WinDBG CDB NTSD SOS Debugging Commands

Download the Debugging Tools First

Download and install Debugging Tools for Windows 32-bit Version. Run WinDbg.exe Or CDB.exe

Command for Help Within WinDBG or CDB

            >.hh [keyword]

Setup Debugging Symbols

Set up symbol path:

            >.sympath c:\windows\symbols;srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
            >.reload
            >!lines
            >!sym noisy
            >x ntdll!*event* search symbols
            >ln [address]

Load SOS to Debug Managed Code

            >sxe ld:mscorjit.dll
            >g
            >.loadby sos mscorwks

            >!name2ee test.exe Test.Main
            >!clrstack

Debugging Commands for Threads

Display threads

>~

switch to thread #n

            
            >~[n]s

stack trace, kb, kP, kn for detailed stack trace

stack trace for all threads

            
            >~*k

SOS Extensions

    
    !eeheap -gc

Take a look at the managed heap

    
    !DumpHeap -stat

Take a look at specific typle by giving it a metadata token, you can get a list of all the objects and their address.

    
    !DumpHeap -mt [MT like 0548cdb4]

GCRoot Command: !Help gcroot. You can determin why an instance was still rooted and therefore not collectable.

    
    !gcroot [address]

Dump object command: get internal of an object. It gives some specific information: 1. _target is the object the delegate is holding onto. 2._methodBase is used for dynamic code. 3._methodPtr is the method associated with the instance, or possibly a dynamically generate thunk for static methods. 4._methodPtrAux is used for static methods; this holds the method descriptor and the _methodPtr is dynamically generated block of code to remove this reference. 5._invocationList and _invocationCount are used for Multicast Delegates.

    
    !do [address]

Get method name: IP2MD. You can use _methodPtr from above.

    
    !ip2md On[address]

Disassembly code command:

    
    !u On[address]

Dump data command:

    
    !dd On[address]

Dump method descriptor in the managed heap:

    
    !dumpmd [address]

Dump metadata reference:

    
    !dumpmt [address]

Locate and save Module:

    
    !lm m [name]
    !savemodule [address] [filepathName]

Use AdPlus to Get Memory Dump

Get memory snapshot of process 2345, using hang mode. Sample:

            adplus -hang -p 2345 -quiet

Get a memory dump when the process crashes. Sample:

            adplus -crash -pn w3wp -quiet

Get a memory dump for the process running iis and hosted web applications. Sample:

            adplus -hang -iis -quiet

Using SOS in Visual Studio

First, you need to right mouse click on the project in solution explorer, choose properties, switch to the Debug tab, and make sure "Enable Unmanaged Code Debugging" is selected.

Second, Open the Immediate window (Debug->Windows->Immediate) and type ".load C:\windows\Microsoft.NET\Framework\v2.0.50727\sos.dll".

Third, Type "!help" for help. Some common commands are listed below:

  
        !CLRStack
        !ip2md [EIP Address]
        !DumpIL [MethodDesc Address]
        !help [Command]

Note:

System.GC.GetTotalMemory

Retrieves the number of bytes currently thought to be allocated. A parameter indicates whether this method can wait a short interval before returning, to allow the system to collect garbage and finalize objects.

Q: Unable to find Immediate window in VS 2005/VS 2008:

A: Go to Tool, Customize select debug immedaite and drag it onto the toolbar. The shortcut Ctrl+Alt+I should bring Immediate Window in debug mode.