debugging - How can I identify the version of a managed dll in windbg? -
i have minidump customer. want find out assembly versions of loaded .net dlls. i've searched internet hours now, cannot find usable way. have windbg , have loaded sos extension have needed clr.dll , mscordacwks.
using lm -v
shows unmanaged dll's. sure overlooking simple.
alright, after more research came conclusion that kind of information not available dll's in minidump. anyway @ least able more information files, , maybe useful else in future.
you can @ least metata information of dll's, , maybe can find useful in there. here's how that:
first domain:
!dumpdomain
you might end large amount of listed assemblies. can either them hand using:
!dumpassembly address
or can use lazy way: install python extension windbg (http://pykd.codeplex.com/) , use following script quick overlook (it's maybe not nicest script, it's working , didn't want invest more time):
import pykd def dump_assemblies(): assemblies = 0 addrs = pykd.dbgcommand("!dumpdomain").splitlines() x in addrs: if x[:8] == "assembly": assemblies = assemblies + 1 print "### retrieving assembly " + x[-8:] print pykd.dbgcommand("!dumpassembly " + x[-8:]) print "### found " + str(assemblies) + " assemblies." dump_assemblies()
you able text search (ctrl + f) dll. once found it, can find offset next module name (looks 12327c8 c:\program files\myapp\mydll.dll).
you can dump module using:
!dumpmodule 12327c8
which lead to:
name: c:\program files\myapp\mydll.dll attributes: pefile assembly: 131a22e2 loaderheap: 00000000 typedeftomethodtablemap: 19220010 typereftomethodtablemap: 134303e0 methoddeftodescmap: 13430740 fielddeftodescmap: 13433964 memberreftodescmap: 134350c8 filereferencesmap: 13435918 assemblyreferencesmap: 1343591c metadata start address: 1c1aaa4c (4248 bytes)
now can check metadata of dll with:
dc 1c1aaa4c 1c1aaa4c + 4248
that's closest more information dll. unfortunately file version not written there, other more generic info. anyway, try in touch customer again. answers anyway.
Comments
Post a Comment