!wmodule command fails with "Init was performed but it could not start CLR. Error: 8027025b"

[rodneyviana]

!wmodule command fails with "Init was performed but it could not start CLR. Error: 8027025b"

[rodneyviana]

Hi Mike,

Thanks for the detailed account of the incident. It seems that .NET DAC (mscorwks) cannot be instantiated. Run this and let me know if using this command: ".cordll -u -ve -l" you are able to load mscorwks???????.dll. Also, is it a WOW6432 dump by any chance? Is it a full user mode dump?

.cordll -u -ve -l

Thanks,

Rodney

[MikeVolodarsky]

Hey Rodney,

Former MSFTy here, familiar with the expected/actual/repro steps :)

Thank you for the awesomely fast response!

Here is the result:

0:043> .cordll -u -ve -l
CLRDLL: Loaded DLL C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll
Automatically loaded SOS Extension
CLR DLL status: Loaded DLL C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll

After this, running !wmodule:

0:043> !wmodule -managed -noms -saveto d:\temp\dlls
e0434352 Exception in C:\Users\mvolo\Downloads\NetExt-2.1.58.5000\NetExt-2.1.58.5000\x64\NetExt.dll.wmodule debugger extension.
PC: 00007fff4d993b29 VA: 0000000000000000 R/W: 80004003 Parameter: 00000000`00000000

--

This is in a live debug session on a 64bit Win10, 64bit w3wp.exe. Confirmed all system dlls loading from c:\windows\system32\inetsrv not syswow64.

Let me know your thoughts.

[rodneyviana]

Hi Mike,

I was able to reproduce. It only fails on live targets. I will troubleshoot and will let you know the results. Meanwhile, if you save a dump of the process you will be able to extract your modules. Try this workaround until I get it sorted out.

[MikeVolodarsky]

Rodney, thanks much for this workaround.

I tried on a minidump, and confirm it worked!

We are able to move forward via the dump route, so this unblocks us. Appreciate your help. Should I keep this issue open to track a fix for live module export? If not in the cards I can close it.

[rodneyviana]

Let's keep it open. The problem is that I am not treating live target memory mapping correctly.

[MikeVolodarsky]

Ok, thank you. We'll be using this extension more going forward and if there are any other issues, will bring them up. Thanks for putting this together! Best, Mike

…

--- original message --- On November 10, 2020, 5:33 PM EST [email protected] wrote: Let's keep it open. The problem is that I am not treating live target memory mapping correctly. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe. --- end of original message ---

[rodneyviana]

Hi Mike,

The new version should be ok. Would be so kind as to test it? Keep me informed of what you are doing with the extension and let me know if you need help.

[MikeVolodarsky]

Hey Rodney,

Great work! Confirm the latest version NetExt-2.1.59.5000 works in these cases:

1. Live 64 bit w3wp
2. .dump /ma of same process

Just in case I did a quick windiff of DLLs exported yesterday with the other version, the new version live, and new version dump, and they all match.

Thanks again for the quick fix. Looking forward to using the extension further.

Best,
Mike

[rodneyviana]

Thanks for the feedback. I am closing this issue and considering it resolved.