Reading objects from memory with MDbgEng

问题

I wanted to help out @mark in a question where he is asking for an API to dump many objects from a .NET crash dump file.

So I wrote the following code using mdbgeng, but unfortunately it fails with a NotImplementedException when trying to enumerate the objects in memory.

using System;
using System.Runtime.InteropServices;
using Microsoft.Samples.Debugging.CorDebug;
using Microsoft.Samples.Debugging.CorDebug.Utility;
using Microsoft.Samples.Debugging.MdbgEngine;
using Microsoft.Samples.Debugging.Native;

namespace DumpHeapFromDotNet
{
    class Program
    {
        static void Main(string[] args)
        {
            var libraryProvider =  new LibraryProvider();
            var dumpReader = new DumpReader(args[0]);
            var dataTarget = new DumpDataTarget(dumpReader);
            foreach (var module in dumpReader.EnumerateModules())
            {
                var clrDebugging = new CLRDebugging();
                Version actualVersion;
                ClrDebuggingProcessFlags flags;
                CorProcess proc;
                var hr = (HResult) clrDebugging.TryOpenVirtualProcess(module.BaseAddress, dataTarget, libraryProvider,
                    new Version(4, 6, int.MaxValue, int.MaxValue), out actualVersion, out flags, out proc);

                if (hr < 0)
                {
                    switch (hr)
                    {
                        case HResult.CORDBG_E_NOT_CLR:
                            Console.WriteLine(module.FullName + " is not a .NET module");
                            break;
                        case HResult.CORDBG_E_LIBRARY_PROVIDER_ERROR:
                            Console.WriteLine(module.FullName + " could not provide library");
                            break;
                        case HResult.CORDBG_E_UNSUPPORTED_DEBUGGING_MODEL:
                        case HResult.CORDBG_E_UNSUPPORTED_FORWARD_COMPAT:
                            break;
                        default:
                            Marshal.ThrowExceptionForHR((int)hr);
                            break;
                    }
                }
                else
                {
                    var objects = proc.Objects; // NotImplementedException
                    foreach (CorObjectValue o in objects)
                    {
                        // TODO: Write details of object to file here
                    }
                }
            }
            Console.ReadLine();
        }
    }
}

The dump I was using is a .NET 4.6.1076.0 dump with full memory (you can pass a file name as an argument):

0:000> lm vm clr
[...]
ProductVersion:   4.6.1076.0
FileVersion:      4.6.1076.0 built by: NETFXREL3STAGE

0:000> .dumpdebug
----- User Mini Dump Analysis

MINIDUMP_HEADER:
Version         A793 (61B1)
NumberOfStreams 11
Flags           1806
                0002 MiniDumpWithFullMemory
                0004 MiniDumpWithHandleData
                0800 MiniDumpWithFullMemoryInfo
                1000 MiniDumpWithThreadInfo

I doubt it has something to do with missing mscordacwks or similar, since I just created the dump on the same machine with the same .NET framework as I used for this sample.

Is it really not implemented yet, or am I doing something else wrong?

回答1:

I'm currently messing with MDBG and I have tried to check the described behavior on real application, not on the dump. I received exatly the same not implemented exception. Looking for the documentation on MSDN I've found the confirmation, that this method is not implemented.

来源：https://stackoverflow.com/questions/37624824/reading-objects-from-memory-with-mdbgeng

标签

debugging

windbg

crash-dumps

mdbg