poizan42 / soswow64 Goto Github PK
View Code? Open in Web Editor NEWwindbg/dbgeng extension for debugging 64-bit dumps of 32-bit .NET processes.
License: Other
windbg/dbgeng extension for debugging 64-bit dumps of 32-bit .NET processes.
License: Other
** What's this? ** On a 64-bit Windows installation is it possible to make both 32-bit and 64-bit dumps of 32-bit processes. The task manager will create a 64-bit dump, which therefore is often what you end up with users sending you. This is not a problem for native executeables since you can still load it in windbg and use the !wow64exts.sw extension to switch into the 32-bit view. However if your process is a .NET process and you want to use SoS to investigate it then you are out of luck, you'll just get the message "SOS does not support the current target architecture." This extension gets around this by hooking/patching functions in dbgeng.dll so that SoS thinks it's working with a 32-bit dump. ** Usage ** Copy soswow64.dll into the "winxp" subfolder of windbg. Then after loading a 64-bit memory dump of a 32-bit process you can simply load the extension: 0:000> .load soswow64 Successfully hooked IDebugControl::GetExecutingProcessorType. Successfully patched DbgEng!X86MachineInfo::ConvertCanonContextToTarget. Example: 0:000> .loadby sos clr 0:000> !wow64exts.sw Switched to 32bit mode 0:000:x86> !threads SOS does not support the current target architecture. 0:000:x86> .load soswow64 Successfully hooked IDebugControl::GetExecutingProcessorType. Successfully patched DbgEng!X86MachineInfo::ConvertCanonContextToTarget. 0:000:x86> !threads ThreadCount: 16 UnstartedThread: 0 BackgroundThread: 4 PendingThread: 0 DeadThread: 11 Hosted Runtime: no Lock ID OSID ThreadOBJ State GC Mode GC Alloc Context Domain Count Apt Exception 0 1 318c 00fe9d58 202a020 Preemptive 029CD30C:00000000 00fdd4d0 0 MTA 2 2 5858 00ff78c8 2b220 Preemptive 00000000:00000000 00fdd4d0 0 MTA (Finalizer) XXXX 3 0 00fd63b8 8039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Completion Port) 3 5 1ddc 01045c68 8029220 Preemptive 00000000:00000000 00fdd4d0 0 MTA (Threadpool Completion Port) XXXX 6 0 01046c18 8039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Completion Port) XXXX 7 0 010857c8 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 8 0 01089a20 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 9 0 0108b300 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 10 0 0108ceb8 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 12 0 0109d418 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 13 0 0109dc38 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 14 0 010b2b10 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 15 0 01084b98 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) XXXX 16 0 010be6b0 1039820 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) 4 18 5b88 01032318 1020220 Preemptive 00000000:00000000 00fdd4d0 0 Ukn (Threadpool Worker) 5 20 192c 0102ee48 202b220 Preemptive 029CE75C:00000000 00fdd4d0 0 MTA ** Compatibility ** Any version of sos that either has the name "sos.dll" or the OriginalFilename "sos.dll" in its version info resource should work since we are hooking the IDebugControl interface. The patching of dbgeng!X86MachineInfo::ConvertCanonContextToTarget has been tested with the following versions of dbgeng.dll: 6.6.7.5 (Debugging tools for Vista, WinDbg 6.6.0007.5) 6.12.2.633 (Debugging tools for Windows 7, WinDbg 6.12.0002.633) 6.2.9200.20512 (Debugging tools for Windows 8.0, WinDbg 6.2.9200.16384) 6.3.9600.16384 (Debugging tools for Windows 8.1, WinDbg 6.3.9600.16384) 10.0.10586.0 (Debugging tools for Windows 10, WinDbg 10.0.10586.567) 10.0.14281.933 (Debugging tools for Windows 10 (insider preview), WinDbg 10.0.14281.933) The extension will not work on Windows versions older than Windows Vista. ** How? ** I have described the details on my blog: https://poizan.dk/blog/2015/10/15/using-sos-to-debug-32-bit-code-in-a-64-bit-dump-with-windbg/ Note that we are hooking IDebugControl::GetExecutingProcessorType to return the effective processor type instead if we are called from sos.dll. That way it should work with every sos versions without having to look for specific signatures. The patching of DbgEng!X86MachineInfo::ConvertCanonContextToTarget is done by looking for signatures, so it probably works with other revisions than the five listed above. ** Bugs & improvements? ** Just file an issue at https://github.com/poizan42/soswow64/issues. If you have a version of dbgeng.dll that it does not work with then it would be helpful if you sent me the dll as it may be hard to figure out how to get a specific version otherwise.
