Setting .NET breakpoints in Windbg for applications that crash on startup

I recently received a question from a reader who wanted to know how to set breakpoints in code for applications that crash on startup.

The email went like this:

I have a .NET app which is crashing upon startup (it even causes DW20.exe to make an appearance). When I open the .NET app in Windbg, I can see exactly what the exception is and where it happens.

What I would like to do is put a breakpoint on the method where the exception is being raised so that I can step through it. This is where I’m stuck.

I’m familiar with commands such as !name2ee and !bpmd., however, when I load the .NET app, I don’t get a chance to set the breakpoint since the exception happens so early in startup code of the app. It’s like as soon as Windbg finishes loading modules, the exception strikes. It would be different if this was code running after a button click, but since this runs at startup, I’m having difficulties.

I’ve tried Ctrl-Break during the module loading and tried to set the breakpoint, but this doesn’t work - it’s too early to try to set a breakpoint at that moment.

How do you load a .NET app in Windbg and halt it so that you can set a breakpoint to a method that will be called later?

The answer is:

1. Open up the application with windbg through File/Open Executable. This will start the application under the windbg debugger (just as if you would do a debug in Visual Studio)

2. In windbg run

    sxe ld:mscorlib
    g
   

   This will break in when mscorlib.dll is loaded, and at that point you can start setting breakpoints in code

3. Load up sos by running .loadby sos mscorwks which which will load sos from the directory where mscorwks.dll is loaded, i.e. the framework directory.
4. Set your breakpoint with !bpmd, for example !bpmd BadApp.exe BadApp.BadClass.CrashApp will set a breakpoint on the method CrashApp in the class BadApp.BadClass defined in the BadApp.exe module. If your class was defined in a dll you would use the dllname.dll instead of the application name.

So all in all it looks something like this:

Microsoft (R) Windows Debugger  Version 6.8.0000.0
Copyright (c) Microsoft Corporation. All rights reserved.

ModLoad: 00400000 00408000   BadApp.exe
ModLoad: 7d4c0000 7d5f0000   NOT_AN_IMAGE
ModLoad: 7d600000 7d6f0000   C:\WINDOWS\SysWOW64\ntdll32.dll
ModLoad: 79000000 79046000   C:\WINDOWS\SysWOW64\mscoree.dll
ModLoad: 7d4c0000 7d5f0000   C:\WINDOWS\syswow64\KERNEL32.dll
(1bc4.11a4): Break instruction exception - code 80000003 (first chance)
eax=7d600000 ebx=7efde000 ecx=00000005 edx=00000020 esi=7d6a01f4 edi=00221f38
eip=7d61002d esp=0012fb4c ebp=0012fcac iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll32!DbgBreakPoint:
7d61002d cc              int     3

0:000> sxe ld:mscorlib
0:000> g

ModLoad: 790c0000 79bf6000   C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\32e6f703c114f3a971cbe706586e3655\mscorlib.ni.dll
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7efdd000 edi=20000000
eip=7d61cb85 esp=0012e9a0 ebp=0012e9e0 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll32!ZwMapViewOfSection+0x12:
7d61cb85 c22800          ret     28h

0:000> .loadby sos mscorwks

0:000> !bpmd BadApp.exe BadApp.BadClass.CrashApp
Adding pending breakpoints...

0:000> g
CLR notification: module 'mscorlib' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'BadApp' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'System' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'System.Drawing' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'System.Windows.Forms' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'System.Configuration' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'System.Xml' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'sorttbls.nlp' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: module 'sortkey.nlp' loaded
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
CLR notification: method 'BadApp.BadClass.CrashApp()' code generated
(1bc4.11a4): CLR notification exception - code e0444143 (first chance)
JITTED BadApp!BadApp.BadClass.CrashApp()
Setting breakpoint: bp 02400270 [BadApp.BadClass.CrashApp()]
Breakpoint 0 hit
eax=01d76970 ebx=02703558 ecx=02725518 edx=00262498 esi=02725518 edi=02725518
eip=02400270 esp=0012ef2c ebp=0012ef78 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
BadApp!BadApp.BadClass.CrashApp():
02400270 83ec08          sub     esp,8

I would say though that this particular scenario would be much easier to go through in Visual Studio, dbgclr or mdbg so if you have the option of using any of those I would recommend them over using windbg in this case.

Happy National day tomorrow to all the Swedes, it’s promising to be a nice sunny day off :)