Windbg Extension NetExt 使用指南 【2】 ---- NetExt 的基本命令介绍
摘要 : 本章節(jié)介紹NetExt常用的命令. 并且對(duì)SOS進(jìn)行一些對(duì)比.
NetExt的幫助
要想玩好NetExt, 入門(mén)就得看幫助. 看NetExt的幫助可以調(diào)用!whelp 命令. 這樣hi列舉出NetExt所支持的所有命令.
0:000> !netext.whelp netext version 2.0.0.5000 Feb 9 2015 License and usage can be seen here: !whelp license Check Latest version: !wupdate For help, type !whelp (or in WinDBG run: '.browse !whelp') Questions and Feedback: http://netext.codeplex.com/discussions Copyright (c) 2014-2015 Rodney Viana (http://blogs.msdn.com/b/rodneyviana) Type: !windex -tree or ~*e!wstack to get startedShow Object Detail Commands --------------------------- !wdo - Display ad-hoc objects or arrays from GAC or Stack !wselect - Display ad-hoc fields (and level fields) for an object or for all item in an array !wfrom - Perform SQL-like analysis of Heap objects enabling comparison, expression evaluation and indexed filtering. *(new)* !wpe - Dump Exception ObjectEnumerate objects ------------------ !windex - index and display objects based in different filters like object with of type HttpContext !wstack - dump unique stack objects !wheap - list objects without indexing and show thottled heap sampling !wgchandle - Dump GC root handles *(new)* !wdae - Dump All ExceptionsProcess commands ---------------- !wclrstack - Dump current stack trace (only managed thread) *(new)* !wthreads *(new)* !wver - Show CLR version and extension version *(new)* !wupdate - Check for updateSpecial -------!wdict - Display dictionary objects !whash - Display HashTable objects !whttp - List HttpContext Objects !wconfig - Show all .config file lines in memory !wservice - List WCF service Objects !weval - Evaluate expression list !wkeyvalue - Display pair key/value for NameObjectCollection type objects !wcookie - Display HTTP cookies !wruntime - Display HTTP Runtime Info including Active Requests !wtoken - Display WIF tokens and cookiesMisc ----expression syntax functions list *new functions* license see all licenses applied to this product?
如果想要知道具體更為具體的內(nèi)容, 需要在!whelp 后面加上這個(gè)命令. 例如, NetExt中用得非常多的一個(gè)命令!wdo. 這個(gè)命令相當(dāng)于!sos.do. 如果想要知道它更為詳細(xì)的說(shuō)明, 可以執(zhí)行命令 !whelp wdo
0:000> !netext.whelp wdo Display ad-hoc objects or arrays from GAC or StackUsage: !wdo [-forcearray] [-shownull] [-noheader] [-noindex] [-tokens] [-mt <expr>][-start <expr>] [-end <expr>] <expr> Where:-mt <expr> is the method table address of the object (for value objects). Optional-start lt;expr> is the starting index of an array. Optional. Default is starting array at item 0-end <expr> is the end index of an array. Optional. Default is ending array at max items-forcearray if not used Byte[] and Char[] arrays will show as string instead of array items. Optional-shownull if not used will show only non-empty array items. Optional-noheader if present will hide headers and show only object address, fields and values. Optional-noindex if present will not show array index (useful for .foreach). Optional-tokens if present will show class token and field token<expr> is the object or array address (you can use an expression). RequiredImprovements over !DumpObj: ---------------------------- Object, struct and nested class fields show address value with link to detail the field. Click link to follow- Numeric type fields show both hex and decimal values- For Enum type fields it shows the type name (or type names for [Flag]Enum) along with the numeric value- For TimeSpan and