It complains that: MANAGED_BITNESS_MISMATCH: Managed code needs matching platform for proper analysis. Use 'x64' debugger.
And does not show any "managed" information about the exception
Hi, had tried your library and it works fine in WinDbg x86. :)
Just one question - If I build x64 binary, it will work in WinDBG x64?
So my suggestion is to maybe just put download of compiled soswow64 library for download as I'm not sure how many .NET developers know how to compile with C++.
Best Regards,
Compiled under VS 2013, but could not load into Windbg(x86)
.load soswow64
The call to LoadLibrary(soswow64.dll) failed, Win32 error 0n126
"The specified module could not be found."
ProcessMonitor showed that it tried to load 'api-ms-win-core-libraryloader-l1-2-0.dll' that doesn't exist on Win 7.
Changing linker input project properties from mincore.lib (required for VerQueryValue) to version.lib fixed the issue
.load soswow64
Successfully hooked IDebugControl::GetExecutingProcessorType.
Failed patching DbgEng!X86MachineInfo::ConvertCanonContextToTarget, stack related commands may not work correctly.
WinDbg 10.0.19041.685
dbgeng.zip
Many sos commands worked, but !clrstack
command does not work.
Compiled x86 ver under .NET Framework 3.5 with VS2008.
User Mini Dump File with Full Memory: Only application data is available
Executable search path is:
Windows 7 Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Fri May 31 10:20:32.000 2019 (GMT+9)
System Uptime: 15 days 6:17:10.492
Process Uptime: 0 days 0:03:13.000
................................................................
wow64cpu!TurboDispatchJumpAddressEnd+0x544:
00000000`77371e4c c3 ret
0:000> lmvm mscorwks
start end module name
00000000`6d010000 00000000`6d5c0000 mscorwks (deferred)
Image path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
Image name: mscorwks.dll
Timestamp: Thu Mar 28 13:23:02 2019 (5C9C4C26)
CheckSum: 005AF486
ImageSize: 005B0000
File version: 2.0.50727.8941
Product version: 2.0.50727.8941
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: mscorwks.dll
OriginalFilename: mscorwks.dll
ProductVersion: 2.0.50727.8941
FileVersion: 2.0.50727.8941 (WinRelRS4.050727-8900)
FileDescription: Microsoft .NET Runtime Common Language Runtime - WorkStation
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail
0:000> .exepath D:\analysis\x86\2.0.50727.8941
Executable image search path is: D:\analysis\x86\2.0.50727.8941
Expanded Executable image search path is: d:\analysis\x86\2.0.50727.8941
0:000> .cordll -ve -u -l
CLR DLL status: No load attempts
0:000> !wow64exts.sw
Switched to 32bit mode
0:000:x86> .loadby sos mscorwks
0:000:x86> .load D:\analysis\tools\soswow64\soswow64.dll
Successfully hooked IDebugControl::GetExecutingProcessorType.
Successfully patched DbgEng!X86MachineInfo::ConvertCanonContextToTarget.
