How to troubleshoot .NET 2.0 Error Reporting messages in the event log?

Question

I work on an open source product called EVEMon written in C# targeting the .NET 2.0 platform, I have one user who is suffering from a strange .NET crash that we have been unable to resolve.

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 5000
Date: 4/29/2009
Time: 10:58:10 PM
User: N/A
Computer: removed this
Description:
EventType clr20r3, P1 evemon.exe, P2 1.2.7.1301, P3 49ea37c8, P4
system.windows.forms, P5 2.0.0.0, P6 4889dee7, P7 6cd3, P8 18, P9
system.argumentexception, P10 NIL.

Data:
//hex representation of the above Description

The application itself crashes with out displaying an error (despite having a error handling UI), the above messages was copied out of the Windows Event log. The end user has re-installed .NET and updated to the latest versions. The .PDB files are distributed with every release version of the program to aid in debugging and testing, the user with the problem in question has the full complement of PDB files for the correct version of EVEMon.

Is there a specific, tried and tested technique to analyse and diagnose this type of crash? and if so what tools and technologies are available to aid in debugging?

Special Thanks

I would like to give special thanks to Steffen Opel and highlight that his answer whilst not directly answering the question I was asking, addressed the bigger issue with my code base that the global error handling was missing an important component.

Answer 1

This is how I would tackle the problem for a end user with a crash.

1. Download and install Debugging Tools for Windows at http://www.microsoft.com/whdc/devtools/debugging/default.mspx

2. Once the tools are installed (they end up going to C:\Program Files\ by default) start a command line window.

3. Change to the directory which contains adplus (e.g "C:\Program Files\Debugging Tools for Windows (x86)").

4. Run the follwing command. This will start the application and attach adplus.

adplus -crash -o C:\debug\ -FullOnFirst -sc C:\path\to\your\app.exe

After the crash dump is created

Once the application crashes start WinDbg and load the .dmp file that is created in C:\debug. (File --> Open Crash Dump)

Execute these commands to see the stack trace and hopefully find the problem.

To load SOS for debugging

• Pre .NET 4.0

.loadby sos mscorwks

• .NET 4.0

.loadby sos clr

To see the stack trace

!clrstack

To see a more useful stack trace

!clrstack –p

To poke inside an object..perhaps see what caused the exception

!do <address>

e.g This is the result from a application that faulted randomly with an IO exception. WinDbg pointed out the path that was being referenced which was incorrect.

0:009> !do 017f2b7c    
Name: System.String    
MethodTable: 790fd8c4    
EEClass: 790fd824    
Size: 124(0x7c) bytes    
 (C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)    
String: \\server\path\not_here.txt
Fields:    
      MT    Field   Offset                 Type VT     Attr    Value Name    
79102290  4000096        4         System.Int32  1 instance       54 m_arrayLength    
79102290  4000097        8         System.Int32  1 instance       53 m_stringLength    
790ff328  4000098        c          System.Char  1 instance       5c m_firstChar    
790fd8c4  4000099       10        System.String  0   shared   static Empty    
    >> Domain:Value  00161df8:790d884c <<    
7912dd40  400009a       14        System.Char[]  0   shared   static WhitespaceChars    
    >> Domain:Value  00161df8:014113e8 <<