How to set a breakpoint when loading .NET 2 or .NET 4?

Question

Sometimes I debug .NET applications, but I don’t know if they will use .NET 2 or .NET 4. I want to hack when .NET loads, so I do

sxe -c ".echo .NET4 loaded" ld clr sxe -c ".echo .NET2 loaded" ld mscorwks 

Unfortunately, there can only be one such breakpoint, and in the above example, mscorwks overwrites clr , and in the case of .NET4, it does not hit the breakpoint.

Is there a way to break up several different loading events?

I really don't want to bother with my non-working obscure attempt

 sxe -c".foreach /ps 5 /pS 99 (token {.lastevent}) {.if ($spat(\"[0-9a-z.:\\]*\\clr.dll\",\"${token}\")) {.echo clr;} .elsif ($spat(\".*\mscorwks.dll\",\"${token}\")) {.echo mscorwks} .else {}}" ld 

Answer 1

Using pykd , I came up with the following solution:

First write a Python script (loadModule.py in my example) with the following contents:

 from pykd import * import sys event = lastEvent() if event != eventType.LoadModule: sys.exit() # get module load event details in string format details = dbgCommand(".lastevent") # remove the debugger time details = details.split("\n")[0] # get everything behind "Load module" details = details.split("Load module ")[1] # remove address details = details.split(" at ")[0] # remove full path details = details.split("\\")[-1] # remove extension details = ".".join(details.split(".")[0:-1]) # compare case-insensitive details = details.upper() if details in [x.upper() for x in sys.argv[1:]]: breakin() 

Then set a breakpoint in the load event as follows:

 sxe -c "!py loadModule.py clr mscorwks coreclr;g" ld 

This will cause the Python script to execute on every module load event. the script breaks into a debugger (breakin () in the Python script) if the module is found, otherwise it continues (g in WinDbg).

You can use any number of modules. The comparison is case insensitive.

Please note that this may not be the most elegant solution. There seems to be another way: subclassing eventHandler :: onModuleLoad.

Answer 2

You can set two breakpoints

bu mscorwks! EEStartup

bu clr! EEStartup

(for example, bu clr! EEStartup ".echo Inclusion in the debugger on the clr-loaded") and only one of them will work