0:000:x86> !threads
ThreadCount: 2
UnstartedThread: 0
BackgroundThread: 1
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
PreEmptive GC Alloc Lock
ID OSID ThreadOBJ State GC Context Domain Count APT Exception
0 1 3378 0000000000e30308 6020 Enabled 000000000305e2bc:000000000305e798 0000000000e2b258 0 STA
5 2 31bc 0000000000e3d6e0 b220 Enabled 0000000000000000:0000000000000000 0000000000e2b258 0 MTA (Finalizer)
0:000:x86> !dso
OS Thread Id: 0x3378 (0)
ESP/REG Object Name
ebx 0000000003013ef8 System.Windows.Forms.Application+ThreadContext
esi 000000000305c3f4 System.Windows.Forms.Application+ComponentManager+ComponentHashtableEntry
edi 000000000305e298 System.Collections.Hashtable+HashtableEnumerator
0000000000b5f0b4 000000000305d1b0 System.Windows.Forms.NativeMethods+MSG[]
0000000000b5f0b8 0000000003013ef8 System.Windows.Forms.Application+ThreadContext
0000000000b5f0c0 000000000305c3ac System.Windows.Forms.Application+ComponentManager
0000000000b5f108 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f110 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f138 0000000003013ef8 System.Windows.Forms.Application+ThreadContext
0000000000b5f160 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f164 0000000003013ef8 System.Windows.Forms.Application+ThreadContext
0000000000b5f174 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f190 00000000030134c4 WindowsFormsApplication6.Form1
0000000000b5f194 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f198 0000000003013ef8 System.Windows.Forms.Application+ThreadContext
0000000000b5f1a4 000000000305726c System.Windows.Forms.ApplicationContext
0000000000b5f1bc 00000000030134c4 WindowsFormsApplication6.Form1
0:000:x86> !clrstack
OS Thread Id: 0x3378 (0)
Failed to start stack walk: 80070057
0:000:x86> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00b5f114 6b1f9c77 00000000 ffffffff 00000000 win32u!NtUserWaitMessage+0xc
00b5f16c 6b1f9ac1 0305726c 1e650002 00000000 System_Windows_Forms_ni+0x209c77
00b5f19c 6b1b6911 0305726c 00b5f1ec 00e30308 System_Windows_Forms_ni+0x209ac1
00b5f1c0 6d011b6c 007b2d4c 00000001 00b5f250 System_Windows_Forms_ni+0x1c6911
00b5f1d0 6d02854b 00b5f2a0 00000000 00b5f270 mscorwks+0x1b6c
00b5f250 6d0305eb 00b5f2a0 00000000 00b5f270 mscorwks+0x1854b
00b5f394 6d03061e 00dac020 00b5f460 00b5f42c mscorwks+0x205eb
00b5f3b0 6d03063c 00dac020 00b5f460 00b5f42c mscorwks+0x2061e
00b5f3c8 6d0f084d 00b5f42c 20818181 00000000 mscorwks+0x2063c
00b5f52c 6d0f076d 00da302c 00000001 00b5f568 mscorwks!GetPrivateContextsPerfCounters+0x345c2
00b5f794 6d0f0c8a 00000000 208188c9 00000001 mscorwks!GetPrivateContextsPerfCounters+0x344e2
00b5fc64 6d0f0e74 007b0000 00000000 20818819 mscorwks!GetPrivateContextsPerfCounters+0x349ff
00b5fcb4 6d0f0da4 007b0000 20818851 00000000 mscorwks!CorExeMain+0x168
00b5fcfc 7070d93b 74f50efa 71344e10 7070d8c0 mscorwks!CorExeMain+0x98
00b5fd3c 7133e8b9 71344e10 70700000 41d0f1e0 mscoreei!CorExeMain+0x7b
00b5fd50 71344e18 71344e10 74758494 00956000 mscoree!DllUnregisterServer+0x169
00b5fd6c 774641c8 00956000 96fc377c 00000000 mscoree!CorExeMain+0x8
00b5fdb4 77464198 ffffffff 7747f325 00000000 ntdll_77400000!RtlAreBitsSet+0x88
00b5fdc4 00000000 71344e10 00956000 00000000 ntdll_77400000!RtlAreBitsSet+0x58
Could you help me solve my problem?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.