HOWTO: Capture a dump on a specific managed exception

So often times, we get an exception of interest, either we see it in the Event Log or we see it in a dump and we want to get a dump at the time of the exception to see what was happening.  So how do we go about doing that?  Well, the answer is, there are a few ways you can do this.

DebugDiag Methods

Note: This method currently only works on 32-bit processes

The first way to get a dump on a specific exception is to use DebugDiag.  After installing this tool and running it, you will use the Crash rule.  After picking your process, on the Advanced Configuration (Optional) screen, click on the Exceptions button


After you click on this, you will select the CLR (.NET) Exception and then enter your exception type that you want to get the dump on


That is all there is to it.  You have now setup DebugDiag to capture a dump on the specific exception that you are interested in.  Good luck!

Adplus - Windbg Method

This method requires that you have installed the debuggers package.  And keep in mind there are packages for 32-bit and 64-bit versions of the debugger and you should install the one that matches the process you are trying to debug.

There is an excellent posting about capturing a dump using adplus here.  So I am going to extend on that to allow us to capture a dump on a particular exception.  So in that case, we want the config file we create for adplus to have some specific things in it.  But what we put in there kind of depends on what version of the .NET Framework we are using.

.NET Framework 1.x

So if we are using 1.0 or 1.1, we will want the config file to look like this:


<cmd>.load clr10\sos.dll</cmd>

<!-- This is for the CLR exception -->
<code> clr </code>
<actions1> Log </actions1>
<customactions1> !cce
System.IndexOutOfRangeException 1; j ($t1 = 1)
'.dump /ma /u c:\dumps\mydump.dmp' ; ''
<returnaction1> gn </returnaction1>
<actions2> Log;FullDump </actions2>

<option> NoDumpOnFirstChance </option>



.NET Framework 2.0

For 2.0, it should look like:


<cmd>.loadby sos mscorwks </cmd>
<cmd>sxe –c "!soe
System.Security.SecurityException 1;
.if(@$t1==1) { .dump /ma /u
c:\DebugOut\exception.dmp } .else {g}" clr

<option> NoDumpOnFirstChance </option>



Note: The customactions1 and cmd lines above should all be one line, they were changed so it would fit the screen.

Please keep in mind that we must use the same debugger package (32-bit or 64-bit) as the process we are trying to debug.

Good luck and happy debugging.

kick it on

Comments (4)

  1. You’ve been kicked (a good thing) – Trackback from

  2. gOODiDEA says:


  3. There are multiple ways to capture a dump.&#160; There are some examples discussed in my previous post,

  4. 飞天舞者 says:


Skip to main content