Comments on: Crash Dump Analysis Patterns (Part 95) https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Mon, 18 May 2026 05:04:01 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-767726 Dmitry Vostokov Tue, 25 Apr 2023 07:26:45 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-767726 This pattern was renamed to Runtime Thread (CLR) to allow variants of other execution environments This pattern was renamed to Runtime Thread (CLR) to allow variants of other execution environments

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-767725 Dmitry Vostokov Mon, 24 Apr 2023 19:30:57 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-767725 In .NET Core it is coreclr module. In .NET Core it is coreclr module.

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-295490 Dmitry Vostokov Sun, 12 Jun 2011 12:04:42 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-295490 Thanks! I've found that in CLR 4.0 the module has changed to just clr: <p align="left"><font size="1"><code><pre>0:000> lmv m clr start end module name 000007fe`eadc0000 000007fe`eb725000 clr (pdb symbols) Loaded symbol image file: clr.dll Image path: C:\Windows\Microsoft.NET\Framework64\ v4.0.30319\clr.dll Image name: clr.dll Timestamp: Thu Mar 18 12:39:07 2010 (4BA21EEB) CheckSum: 00959DBD ImageSize: 00965000 File version: 4.0.30319.1 Product version: 4.0.30319.1 File flags: 8 (Mask 3F) Private File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® .NET Framework InternalName: clr.dll OriginalFilename: clr.dll ProductVersion: 4.0.30319.1 FileVersion: 4.0.30319.1 (RTMRel.030319-0100) PrivateBuild: DDBLD431 FileDescription: Microsoft .NET Runtime Common Language Runtime - WorkStation LegalCopyright: © Microsoft Corporation. All rights reserved. Comments: Flavor=Retail</pre></code></font></p> <p align="left"><font size="1"><code><pre>0:000> ~16kc Call Site ntdll!NtWaitForSingleObject KERNELBASE!WaitForSingleObjectEx clr!CLREvent::WaitEx clr!CLREvent::WaitEx clr!CLREvent::WaitEx clr!Thread::WaitSuspendEventsHelper clr!Thread::WaitSuspendEvents clr! ?? ::FNODOBFM::`string' clr!Thread::RareDisablePreemptiveGC clr!GCHolderBase<1,0,0,1>::EnterInternal clr!AddTimerCallbackEx clr!ThreadpoolMgr::AsyncTimerCallbackCompletion clr!UnManagedPerAppDomainTPCount::DispatchWorkItem clr!ThreadpoolMgr::NewWorkerThreadStart clr!ThreadpoolMgr::WorkerThreadStart clr!Thread::intermediateThreadProc kernel32!BaseThreadInitThunk ntdll!RtlUserThreadStart</pre></code></font></p> Thanks! I’ve found that in CLR 4.0 the module has changed to just clr:

0:000> lmv m clr
start             end                 module name
000007fe`eadc0000 000007fe`eb725000   clr        (pdb symbols)
    Loaded symbol image file: clr.dll
    Image path: C:\Windows\Microsoft.NET\Framework64\
v4.0.30319\clr.dll
    Image name: clr.dll
    Timestamp:        Thu Mar 18 12:39:07 2010 (4BA21EEB)
    CheckSum:         00959DBD
    ImageSize:        00965000
    File version:     4.0.30319.1
    Product version:  4.0.30319.1
    File flags:       8 (Mask 3F) Private
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® .NET Framework
    InternalName:     clr.dll
    OriginalFilename: clr.dll
    ProductVersion:   4.0.30319.1
    FileVersion:      4.0.30319.1 (RTMRel.030319-0100)
    PrivateBuild:     DDBLD431
    FileDescription:  Microsoft .NET Runtime Common Language
Runtime - WorkStation
    LegalCopyright:   © Microsoft Corporation.
All rights reserved.
    Comments:         Flavor=Retail

0:000> ~16kc
Call Site
ntdll!NtWaitForSingleObject
KERNELBASE!WaitForSingleObjectEx
clr!CLREvent::WaitEx
clr!CLREvent::WaitEx
clr!CLREvent::WaitEx
clr!Thread::WaitSuspendEventsHelper
clr!Thread::WaitSuspendEvents
clr! ?? ::FNODOBFM::`string'
clr!Thread::RareDisablePreemptiveGC
clr!GCHolderBase<1,0,0,1>::EnterInternal
clr!AddTimerCallbackEx
clr!ThreadpoolMgr::AsyncTimerCallbackCompletion
clr!UnManagedPerAppDomainTPCount::DispatchWorkItem
clr!ThreadpoolMgr::NewWorkerThreadStart
clr!ThreadpoolMgr::WorkerThreadStart
clr!Thread::intermediateThreadProc
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart

]]> By: Marc Sherman https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-108795 Marc Sherman Wed, 09 Dec 2009 18:57:54 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-108795 Thanks for the cool idea for checking if an app is managed (or at least a subset of it). <p align="left">For silverlight apps you'd want to look for coreclr instead of mscorwks in the stack traces. See http://blogs.msdn.com/tess/archive/2008/08/21/debugging-silverlight-applications-with-windbg-and-sos-dll.aspx for the details.</p> I'm looking forward to your managed articles since I too am a native programmer delving into the .NET world. Marc Thanks for the cool idea for checking if an app is managed (or at least a subset of it).

For silverlight apps you’d want to look for coreclr instead of mscorwks in the stack traces. See http://blogs.msdn.com/tess/archive/2008/08/21/debugging-silverlight-applications-with-windbg-and-sos-dll.aspx for the details.

I’m looking forward to your managed articles since I too am a native programmer delving into the .NET world.

Marc

]]> By: Crash Dump Analysis » Blog Archive » 10 Common Mistakes in Memory Analysis (Part 6) https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-108499 Crash Dump Analysis » Blog Archive » 10 Common Mistakes in Memory Analysis (Part 6) Tue, 08 Dec 2009 11:15:17 +0000 https://www.dumpanalysis.org/blog/index.php/2009/12/07/crash-dump-analysis-patterns-part-95/#comment-108499 [...] previous thread #16 is a CLR thread loading an [...] […] previous thread #16 is a CLR thread loading an […]

]]>