PowerPoint Presentation

WinDbg .NET

DotNext 2015IntelliEgg

1

? IntelliDebugger http://intelliegg.com .NET - http://spbdotnet.org Cezurity, Acronis, Luxoft, Boeing

WinDbg ? , Visual Studio, ?

?

- deadlock?- * WinDbg

4

?

WinDbg , (mixed)

WinDbg - , GUI

7

WinDbg

https://github.com/yuske/DotNextMsk2015

0:000> .sympath Symbol search path is:

0:000> .sympath+ c:\mysymbolsSymbol search path is: c:\mysymbols0:000> .reload Reloading current modules .... *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll0:000> .symfix

> setx _NT_SYMBOL_PATH cache*C:\symbols;SRV*C:\symbo ls*http://msdl.microsoft.com/download/symbols;\\host\bulds\last /m

> set _NT_ALT_SYMBOL_PATH

https://msdn.microsoft.com/en-us/library/windows/hardware/ff558829(v=vs.85).aspx

0:000> dx /?DX [-r[#]] - display C++ expression using extension model (e.g.: NatVis)DX [-r[#]] [,] - display C++ expression using extension model (e.g.: NatVis) in a specified format

https://msdn.microsoft.com/en-us/library/windows/hardware/dn936815(v=vs.85).aspx

> cd "C:\Program Files (x86)\Windows Kits\10\ Debuggers\x86"> mklink /d Visualizers "C:\Program Files (x86)\ Microsoft Visual Studio 14.0\Common7\Packages\ Debugger\Visualizers

14

.NET SOS http://bit.ly/1PUofK9 SOSEX http://www.stevestechspot.com/ NetExt http://netext.codeplex.com/ PSSCOR2/PSSCOR4 http://bit.ly/1kOJLEV; http://bit.ly/1NKan0GSDbgExt2 https://github.com/steveniemitz/SDbgExt2

0:000> .loadby sos.dll clr0:000> .load sosex0:000> .load netext0:000> .load psscor40:000> .load spt

17

Type HandleSync Block TableMethod TableMethod DescriptorsModulesMetadata TokensEEClass

18

!DumpDomain []!DumpModule [-mt] !DumpAssembly !DumpClass !DumpMT [-MD] !IP2MD !DumpMD !Name2EE

19

0:000> !mx Demo!*Thread*AppDomain 724c6770 (Shared Domain)----------------------------------------------------AppDomain 0085dc28 (Demo.exe)----------------------------------------------------module: Demo class: Demo.Program StartThreadA() StartThreadB()

20

0:000> u002c0362 e8b51ce5ff call 0011201c 002c0367 8bf8 mov edi,eax 002c0369 8b460c mov eax,dword ptr [esi+0Ch] 002c036c 894704 mov dword ptr [edi+4],eax 002c036f 57 push edi 002c0370 8bd5 mov edx,ebp 002c0372 8bcb mov ecx,ebx 002c0374 e8a79a1279 call mscorlib_ni+0x329e20 (793e9e20)

21

0:000> !U eip 002c0362 e8b51ce5ff call 0011201c (JitHelp: CORINFO_HELP_NEWSFAST) 002c0367 8bf8 mov edi,eax 002c0369 8b460c mov eax,dword ptr [esi+0Ch] 002c036c 894704 mov dword ptr [edi+4],eax 002c036f 57 push edi 002c0370 8bd5 mov edx,ebp 002c0372 8bcb mov ecx,ebx 002c0374 e8a79a1279 call mscorlib_ni+0x329e20 (793e9e20) (System.Console.WriteLine(System.String, System.Object, System.Object, System.Object), mdToken: 060007c8)

22

0:000> !ip2md 0x793e9e20 MethodDesc: 79259d40 Method Name: System.Console.WriteLine (System.String, System.Object, System.Object, System.Object) Class: 79101018 MethodTable: 79101118 mdToken: 060007c8 Module: 790c2000 IsJitted: yes m_CodeOrIL: 793e9e20

0:000> !DumpIL 79259d40 ilAddr = 79b28110 IL_0000: call System.Console::get_Out IL_0005: ldarg.0 IL_0006: ldarg.1 IL_0007: ldarg.2 IL_0008: ldarg.3 IL_0009: callvirt System.IO.TextWriter::WriteLine IL_000e: ret

0:004> !name2ee Bar.exe Bar.App.Foo Module: 00112d8c (Bar.exe)Token: 0x06000002MethodDesc: 00113178Name: Bar.App.Foo(Int32, Int32) JITTED Code Address: 003e01780:004> bp 003e0178

25

0:004> !name2ee Bar.exe Bar.App.Foo Module: 00112d8c (Bar.exe)Token: 0x06000002MethodDesc: 00113178Name: Bar.App.Foo(Int32, Int32) Not JITTED yet. Use !bpmd -md 00113178 to break on run.0:004> !bpmd md 00113178MethodDesc = 00113178 Adding pending breakpoints...

