on your computer in places such as:

• C: \ Windows \ Microsoft.NET
• C: \ Program Files (x86) \ Reference Assemblies \ Microsoft \ Framework
• C: \ Program Files \ Reference Assemblies \ Microsoft \ Framework

If you can find the file, put the folder in which it was found on the path to the symbol. If you cannot find the file, you can resort to copying the missing files from the test computer. This is not as bad as it seems, because there are not many published versions of the .NET framework.

Answer 2

It can be a JIT code, in which case after loading sos you can use the command! IP2MD to get the function name (via IP):

 SP IP Function 0013E370 564618E3 PresentationFramework_ni!Unknown+0x1bf ... >!IP2MD 564618E3