Getting where the exception is thrown in Windows Error Report for managed application without a dump

  • Article

A while ago, an internal thread shows how to get where the exception is thrown in Windows Error Report for managed application without a dump. The thread is very insightful. Shared below:

Subject: RE: How to investigate Windows Error Report from managed app?

FYI

I actually found that there is way to find what method caused this error and where without the dump. See below:

Problem signature

Problem Event Name: CLR20r3

Problem Signature 01: consoleapplication35.exe

Problem Signature 02: 1.0.0.0

Problem Signature 03: 48ed4a20

Problem Signature 04: ConsoleApplication35

Problem Signature 05: 1.0.0.0

Problem Signature 06: 48ed4a20

Problem Signature 07: 1

Problem Signature 08: 2e

Problem Signature 09: System.InvalidOperationException

OS Version: 6.0.6001.2.1.0.272.7

Locale ID: 1033

The Problem Signature 07 is MethodDef token. And SOS provides !Token2EE command to find the token. The trick here is that it trimmed “06” from the top, so its original value should be 0600000 + the value you see from Problem Signature 07 which is 06000001 in this example.

Now use !Token2EE to figure out the method:

0:003> !Token2EE ConsoleApplication35 06000001

Module: 00112c5c (ConsoleApplication35.exe)

Token: 0x06000001

MethodDesc: 00112ff0

Name: ConsoleApplication35.Program.Main(System.String[])

JITTED Code Address: 001b0070

Now you use !dumpil to list all IL for the method and check the IL offset to find which line actually failed.

0:003> !dumpil 00112ff0

ilAddr = 00ee2050

IL_0000: nop

IL_0001: ldstr "notepad.exe"

IL_0006: ldnull

IL_0007: call System.Diagnostics.Process::Start

IL_000c: stloc.0

.try

{

  IL_000d: nop

  IL_000e: ldloc.0

  IL_000f: callvirt System.Diagnostics.Process::WaitForExit

  IL_0014: nop

  IL_0015: nop

  IL_0016: leave.s IL_0028

} // end .try

.finally

{

  IL_0018: ldloc.0

  IL_0019: ldnull

  IL_001a: ceq

  IL_001c: stloc.1

  IL_001d: ldloc.1

  IL_001e: brtrue.s IL_0027

  IL_0020: ldloc.0

  IL_0021: callvirt System.IDisposable::Dispose

  IL_0026: nop

  IL_0027: endfinally

} // end .finally

IL_0028: nop

IL_0029: newobj System.InvalidOperationException::.ctor

IL_002e: throw

That’s it.