26

0:004> !bpmd Bar.exe Bar.Comparer`1.GreaterThanFound 1 methods...MethodDesc = 001a3188 Adding pending breakpoints...

27

!mbm [ILOffset] [Options]!mbp [ColNum] [Options]

28

.NET Framework

29

0:004> !threadsThreadCount: 3UnstartedThread: 0BackgroundThread: 1... ID OSID ThreadOBJ State ... Apt Exception 0 1 316c 0109b6e0 202a020 MTA 5 2 1f88 010a8e98 2b220 MTA (Finalizer) 6 3 1968 010c8960 202b020 MTA

0:004> !ClrStackOS Thread Id: 0x316c (0)Child SP IP Call Site0018ec34 77b96e3c [HelperMethodFrame: 0018ec34] System.Threading.Thread.SleepInternal(Int32)0018ecb8 70bebfca System.Threading.Thread.Sleep(Int32)0018ecc0 00f30740 Demo.Program.SampleB() [C:\Demo\Program.cs @ 66]0018ed14 00f304ed Demo.Program.Main(System.String[]) [C:\Demo\Program.cs @ 17]

!DumpStack [-ee]!mk [FrameCount] [-l] [-p] [-a]!EEStack short [-ee]

33

deadlock

34

0:000> dd 0x01e06bec01e06bec 001c30b0 00000000 00000000 00000000 01e06bfc 80000000 790fd8c4 00000014 00000013 01e06c0c 003a0078 0030007b 002c007d 00790020 01e06c1c 007b003a 007d0031 0020002c 003a007a 01e06c2c 0032007b 0000007d 00000000 00000000 01e06c3c 00000000 00000000 00000000 00000000 01e06c4c 00000000 00000000 00000000 00000000 01e06c5c 00000000 00000000 00000000 00000000

0:000> !DumpObj 0x01c56bec Name: Bar.AppMethodTable: 002130b0 EEClass: 00211240 Size: 20(0x14) bytes (C:\samples\Bar.exe)...

36

!DumpVC !DumpArray [-start ] [-length ] [-details] [-nofields]

37

0:000>!mdt 02772f90 -r02772f90 (Demo.Bar) array:02772ff8 (System.Int32[], Elements: 4) list:02773038 (.List`1[[System.String, mscorlib]]) _items:0277305c (System.String[], Elements: 4) _size:0x2 (System.Int32) _version:0x2 (System.Int32) _syncRoot:NULL (System.Object) k__BackingField:(Demo.Point) VALTYPE

38

!DumpStackObjects [-verify] [top stack [bottom stack]]!ObjSize [] | [-aggregate] [-stat]

39

!DumpHeap [-stat] [-strings] [-short] [-min ] [-max ] [-thinlock] [-startAtLowerBound] [-mt ] [-type ][start [end]]!DumpRuntimeTypes!strings!EEHeap [-gc] [-loader]!TraverseHeap [-xml] !VerifyHeap

0:006> !HeapStat -iuHeap Gen0 Gen1 Gen2 LOHHeap0 188636 6297752 256636732 17592

Free space: Heap0 12 116 6916 80

Unrooted objects: Heap0 170476 6297584 256616572 0

!GCRoot [-nostacks] !gcgen !dumpgen [-free] [-stat] [-type ] [-nostrings]

memory leak

43

web-!whttp HttpContext !wservice WCF service !wsocket !DumpASPNetRequests HttpContext !DumpSqlConnectionPools Sql onnection pools

?

http://amzn.to/21TWSWd http://amzn.to/1NK2bl0 http://amzn.to/1QzZIdR

Sasha Goldshtein http://blogs.microsoft.co.il/sasha/ John Robbins http://www.wintellect.com/devcenter/jrobbins EreTIk's Box http://eretik.omegahg.com/WinDbg.html

48

TRUE DETECTIVEWinDbg is

49

intelliegg.comspbdotnet.orggithub.com/yuske@yu5k3

IntelliEgg

!