Video of my TechEd presentation of Common Issues in ASP.NET and how to debug them with Windbg

My TechEd presentation “Common Issues in ASP.NET and how to debug them with Windbg” is now up on channel 9, so if you want to watch it, here you go

Have fun,

Comments (9)

  1. Alex says:

    The wmv link on that page doesn’t work at all.

    Is there any opportunity that you can give some information on how to debug sharepoint related issues?

  2. Dominick says:

    Hey Tess!

    gratz! You did great.

    Take care


  3. gOODiDEA.NET says:

    .NET Visual Studio Keyboard Shortcut Tip: Ctrl+- / Ctrl+Shift+- Did you know… There’s a way

  4. gOODiDEA says:

    .NETVisualStudioKeyboardShortcutTip:Ctrl -/Ctrl Shift -Didyouknow

  5. snarum says:

    If there ever would be a version with slightly higher quality I’d be very interested knowing about it.

  6. Eldblom says:

    Here’s a late thank you for your presentations at TechEd. I found them really inspiring and we’ve already applied the techniques you described in some of our projects.

  7. GP says:


    Sorry that I post my question here (a "little" bit off-topic), but I have no other option to contact you. If you have a minute or two minute left I would really appreciate your feedback on my problem described below. You can also reply me by mail if you like (guenter.prossliner_nospam<AT>, remove "_nospam").

    I have the problem, that !clrstack -a doesn’t show up arguments, instead it looks like:


           this = <no data>

    My assumption is that this arguments are passed in registers. But even if i look at the output of !u i cannot find them.

    This is what I’ve done:

    1. I have loaded a crash dump into windbg

    2. !pe

    0:033> !pe

    Exception object: 0113d50c

    Exception type: System.ArgumentException

    Message: The UNC path should be of the form \servershare.

    InnerException: <none>

    StackTrace (generated):

       SP       IP       Function

       060CF2F8 7962C227 mscorlib_ni!System.IO.Path.NormalizePathFast(System.String, Boolean)+0x2c7d6f

       060CF81C 793644AE mscorlib_ni!System.IO.Path.GetFullPathInternal(System.String)+0x2e

       060CF824 793A23C6 mscorlib_ni!System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption)+0xb6

       060CF8E4 7948F41A mscorlib_ni!System.IO.Directory.GetFiles(System.String, System.String, System.IO.SearchOption)+0x26

       060CF8F8 7948F3D8 mscorlib_ni!System.IO.Directory.GetFiles(System.String)+0xc

       060CF8FC 00BA3AF7 WorldDirect_Europay_TK_ExternalInterfaces_Communication!WorldDirect.Europay.TK.ExternalInterfaces.Communication.DirectoryWatcherMessageSink.HandleExistingFiles(System.String)+0x16f

       060CF93C 00BA3957

    It’s obviously an invalid string passed into Directory.GetFiles(), but WHAT string?

    3. !clrstack -a

    0:033> !clrstack -a

    OS Thread Id: 0xfe4 (33)

    ESP       EIP    

    060cf834 7c8285ec [HelperMethodFrame: 060cf834]

    060cf884 00ba3af7 WorldDirect.Europay.TK.ExternalInterfaces.Communication.DirectoryWatcherMessageSink.HandleExistingFiles(System.String)


           this = <no data>

           filter = <no data>


    I have to get the "filter" argument.

    4. Now I’ve tried to figure it out by using !u on the "HandleExistingFiles" method:

    0:033> !ip2md 00BA3AF7

    MethodDesc: 036574d0

    0:033> !u 036574d0

    00ba3988 55              push    ebp

    00ba3989 8bec            mov     ebp,esp

    00ba39cb 8b45c8          mov     eax,dword ptr [ebp-38h]

    00ba39ce 8b4810          mov     ecx,dword ptr [eax+10h]

    00ba39d1 e8f6b98e78      call    mscorlib_ni+0x3cf3cc (7948f3cc) (System.IO.Directory.GetFiles(System.String), mdToken:

    5. Now I’ve tried to figure out the contents of the eax and ecx registers at the time this method had been called. The windbg "r" command doesn’t help, because the cpu is somewhere in the exception handler.

    6. I’ve calculated the register values based on the ESP of the !clrstack -a output:


    > 00ba3988 55              push    ebp


    > 00ba39cb 8b45c8          mov     eax,dword ptr [ebp-38h]

    EAX=[060cf884-38h] = [060CF84C] = 0021bc28

    > 00ba39ce 8b4810          mov     ecx,dword ptr [eax+10h]

    ECX=[0021bc28+10h]=[0021bc38] = 00000000

    7. Now I thought that I can execute a !do 0021bc28, but it gives me the (famous) "Invalid CLASS field", which isn’t really a great supprise since [21bc38] = null-poiter.

    You you tell me why this doesn’t work? What have I done wrong?  It the ESP Value printed by !clrstack the register before the method has been called? What confused me too is the fact, that the !pe command print out a different (E)SP for the same StackFrame (060CF8FC)!

    I can give you more information if necessary.

    Thank you very much!

  8. Tess says:

    Hi GP.

    !clrstack -a will only produce data if it can get to it, which means that if the registers have been overwritten etc. it can not.

    You can always run !dso though to look at the objects on the stack, and specifically look at the ones laying on ESPs between your call and the next or previous

  9. A WinDbg Debugging Journey – NHibernate Memory Leak

Skip to main content