WinDbg中!bpmd断点触发Access violation错误排查

架构老林

2026-7-19

WinDbg调试.NET 7托管代码的断点异常问题

初始尝试与错误

尝试在WinDbg中为托管代码添加断点，执行命令 !mbp Program.cs 5 时，出现错误：

Failed to load App Domain data for the shared AppDomain. Error = 0x80070057

EDIT1：换用bpmd后的访问违例错误

排查发现sosex与.NET 7不兼容导致上述错误，改用sos扩展的bpmd命令为TestClass.Example()方法添加断点：

!bpmd -md 00007FFDBEB99BB0

断点能正常触发，但继续执行后抛出访问违例错误：

(22d8.1680): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00007ffd`beaa0990 0000            add     byte ptr [rax],al ds:00007ffd`beaa0990=00

EDIT2：系统方法与自定义方法的差异疑问

确认sos的bpmd与.NET 7存在兼容性问题，降级到.NET 6后bpmd可正常工作。但存在疑问：在.NET 7项目中，用bpmd为System.String.Contains（属于System.Private.CoreLib.dll）设置断点可正常执行，为何自定义的TestClass.Example()方法会报错？System.Private.CoreLib.dll本身也是基于.NET 7构建的，是什么导致了这种差异？

测试代码

namespace TestApp
{
  class Program
  {
      private static void Main()
      {
         var testClass = new TestClass();
         Console.ReadLine();
         testClass.Example();
      }
  }

  public class TestClass
  {
      public int X;

      public void Example()
      {
          Console.WriteLine(X++);
      }
  }
}

完整WinDbg输出

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : false
   AllowNugetExeUpdate : false

   - Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true


************* Waiting for Debugger Extensions Gallery to Initialize **************
.
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 36

Microsoft (R) Windows Debugger Version 10.0.25324.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: C:\Users\Loord\RiderProjects\TestApp\TestApp\bin\Debug\net7.0\TestApp.exe

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
ModLoad: 00007ff7`07660000 00007ff7`0768b000   apphost.exe
ModLoad: 00007ffe`a8870000 00007ffe`a8a65000   ntdll.dll
ModLoad: 00007ffe`a84f0000 00007ffe`a85ad000   C:\Windows\System32\KERNEL32.DLL
ModLoad: 00007ffe`a6430000 00007ffe`a66f8000   C:\Windows\System32\KERNELBASE.dll
ModLoad: 00007ffe`a85b0000 00007ffe`a8750000   C:\Windows\System32\USER32.dll
ModLoad: 00007ffe`a6170000 00007ffe`a6192000   C:\Windows\System32\win32u.dll
ModLoad: 00007ffe`a8010000 00007ffe`a803a000   C:\Windows\System32\GDI32.dll
ModLoad: 00007ffe`a6060000 00007ffe`a616b000   C:\Windows\System32\gdi32full.dll
ModLoad: 00007ffe`a6700000 00007ffe`a679d000   C:\Windows\System32\msvcp_win.dll
ModLoad: 00007ffe`a6330000 00007ffe`a6430000   C:\Windows\System32\ucrtbase.dll
ModLoad: 00007ffe`a7090000 00007ffe`a77d2000   C:\Windows\System32\SHELL32.dll
ModLoad: 00007ffe`a7e80000 00007ffe`a7f2c000   C:\Windows\System32\ADVAPI32.dll
ModLoad: 00007ffe`a6a60000 00007ffe`a6afe000   C:\Windows\System32\msvcrt.dll
ModLoad: 00007ffe`a8450000 00007ffe`a84eb000   C:\Windows\System32\sechost.dll
ModLoad: 00007ffe`a8040000 00007ffe`a816b000   C:\Windows\System32\RPCRT4.dll
(22d8.1680): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffe`a8940670 cc              int     3
0:000> g
ModLoad: 00007ffe`a8750000 00007ffe`a8780000   C:\Windows\System32\IMM32.DLL
ModLoad: 00007ffe`7e310000 00007ffe`7e371000   C:\Program Files\dotnet\host\fxr\7.0.4\hostfxr.dll
ModLoad: 00007ffe`7fd70000 00007ffe`7fdd3000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\hostpolicy.dll
ModLoad: 00007ffe`1e440000 00007ffe`1e939000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\coreclr.dll
ModLoad: 00007ffe`a8170000 00007ffe`a829a000   C:\Windows\System32\ole32.dll
ModLoad: 00007ffe`a79a0000 00007ffe`a7cf5000   C:\Windows\System32\combase.dll
ModLoad: 00007ffe`a68d0000 00007ffe`a699d000   C:\Windows\System32\OLEAUT32.dll
ModLoad: 00007ffe`a6850000 00007ffe`a68d0000   C:\Windows\System32\bcryptPrimitives.dll
(22d8.1680): Unknown exception - code 04242420 (first chance)
ModLoad: 00007ffe`1d920000 00007ffe`1e43a000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Private.CoreLib.dll
ModLoad: 00007ffe`1d7a0000 00007ffe`1d91b000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\clrjit.dll
ModLoad: 00007ffe`a3f10000 00007ffe`a3f22000   C:\Windows\SYSTEM32\kernel.appcore.dll
ModLoad: 00000000`00420000 00000000`00428000   C:\Users\Loord\RiderProjects\TestApp\TestApp\bin\Debug\net7.0\TestApp.dll
ModLoad: 00000000`02270000 00000000`0227e000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Runtime.dll
ntdll!NtMapViewOfSection+0x14:
00007ffe`a890d224 c3              ret
0:000> g
ModLoad: 00007ffe`7fd00000 00007ffe`7fd2a000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Console.dll
ModLoad: 00007ffe`9cf90000 00007ffe`9cfa3000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Threading.dll
ModLoad: 00000000`02290000 00000000`02298000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Text.Encoding.Extensions.dll
ModLoad: 00007ffe`7e300000 00007ffe`7e30d000   C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.4\System.Runtime.InteropServices.dll
ntdll!NtMapViewOfSection+0x14:
00007ffe`a890d224 c3              ret
0:000> g
(22d8.3484): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00007ffe`a8910810 cc              int     3
0:008> !name2ee *!TestClass.Example
Module:      00007ffdbe8e4000
Assembly:    System.Private.CoreLib.dll
--------------------------------------
Module:      00007ffdbeb6cf48
Assembly:    TestApp.dll
Token:       0000000006000005
MethodDesc:  00007ffdbeb99bb0
Name:        TestApp.TestClass.Example()
Not JITTED yet. Use !bpmd -md 00007FFDBEB99BB0 to break on run.
--------------------------------------
Module:      00007ffdbeb6ea80
Assembly:    System.Runtime.dll
--------------------------------------
Module:      00007ffdbeb99ce8
Assembly:    System.Console.dll
--------------------------------------
Module:      00007ffdbeb9b150
Assembly:    System.Threading.dll
--------------------------------------
Module:      00007ffdbebc2020
Assembly:    System.Text.Encoding.Extensions.dll
--------------------------------------
Module:      00007ffdbebc4f88
Assembly:    System.Runtime.InteropServices.dll
0:008> !bpmd -md 00007FFDBEB99BB0
MethodDesc = 00007FFDBEB99BB0
Adding pending breakpoints...
0:008> g
(22d8.1680): CLR notification exception - code e0444143 (first chance)
JITTED TestApp!TestApp.TestClass.Example()
Setting breakpoint: bp 00007FFDBEAA0B90 [TestApp.TestClass.Example()]
Breakpoint 0 hit
TestApp!TestApp.TestClass.Example:
00007ffd`beaa0b90 55              push    rbp
0:000> g
(22d8.1680): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00007ffd`beaa0990 0000            add     byte ptr [rax],al ds:00007ffd`beaa0990=00