DateTime fields it shows the string equivalent- For strings it show the content after the address- It shows the inheritance chain in the header (not interface implementations though)- Byte[] and Char[] objects shows as string if you do not use -forcearraty- By default, array objects only show non-null items- Static fields show the value for the first valid application domain where it is defined- For arrays it lists all componentsExamples: -------------Listing an object ad-hoc ------------------------!wdo -tokens 00000001556e24e8Address: 00000001556e24e8EEClass: 000007feef8c2d50Method Table: 000007feefc40268Class Name: System.Runtime.Remoting.Lifetime.LeaseSize : 96Instance Fields: 12Static Fields: 1Total Fields: 13Heap: 0Generation: 0Module: 000007feef7d1000Assembly: 0000000001373e00Domain: 000007fef2767880Dynamic: falseAssembly name: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dllInherits: System.Runtime.Remoting.Lifetime.Lease System.Object System.MarshalByRefObject (000007FEEFC40268 000007FEEFC07370 000007FEEFC0AD70)400018a 000007feefc07370 2000052 System.Object +0000 __identity 0000000000000000400201e 000007feefc0ecf0 2000702 System.Int32 +0020 id 0 (0n0)400201f 000007feefc47fb8 2000702 System.DateTime +0030 leaseTime -mt 000007FEEFC47FB8 00000001556E2520 10/26/2011 9:21:08 PM4002020 000007feefc47eb8 2000702 System.TimeSpan +0038 initialLeaseTime -mt 000007FEEFC47EB8 00000001556E2528 00:05:004002021 000007feefc47eb8 2000702 System.TimeSpan +0040 renewOnCallTime -mt 000007FEEFC47EB8 00000001556E2530 00:02:004002022 000007feefc47eb8 2000702 System.TimeSpan +0048 sponsorshipTimeout -mt 000007FEEFC47EB8 00000001556E2538 00:02:004002023 000007feefc06c50 2000702 System.Boolean +002c isInfinite 0 (False)4002024 000007feefc0f3d8 2000702 System.Collections.Hashtable +0008 sponsorTable 00000001556E25484002025 000007feefc0ecf0 2000702 System.Int32 +0024 sponsorCallThread 0 (0n0)4002026 000007feefc41568 2000702 System.Runtime.Remoting.Lifetime.LeaseMa +0010 leaseManager 00000001556E1FD04002027 000007feefc0ad70 2000702 System.MarshalByRefObject +0018 managedObject 0000000155663A404002028 000007fef03aefc0 2000702 System.Runtime.Remoting.Lifetime.LeaseSt +0028 state 2 (0n2) Active4002029 000007feefc0ecf0 Static 2000702 System.Int32 +0c78 nextId NoInitListing only items 5 to 10 (oxa) from an array ----------------------------------------------!wdo -start 5 -end a 000000016d29cb50Address: 000000016d29cb50EEClass: 00000642780e0cf8Method Table: 000006427843e2a8Class Name: System.Collections.Hashtable+bucket[]Size : 576Rank: 1Components: 23[5]: 000000016d29cbd8[6]: 000000016d29cbf0[7]: 000000016d29cc08[8]: 000000016d29cc20[9]: 000000016d29cc38[10]: 000000016d29cc50* Note: for HashTables you can use !whashCompare to: -----------!wselect - also shows add-hoc objects and arrays, however wselect enables the selection of fields (and field levels) and does not show extensive header!wfrom - enable complex query mechanism with categories, conditions and functions but it is not as simple to use as wselect and wdoHow do I get object addresses? ------------------------------- Type !windex -enumtypes or !windex -tree to enumerate heap objects- Type ~*e!wstack to list all objects in the stack for all threads- Type !wheap to show a quick heap sampling without indexing. It will yield a throttled but quick output?
玩轉(zhuǎn)DUMP OBJECT
SOS中可以用!do里面把Object的信息DUMP出來(lái). NetExt中, 則是使用!wdo. 從表面看, 他們顯示的結(jié)果并沒(méi)有多大區(qū)別.
