CLR 2.0 DLLs load order

Load order:

mscoree.dll -> mscorwks.dll -> mscorlib.dll -> mscorjit.dll

 

Sample Code:

 1using System;
 2
 3public class Test {
 4
 5    public static void Main() {
 6
 7        Console.WriteLine("Test");
 8
 9    }
10
11}

 

Track Load Road:

CommandLine: D:"src"test.exe

Symbol search path is: srv*d:"symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

ModLoad: 00400000 00408000   image00400000

ModLoad: 7c800000 7c8c0000   ntdll.dll

ModLoad: 79000000 79046000   C:"WINDOWS"system32"mscoree.dll

ModLoad: 77e40000 77f42000   C:"WINDOWS"system32"KERNEL32.dll

(19bc.21f0): Break instruction exception - code 80000003 (first chance)

eax=78000000 ebx=7ffde000 ecx=00000007 edx=00000080 esi=7c8877f4 edi=00151f38

eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0         nv up ei pl nz na po nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000202

ntdll!DbgBreakPoint:

7c81a3e1 cc              int     3

0:000> sxe ld

0:000> g

ModLoad: 77f50000 77feb000   C:"WINDOWS"system32"ADVAPI32.dll

eax=00000044 ebx=00000000 ecx=00020924 edx=77e73f90 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e86c ebp=0012e8b0 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77c50000 77cef000   C:"WINDOWS"system32"RPCRT4.dll

eax=000001ec ebx=00000000 ecx=7ffdd000 edx=00150608 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e538 ebp=0012e57c iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 76f50000 76f63000   C:"WINDOWS"system32"Secur32.dll

eax=00002e00 ebx=00000000 ecx=77f76633 edx=77f76633 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e220 ebp=0012e264 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77da0000 77df2000   C:"WINDOWS"system32"SHLWAPI.dll

eax=fffffffd ebx=00000000 ecx=00000000 edx=00000002 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e5f8 ebp=0012e63c iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77c00000 77c49000   C:"WINDOWS"system32"GDI32.dll

eax=00000000 ebx=00000000 ecx=ffffffe7 edx=0012e5cc esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e2c4 ebp=0012e308 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77380000 77411000   C:"WINDOWS"system32"USER32.dll

eax=77ec1b24 ebx=00000000 ecx=77c43000 edx=00000000 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012dfac ebp=0012dff0 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77ba0000 77bfa000   C:"WINDOWS"system32"msvcrt.dll

eax=00000000 ebx=00000000 ecx=50000161 edx=00150608 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e2c4 ebp=0012e308 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 76290000 762ad000   C:"WINDOWS"system32"IMM32.DLL

eax=00000001 ebx=00000000 ecx=0012d901 edx=00000000 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012d9ac ebp=0012d9f0 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 7f000000 7f009000   C:"WINDOWS"system32"LPK.DLL

eax=001503b0 ebx=00000000 ecx=00000007 edx=00150608 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012da20 ebp=0012da64 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 75490000 754f5000   C:"WINDOWS"system32"USP10.dll

eax=00000002 ebx=00000000 ecx=0012d4ce edx=ffff0057 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012d6ec ebp=0012d730 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 79e70000 7a3ff000   C:"WINDOWS"Microsoft.NET"Framework"v2.0.50727"mscorwks.dll

eax=0012f0f8 ebx=00000000 ecx=00000000 edx=00000000 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012f1bc ebp=0012f200 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 78130000 781cb000   C:"WINDOWS"WinSxS"x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5CF844D2"MSVCR80.dll

eax=790012f4 ebx=00000000 ecx=79005b4c edx=7a3a9a00 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012eea4 ebp=0012eee8 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 7c8d0000 7d0cf000   C:"WINDOWS"system32"shell32.dll

eax=00000000 ebx=00000000 ecx=ffffffff edx=0012f46c esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012ed7c ebp=0012edc0 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77420000 77523000   C:"WINDOWS"WinSxS"x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55"comctl32.dll

eax=00000001 ebx=00000000 ecx=0012e201 edx=00000000 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e1ec ebp=0012e230 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 790c0000 79bf6000   C:"WINDOWS"assembly"NativeImages_v2.0.50727_32"mscorlib"32e6f703c114f3a971cbe706586e3655"mscorlib.ni.dll

eax=00000001 ebx=00000000 ecx=0012e901 edx=00000000 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e9d0 ebp=0012ea14 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023  ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 77670000 777a9000   C:"WINDOWS"system32"ole32.dll

eax=00000000 ebx=00000000 ecx=ffffffff edx=00538ba6 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012f268 ebp=0012f2ac iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

ModLoad: 79060000 790b6000   C:"WINDOWS"Microsoft.NET"Framework"v2.0.50727"mscorjit.dll

eax=00000002 ebx=00000000 ecx=00120074 edx=00000043 esi=7ffdd000 edi=20000000

eip=7c8285ec esp=0012e554 ebp=0012e598 iopl=0        nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

eax=000006bc ebx=00000000 ecx=0012fc28 edx=00000000 esi=7c827c0f edi=00000000

eip=7c8285ec esp=0012fc30 ebp=0012fd24 iopl=0         nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246

ntdll!KiFastSystemCallRet:

7c8285ec c3              ret

0:000> g

       ^ No runnable debuggees error in 'g'