windbg调试多个CLR runtime dump文件,自动加载最新版mscordacwks.dll 的问题

最近碰见的奇怪的问题：

同事在生产环境(win2003 x64)抓取的dump文件，加载SOS.dll调试托管代码，看不到托管信息，经查看dump文件包含多个 .NET runtime:

0:000> lmvm clr
start             end                 module name
00000644`7f100000 00000644`7fa64000   clr        (deferred)
Image path: C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Image name: clr.dll
Timestamp:        Sat Jul 09 17:44:20 2011 (4E1822F4)
CheckSum:         00962B7C
ImageSize:        00964000
File version:     4.0.30319.239
Product version:  4.0.30319.239
File flags:       8 (Mask 3F) Private
File OS:          4 Unknown Win32
File type:        2.0 Dll
File date:        00000000.00000000
Translations:     0409.04b0
CompanyName:      Microsoft Corporation
ProductName:      Microsoft® .NET Framework
InternalName:     clr.dll
OriginalFilename: clr.dll
ProductVersion:   4.0.30319.239
FileVersion:      4.0.30319.239 (RTMGDR.030319-2300)
PrivateBuild:     DDBLD205
FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
LegalCopyright:   © Microsoft Corporation.  All rights reserved.
Comments:         Flavor=Retail

0:000> lmvm mscorwks
start             end                 module name
00000642`7f330000 00000642`7fcd3000   mscorwks   (pdb symbols)          c:\symcache\mscorwks.pdb\12C288264FB04776AF30075C27FCC1AB1\mscorwks.pdb
Loaded symbol image file: mscorwks.dll
Image path: C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
Image name: mscorwks.dll
Timestamp:        Thu Jul 07 09:01:53 2011 (4E150581)
CheckSum:         00993F54
ImageSize:        009A3000
File version:     2.0.50727.3625
Product version:  2.0.50727.3625
File flags:       0 (Mask 3F)
File OS:          4 Unknown Win32
File type:        2.0 Dll
File date:        00000000.00000000
Translations:     0409.04b0
CompanyName:      Microsoft Corporation
ProductName:      Microsoft® .NET Framework
InternalName:     mscorwks.dll
OriginalFilename: mscorwks.dll
ProductVersion:   2.0.50727.3625
FileVersion:      2.0.50727.3625 (GDR.050727-3600)
FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation
LegalCopyright:   © Microsoft Corporation.  All rights reserved.
Comments:         Flavor=Retail

在加载2.0 SOS.dll 后依然自动加载 .NET 4.0 mscordacwks.dll

0:000> .cordll -ve -u -l
CLR DLL status: No load attempts
0:000> .load clr20\sos.dll
0:000> !threads
CLRDLL: Loaded DLL C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll
Failed to request ThreadStore

通过使用.cordll命令可以指定加载mscordacwks.dll

.cordll -ve -se -u -I <Start address of the target .NET runtime module> -N

or

.cordll -ve -se -u -I <Start address of the target .NET runtime module> -lp <path of the managed debugging module>

经过测试，这种方式依然自动加载 Runtime 4.0 mscordacwks.dll

最后经高人指点，可能是由于windbg的版本有关，最开始使用的windbg版本：winDbg:6.11.0001.404 AMD64

下载个老版本 winDbg:6.6.0003.5 AMD64 再次尝试加载 Runtime 2.0 mscordacwks.dll 后调试托管信息成功。