DebuggingExtensions

The few "debugging extensions" that have been created at Criteo to help post-mortem .NET applications analysis are now available:

• as a stand alone tool to load a .NET application memory dump and start automatic thread, thread pool, tasks and timer analysis. zip
• as a WinDBG extension to get the same level of details plus more commands such as getting a method signature based on its address. zip
• as a .NET Core console tool to load a .NET application memory dump and show merged threads call stack à la Visual Studio "parallel stacks" (works also on Linux). zip

More analyzers and commands will be added as needed.

Introduction

Most of the code is detailed in the blog series related to ClrMD:

Part 1: Bootstrap ClrMD to load a dump.

Part 2: Find duplicated strings with ClrMD heap traversing.

Part 3: List timers by following static fields links.

Part 4: Identify timers callback and other properties.

Part 5: Use ClrMD to extend SOS in WinDBG.

Part 6: Manipulate memory structures like real objects.

Part 7: Manipulate nested structs using dynamic.

Part 8: Spelunking inside the .NET Thread Pool.

Part 9: Deciphering Tasks and Thread Pool items.

The detailed features are available either as a stand alone tool or a WinDBG extension. More commands will be added as needed.

Source Code

The DebuggingExtensions Visual Studio 2017 solution contains three projects:

1. ClrMDStudio: WPF application that loads a dump file on which commands to be executed

2. gsose: "Grand Son Of Strike Extension" for WinDBG that exposes the same commands (and more)

3. pstacks: .NET Core console application that loads a dump file and shows merged parallel stacks

These projects depends on Nuget packages:

• ClrMD: C# library to explore dump files.
• DynaMD: C# dynamic-based helpers on top of ClrMD.
• ClrMDExports: Helper to write WinDBG/LLDB extensionss on top of ClrMD.