У меня есть дамп памяти. NET 1.1. Я пытаюсь его проанализировать, и хотя я могу его загрузить. NET 1.1 SOS.dll в порядке, проблема в том, что в расширении SOS отсутствует множество команд. Невозможно использовать SOS.dll из более поздних версий. NET framework, поскольку я получаю это сообщение об ошибке:
Failed to load data access DLL, 0x80004005
Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
2) the file mscordacwks.dll that matches your version of mscorwks.dll is
in the version directory
3) or, if you are debugging a dump file, verify that the file
mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
4) you are debugging on the same architecture as the dump file.
For example, an IA64 dump file must be debugged on an IA64
machine.
You can also run the debugger command .cordll to control the debugger's
load of mscordacwks.dll. .cordll -ve -u -l will do a verbose reload.
If that succeeds, the SOS command should work on retry.
If you are debugging a minidump, you need to make sure that your executable
path is pointing to mscorwks.dll as well.
И, насколько я могу судить, в mscordacwks нет DLL. NET 1.1 (если только имеет другое имя)
Обычно я бы использовал эту команду для выгрузки всех строк:
.foreach (obj {!dumpheap -type System.String -short}) {.printf "\n%mu",${obj}+0xc}
Однако это не работает, так как dumpheap не имеет -short опция в. NET 1.1. Доступны только следующие команды:
0:000> !sos.help
SOS : Help
COMState | List COM state for each thread
ClrStack | Provides true managed stack trace, source and line numbers.
Additional parameters: -p[arams] -l[ocals] -r[egs] -a[ll].
DumpClass <addr> | Dump EEClass info
DumpDomain [<addr>] | List assemblies and modules in a domain
DumpHeap [-stat] [-min 100] [-max 2000] [-mt 0x3000000] [-type <partial type name>] [-fix] [start [end]] | Dump GC heap contents
DumpMD <addr> | Dump MethodDesc info
DumpMT [-MD] <addr> | Dump MethodTable info
DumpModule <addr> | Dump EE Module info
DumpObj <addr> | Dump an object on GC heap
DumpStack [-EE] [-smart] [top stack [bottom stack] | -EE only shows managed stack items.
DumpStackObjects [top stack [bottom stack]
DumpVC <mt> <addr> | Dump a value class object
EEHeap [-gc] [-win32] [-loader] | List GC/Loader heap info
EEStack [-short] [-EE] | List all stacks EE knows
EEVersion | List mscoree.dll version
FinalizeQueue [-detail] | Work queue for finalize thread
GCInfo [<MD>] [IP] | Dump GC encoding info for a managed method
GCRoot <addr> | Find roots on stack/handle for object
IP2MD <addr> | Find MethodDesc from IP
Name2EE <module name> <item name> | Find memory address of EE data given a class/method name
ObjSize [<addr>] | Find number of bytes that a root or all roots keep alive on GC heap.
ProcInfo [-env] [-time] [-mem] | Display the process info
RWLock [-all] <addr> | List info for a Read/Write lock
SyncBlk [-all|#] | List syncblock
ThreadPool | Display CLR threadpool state
Threads | List managed threads
Token2EE <module name> <mdToken> | Find memory address of EE data for metadata token
u [<MD>] [IP] | Unassembly a managed code
Вывод команды dumpheap выглядит следующим образом:
0:000> !dumpheap -type System.String
Address MT Size
07291164 031342d8 28
072911dc 031342d8 32
072911fc 031342d8 32
0729121c 031342d8 20
07291268 031342d8 40
07291290 031342d8 76
072912dc 031342d8 32
072912fc 031342d8 84
07291350 031342d8 80
072913a0 031342d8 148
etc..
total 2140 objects
Statistics:
MT Count TotalSize Class Name
31342d8 2140 147000 System.String
Total 2140 objects