What to do with “The version of SOS does not match the version of CLR you are debugging” in WinDbg?

Question

I\'m having a problem with some of my apps. It\'s a wcf-based app running under IIS6 in Windows 2003 Server (x86):
In Event Log I get such an error from \"W3SVC-WP\" sou

Answer 1

In short, do the following:

1. Get the CLR version form the dump
2. Find and download appropriate Microsoft patch
3. Extract the sos.dll and mscordacwks.dll from the patch
4. Use it

---

Below is an example:

1. After loading a crash dump I get the version I need:

>lm vm clr

it gives me

File version:     4.0.30319.18051

2. I google for MS update that contains this version:

sos.dll 4.0.30319.18051

In this case google gives an MS KB page with a download link. I usually download x64 version, because it contains both x86 and x64 dlls, so I have Windows8-RT-KB2833958-x64.msu now.

Note: sometimes it's tricky to get the required patch, but not in this example.

3. Using FAR file manager I extract cabinet archive from this MSU:

Windows8-RT-KB2833958-x64.cab

Note: Sometimes there're several cabinets inside, so you need to check which one contains sos.dll.

Note: Sometimes patches are distributed as .EXE, so you first need to extract MSU or MSP files (I do it with FAR), and then extract cabinets from them.

4. Sometimes files from CABs can be extracted by FAR, but sometimes they have very different structure and I use Expand.exe from WinAIK. WinAIK is 1.7 Gb ISO, but you need only a small part. I use the following BAT file

mkdir Extracted
..\winaik_amd64\servicing\Expand.exe "%1" -F:sos.dll "Extracted"
..\winaik_amd64\servicing\Expand.exe "%1" -F:mscordacwks.dll "Extracted"

This command extracts all versions of specified dlls, each one inside its own dir. Sometimes there're 2 versions of both mscordacwks.dll and sos.dll. I believe this is because of GRD/LDR(QFE) staff. In our example there're 4.0.30319.18051 and 4.0.30319.19079. Check file properties with Windows Explorer.

5. Rename the files appropriately: mscordacwks.dll must be named as mscordacwks_%arch%_%arch%_%version%.dll and placed near the sos.dll

So mscordacwks.dll (4.0.30319.18051) goes to mscordacwks_AMD64_AMD64_4.0.30319.18051.dll

(x86 version rename to mscordacwks_x86_x86_4.0.30319.18051.dll)

sos.dll might stay as is intact, but I rename it to sos.4.0.30319.18051.dll

Do the same for 4.0.30319.19079 version (for possible future needs)

6. Copy these files to 'C:\SOS\' folder which contains a lot of sos.4.x.x.x.dll and mscordacwks_AMD64_AMD64_4.x.x.x.dll

7. Use it with

.load C:\SOS\sos.4.0.30319.18051.dll

Note: Sometimes for .Net 4.5 you need to add additional '0' to mscordacwks version mscordacwks_AMD64_AMD64_4.6.1055.00.dll instead of mscordacwks_AMD64_AMD64_4.6.1055.0.dll. I didn't dig deeper though, because could handle this within a small timeframe.

BTW, WinDbg will say if mscordacwks cannot be found and will specify the version (which will have double '0' at the end).