Monday, August 15, 2011

Windbg - Set break on DLL load

When an application crashes when certain DLL is loaded, we normally see the callstack in Windbg at the point of second chance exception. If the application catches the exception internally, the things can get difficult to track down. In this case, we probably want to set break on DLL load to see if which code is accessing the DLL functions.

Here are simple steps:

1) Run the application under Windbg

    C> Windbg MyApp.exe

2) In Windbg, run below commands. The command sxe sets exception enabled.

    0:000> sxe ld:suspect.dll
    0:000> g

3) When the application hits the DLL, the application will stop and you can check callstack as below:

   0:004> kp

The result of k command (which is callstack) can provide some clues of what's going on.