Debug a 32-bit w3wp process running on a 64-bit machine

The server installed by the company is a 64-bit 2003 system that runs in the form of a 32-bit IIS6.

With Windows Server 2003TM Service Pack 1,iis 6.0, you can run 32-bit WEB applications using the windows-32-on-windows-64 (WOW64) compatibility layer on 64-bit Windows. IIS 6.0 uses WOW64 to run 32 personal product applications required by software developers and administrators, including 32-bit Internet Information Services (IIS) WEB applications. Specific reference to Running 32-bit applications on 64-bit Windows

See the W3wp.exe process followed by the *32 logo from Task Manager

The x64 and x86 directories are also present on the server.

If you run directly

Ntsd-pv-p 5756-logo d:/out.txt-lines-c ". Dump/ma d:/testlocal.dmp;q"

To generate a dump file, you call the NTSD in the x64 directory directly,

At this time, the relevant information is WOW64 compatibility layer, not the user's 32-bit program,

With a 32-bit WinDbg open testlocal.dmp, you see that the stack contains WOW64 related content rather than the 32-bit program stack that the user wants to see.



The correct approach is to:

Dump that generates 64-bit programs:

X64/userdump.exe
/windows/system32/ntsd.exe
64-bit WinDbg open

Dump that generates 32-bit programs:

X86/userdump.exe
/windows/syswow64/ntsd.exe

32-bit WinDbg open


It is recommended to use the Debugdiag tool to crawl the dump file.