在日常分析dmp文件工作中,我发现用".loadby sos clrjit"指令来加载sos扩展库在有的dmp文件成功有的不成功,都是报如下错误:
0:036> .loadby sos clrjit
The call to LoadLibrary(sos.dll) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
今日有得闲,于是就仔细分析下这个问题。
首先,我们知道".loadby sos clrjit"是根据clrjit的路径去加载sos,出现这个问题自然而然有两个可能性:
- 一是dmp文件里没有包含clrjit模块信息
- 二是clrjit路径问题
我们先看看是不是第一种情况,执行lm列出dmp文件包含的模块信息
没有问题的dmp如下:
0:000> lm
start end module name
01250000 0126f000 clrcompression (deferred)
...
692b0000 6933a000 clrjit (deferred)
....
有问题的dmp如下:
0:036> lm
start end module name
00230000 0023e000 mxml1 (deferred)
0:036> lm
start end module name
00230000 0023e000 mxml1 (deferred)
....
50100000 5017d000 clrjit (deferred)
......
可以看到都有clrjit模块信息。也就证明不是第一种情况,那就是第二种情况了,为了求证,要查看模块的详细信息了
没有问题的dmp如下:
0:000> lmDvmclrjit
Browse full module list
start end module name
692b0000 6933a000 clrjit (deferred)
Image path: C:WindowsMicrosoft.NETFrameworkv4.0.30319clrjit.dll
Image name: clrjit.dll
Browse all global symbols functions data
Timestamp: Tue Jul 7 06:46:31 2020 (5F03A9C7)
CheckSum: 00095382
ImageSize: 0008A000
File version: 4.8.4220.0
Product version: 4.0.30319.0
File flags: 8 (Mask 3F) Private
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: clrjit.dll
OriginalFilename: clrjit.dll
ProductVersion: 4.8.4220.0
FileVersion: 4.8.4220.0 built by: NET48REL1LAST_C
PrivateBuild: DDBLD507
FileDescription: Microsoft .NET Runtime Just-In-Time Compiler
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail
有问题的dmp如下:
0:036> lmDvmclrjit
Browse full module list
start end module name
50100000 5017d000 clrjit (deferred)
Image path: clrjit.dll
Image name: clrjit.dll
Browse all global symbols functions data
Timestamp: Sat Apr 12 09:19:13 2014 (53489491)
CheckSum: 0007D3A1
ImageSize: 0007D000
File version: 4.0.30319.34209
Product version: 4.0.30319.34209
File flags: 8 (Mask 3F) Private
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: clrjit.dll
OriginalFilename: clrjit.dll
ProductVersion: 4.0.30319.34209
FileVersion: 4.0.30319.34209 built by: FX452RTMGDR
PrivateBuild: DDBLD354
FileDescription: Microsoft .NET Runtime Just-In-Time Compiler
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail
我相信大家都看出问题之所在了吧。对,能执行成功的模块是全路径,而另外一个只有文件名,那么当然会报"系统找不到指定的文件。"的错误了。看来两种dmp文件抓取的类型标志肯定不一样。
有问题dmp文件标志如下
果然去掉了模块路径信息。下面是这个标志的说明:
MiniDumpFilterModulePaths
过滤内存信息中的模块路径,只保留模块名称。此选项可以保护用户的隐私比如用户名、重要的目录等,但可能阻止系统定位Image文件,应当谨慎应用在特殊环境。
该选项要求DbgHelp 5.1以上版本。