I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension?

Currently I'm just exploring each assembly in the domain, then in each assembly I dump all modules, then in each module I dump method tables hoping that some method address will be equal to the method I search. And it takes me eternity...


1 Answer 1


You can use the ip2md sos command to get the method name for jitted code.

0:016> k
 # Child-SP          RetAddr           Call Site
00 00000000`013fe688 00007ffb`4567ddb8 win32u!NtUserWaitMessage+0x14
01 00000000`013fe690 00007ffb`45611535 System_Windows_Forms_ni+0x2cddb8

0:016> !ip2md 00007ffb`45611535 
MethodDesc:   00007ffb454a25e8
Method Name:  System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32)
Class:        00007ffb4540c9f8
MethodTable:  00007ffb45743f78
mdToken:      00000000060052f3
Module:       00007ffb453b1000
IsJitted:     yes
CodeAddr:     00007ffb45610fd0
Transparency: Safe critical

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.