Windbg: Finding a specific instance of a managed object in a windows process

Todays post is a small detour from the regular Exchange related posts. The other day I was troubleshooting an issue with a program. It did not behave as expected in production and so I fired up WinDbg to inspect the value of some objects. I attached WindDbg to the process in question and load psscor4, a replacement from Microsoft for the standard SOS extension (Note that if you want to use psscor, you need the right version: Psscor2 is for .NET 2.0-3.5 software. Psscor4 is only for .NET 4 programs). The WinDbg results I present in this article are not from the process I actually examined. I hacked together a small sample program instead.

The sample class creates instances of a class named Person. A Person class has two properties: A name (string) and an age (int). The object instance I’m looking for is named Mallory. The goal is to get a look at the object instance with a call to !DumpObj. So all I need is the memory address of the Person instance named Alice. This should be easy.

So here we go. First, load the SOS extension. Since I ‘m examining an x64 process, I ‘m using the X64 version of psscor.

.load C:\temp\Psscor4\amd64\amd64\psscor4.dll

The first thing to do is to get an overview about the target class. How many instances of the Person class are currently lying around? A call to Dumpheap reveals this:

0:007> !dumpheap -type Person -stat
Loading the heap objects into our cache.
total 21 objects
Statistics:
              MT    Count    TotalSize       Change Class Name
000007ff000242b0        1           40            1 System.Collections.Generic.List`1[[DebugTest.Person, DebugTest]]
000007ff00024220       20          640           20 DebugTest.Person

So, we have one list of Person objects: List<Person> and 20 instances of the Person class itself. Since there are only 20 of them, let’s just dump them to the console:

Total 21 objects, Total size: 680
0:007> !dumpheap -type Person
Loading the heap objects into our cache.
         Address               MT     Size
00000000027f2588 000007ff000242b0       40    0 System.Collections.Generic.List`1[[DebugTest.Person, DebugTest]]
00000000027f2588 000007ff000242b0       40    
00000000027f25d0 000007ff00024220       32    0 DebugTest.Person
00000000027f25d0 000007ff00024220       32    
00000000027f2630 000007ff00024220       32    0 DebugTest.Person
00000000027f2630 000007ff00024220       32    
00000000027f2650 000007ff00024220       32    0 DebugTest.Person

Read more: InfiniTec - Henning Krauses Blog
QR:

Posted via email from Jasper-net