Breaking on Module Load

  • Article

 

Let’s say we want to break the debugger when a specific dll is loaded, for example I want to enable some SOS commands and clr hasn’t been loaded yet, this is especially useful when you have an exception that happens too early in the program and you can’t rely on manually trying to break at the right time.

For example, right after attaching the debugger to a process I do this, I will get an error since clr hasn’t been loaded yet

 

0:000> .loadby sos clr

Unable to find module 'clr'

 

Using the sx e ld command, I can tell the debugger to break when clr is loaded

 

0:000> sxe ld clr

0:000> g

 

Right away I get this:

 

ModLoad: 6f580000 6fc03000 C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll

eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7efdd000 edi=003cf400

eip=77d7fc42 esp=003cf2d4 ebp=003cf328 iopl=0 nv up ei pl zr na pe nc

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246

ntdll!NtMapViewOfSection+0x12:

77d7fc42 83c404 add esp,4

 

Now the command will succeed!

0:000> .loadby sos clr