使用MDbgEng从内存中读取对象

时间:2016-06-03 23:27:49

标签: debugging windbg crash-dumps mdbg

我希望在他@mark的问题中帮助asking for an API to dump many objects from a .NET crash dump file

所以我使用mdbgeng编写了以下代码,但不幸的是,当尝试枚举内存中的对象时,它失败了NotImplementedException

using System;
using System.Runtime.InteropServices;
using Microsoft.Samples.Debugging.CorDebug;
using Microsoft.Samples.Debugging.CorDebug.Utility;
using Microsoft.Samples.Debugging.MdbgEngine;
using Microsoft.Samples.Debugging.Native;

namespace DumpHeapFromDotNet
{
    class Program
    {
        static void Main(string[] args)
        {
            var libraryProvider =  new LibraryProvider();
            var dumpReader = new DumpReader(args[0]);
            var dataTarget = new DumpDataTarget(dumpReader);
            foreach (var module in dumpReader.EnumerateModules())
            {
                var clrDebugging = new CLRDebugging();
                Version actualVersion;
                ClrDebuggingProcessFlags flags;
                CorProcess proc;
                var hr = (HResult) clrDebugging.TryOpenVirtualProcess(module.BaseAddress, dataTarget, libraryProvider,
                    new Version(4, 6, int.MaxValue, int.MaxValue), out actualVersion, out flags, out proc);

                if (hr < 0)
                {
                    switch (hr)
                    {
                        case HResult.CORDBG_E_NOT_CLR:
                            Console.WriteLine(module.FullName + " is not a .NET module");
                            break;
                        case HResult.CORDBG_E_LIBRARY_PROVIDER_ERROR:
                            Console.WriteLine(module.FullName + " could not provide library");
                            break;
                        case HResult.CORDBG_E_UNSUPPORTED_DEBUGGING_MODEL:
                        case HResult.CORDBG_E_UNSUPPORTED_FORWARD_COMPAT:
                            break;
                        default:
                            Marshal.ThrowExceptionForHR((int)hr);
                            break;
                    }
                }
                else
                {
                    var objects = proc.Objects; // NotImplementedException
                    foreach (CorObjectValue o in objects)
                    {
                        // TODO: Write details of object to file here
                    }
                }
            }
            Console.ReadLine();
        }
    }
}

我使用的转储是带有完整内存的.NET 4.6.1076.0转储(您可以将文件名作为参数传递):

0:000> lm vm clr
[...]
ProductVersion:   4.6.1076.0
FileVersion:      4.6.1076.0 built by: NETFXREL3STAGE

0:000> .dumpdebug
----- User Mini Dump Analysis

MINIDUMP_HEADER:
Version         A793 (61B1)
NumberOfStreams 11
Flags           1806
                0002 MiniDumpWithFullMemory
                0004 MiniDumpWithHandleData
                0800 MiniDumpWithFullMemoryInfo
                1000 MiniDumpWithThreadInfo

我怀疑它与丢失mscordacwks或类似的东西有关,因为我刚刚在同一台机器上使用与此示例相同的.NET框架创建了转储。

它真的没有实现,还是我做错了什么?

1 个答案:

答案 0 :(得分:1)

我目前正在搞乱MDBG,我试图检查实际应用程序中描述的行为,而不是转储。我收到了同样没有实现的异常。在MSDN上查找文档我发现了这个method is not implemented

的确认