In this talk, we look at WinDbg, a powerful debugger that can help resolve difficult errors in production environments. We use WinDbg to pinpoint stack traces given dump files generated in production, to find memory leak causes and inspect heap memory, and even to automatically walk objects and threads to find deadlocks.

1. Sasha Goldshtein
CTO
Sela Group
@goldshtn
blog.sashag.net
Advanced Debugging
with WinDbg and SOS

2. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
AN HOUR FROM NOW,
YOU’LL KNOW HOW TO:
 Capture crash and hang dumps
 Pinpoint basic crash causes from dumps
 Inspect heap objects and graphs to find
memory leaks
 Identify deadlocked threads

3. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
DUMPS 101

4. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
A DUMP IS A SNAPSHOT OF A
RUNNING PROCESS. YOU CAN SAVE
IT, MOVE IT AROUND, AND ANALYZE
IT LATER. YOU CAN’T “DEBUG” IT.

5. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
TWO TYPES OF DUMPS:
Crash Dump
 The program crashed
Hang Dump
 The program didn’t crash
 Yet

6. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
SYSINTERNALS PROCDUMP: TAKE
DUMPS EASILY, ANYWHERE, AND
WITH NO PUN INTENDED.
Procdump -ma -e MyApp.exe
Procdump -h -x C:tempmyapp.exe
Procdump -c 90 -n 3 -s 5 MyApp.exe
Procdump -e 1 1234

7. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
CRASH ROOT CAUSE
FROM A DUMP

8. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
DRAG AND DROP A DUMP FILE INTO
VISUAL STUDIO. CLICK THE GREEN
BUTTON. VOILA, IT WORKS.*
* NITPICKER’S CORNER: YOU NEED SYMBOLS
AND SOURCES TO BE LINED UP PROPERLY.

9. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
“
”
YOU WILL INSTALL VISUAL STUDIO ON
MY BOXEN OVER MY DEAD BODY.
GOOD DAY.
I SAID “GOOD DAY”.
Joe the IT Admin

10. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
ENTER:
WinDbg
 Lightweight GUI debugger
 Super-scriptable
 Super-extensible
 Knows nothing about .NET 
SOS
 WinDbg extension for .NET
 Ships with .NET Framework
 Or on the symbol server*
 Knows all about .NET 
* As of CLR 4.0, for GDR versions
10

11. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
TAKE 2:
 Drag and drop a dump file into WinDbg.
Hmm. Now what?
!analyze -v !PrintException
!CLRStack .load sosex
!mk !mdt
.for (r $t0=@ebp; poi(@$t0)!=0; r
$t0=poi(@$t0)) { !mln poi(@$t0+4) }

12. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
MEMORY LEAKS: THE EASY WAY
 Not in this talk. Shell out $500 for a
decent memory profiler.

13. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
MEMORY LEAKS: THE
HARD WAY

14. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
WHAT WE NEED:
1. A list of all heap objects
2. A diff of heap objects between dumps
3. Why these heap objects won’t go
away
!dumpheap -stat !objsize
!gcroot !refs

15. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
DEADLOCKS

16. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
WHAT WE NEED:
1. What is thread X waiting for
2. (Suppose it’s sync object Y)
3. Which thread owns sync object Y
!syncblk !mwaits
!mlocks !dlk

17. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
ADDITIONAL REFERENCES

18. www.devconnections.com
ADVANCED DEBUGGING WITH WINDBG AND SOS
THANK YOU!
Sasha Goldshtein @goldshtn
sashag@sela.co.il blog.sashag.net
18