问题解答

1. 初始错误原因

sosex扩展的!mbp命令在.NET 7环境下存在兼容性问题，无法正确加载共享AppDomain数据，导致0x80070057参数错误。

2. bpmd触发后访问违例的原因

sos扩展的bpmd命令在.NET 7中对自定义程序集的JIT钩子逻辑存在缺陷：当自定义方法首次JIT编译时，bpmd设置的断点会错误地覆盖方法入口处的指令，或者在断点移除/恢复时破坏了原有指令的完整性，导致后续执行时出现内存访问违例。

3. 系统方法与自定义方法的差异

System.Private.CoreLib.dll中的方法属于.NET运行时核心库，这类方法在.NET发布时会被**预编译（NGEN/AOT）**或者在运行时JIT编译时受到特殊处理：

核心库方法的JIT编译流程受CLR特殊保护，bpmd的断点逻辑不会破坏其指令完整性；
自定义程序集的方法是普通JIT编译，bpmd在.NET 7中的钩子逻辑未适配新的JIT编译流程，导致断点设置/恢复时出现指令损坏。

临时解决方案

降级项目到.NET 6，bpmd可正常工作；

改用sos的!name2ee命令获取方法地址，手动设置原生断点：

!name2ee TestApp.dll!TestApp.TestClass.Example
bp <JIT编译后的方法地址>

使用.NET 7官方推荐的调试工具，如Visual Studio调试器或dotnet-dump工具。

内容的提问来源于stack exchange，提问作者Enescan BEKTAŞ

WinDbg中!bpmd断点触发Access violation错误排查

初始尝试与错误 #

EDIT1：换用bpmd后的访问违例错误 #

EDIT2：系统方法与自定义方法的差异疑问 #

测试代码 #

完整WinDbg输出 #

问题解答 #

1. 初始错误原因 #

2. bpmd触发后访问违例的原因 #

3. 系统方法与自定义方法的差异 #

临时解决方案 #