0:014> !do 00000001957775e0 Name: System.RuntimeFieldInfoStub MethodTable: 000007fef0b9c950 EEClass: 000007fef07d1dc0 Size: 72(0x48) bytes File: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll Fields:MT Field Offset Type VT Attr Value Name 000007fef0b95a48 40005c6 8 System.Object 0 instance 0000000000000000 m_keepalive 000007fef0b95a48 40005c7 10 System.Object 0 instance 0000000000000000 m_c 000007fef0b95a48 40005c8 18 System.Object 0 instance 0000000000000000 m_d 000007fef0b9c7d8 40005c9 30 System.Int32 1 instance 0 m_b 000007fef0b95a48 40005ca 20 System.Object 0 instance 0000000000000000 m_e 000007fef0b95a48 40005cb 28 System.Object 0 instance 0000000000000000 m_f 000007fef0ba6d98 40005cc 38 ...eldHandleInternal 1 instance 0000000195777618 m_fieldHandle0:014> !netext.wdo 00000001957775e0 Address: 00000001957775e0 Method Table/Token: 000007fef0b9c950/200014a04 Class Name: System.RuntimeFieldInfoStub Size : 72 EEClass: 000007fef07d1dc0 Instance Fields: 7 Static Fields: 0 Total Fields: 14 Heap/Generation: 1/0 Module: 00000000f06d0000 Assembly: 0000000000da0870 Domain: 00000000f3f75580 Assembly Name: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll Inherits: System.Object (000007FEF0B95A48) 000007fef0b95a48 System.Object +0000 m_keepalive 0000000000000000 000007fef0b95a48 System.Object +0008 m_c 0000000000000000 000007fef0b95a48 System.Object +0010 m_d 0000000000000000 000007fef0b95a48 System.Object +0018 m_e 0000000000000000 000007fef0b95a48 System.Object +0020 m_f 0000000000000000 000007fef0b9c7d8 System.Int32 +0028 m_b 0 (0n0) 000007fef0ba6d98 System.RuntimeFieldHandleInternal +0030 m_fieldHandle -mt 000007FEF0BA6D98 0000000195777618
!wdo在細(xì)節(jié)上則做的更加體貼. 例如dump的對(duì)象中包含了一個(gè)string類(lèi)型, !wdo會(huì)將string的地址顯示出來(lái). 對(duì)于枚舉類(lèi)型, 則會(huì)將枚舉對(duì)應(yīng)的含義顯示出來(lái).? !do命令顯示出來(lái)的結(jié)果還必須手工的再對(duì)string的地址進(jìn)行操作. 對(duì)枚舉的類(lèi)型的翻譯也相當(dāng)?shù)馁N心, 減少了機(jī)械枯燥的工作也節(jié)省了時(shí)間.
另外一個(gè)優(yōu)勢(shì)在于對(duì)數(shù)組的處理. SOS的!do并不能顯示數(shù)組里面的內(nèi)容, 需要使用!dumparray命令.
使用!wdo時(shí)候, 他會(huì)嘗試將這些數(shù)組翻譯成一些有意義的內(nèi)容. 例如上面的byte[]數(shù)組, 其實(shí)可以拼成一組字符串.
?
還能用-noheader的參數(shù)減少輸出的內(nèi)容, 可以關(guān)注具體字段里面的數(shù)據(jù). 通常是配合一些腳本一起使用.
每一列的意義如下 :
| Column | 意義 |
| 0 | 當(dāng)前field的類(lèi)型的Method Definition Table的地址 |
| 1 | 如果顯示Static, 則說(shuō)明這個(gè)field是個(gè)Static類(lèi)型, 否則是個(gè)instance |
| 2 | 類(lèi)型的名稱 |
| 3 | field的偏移量. |
| 4 | field name |
| 5 | 這個(gè)field的具體內(nèi)容, 如果是個(gè)值類(lèi)型, 則是它的值, 如果是引用類(lèi)型則顯示它的地址. |
| 6 | 如果是一個(gè)常用類(lèi)型, 則顯示他的具體內(nèi)容, 常用類(lèi)型包括datetime, string, guid等等 |
?
!wselect初體驗(yàn)
另外一個(gè)非常強(qiáng)大的功能是!wselect命令. 這個(gè)命令與!wdo很類(lèi)似, 也是用dump object.
0:014> !wselect * from 000000019588b000 [System.Uri] Known Type Value: http://rviana-serv.northamerica.corp.microsoft.com:2000/Service.svc (string)System.String m_String = http://rviana-serv.northamerica.corp.microsoft.com:2000/Service.svc (string)System.String m_originalUnicodeString = NULL System.UriParser m_Syntax = 000000019568C020 (string)System.String m_DnsSafeHost = NULL System.Uri+UriInfo m_Info = 000000015572EA20 (…)
如果你認(rèn)為他只能做到這些就圖樣圖森破了. 它還可以只顯示個(gè)別特定的field, 當(dāng)然你必須指定field的名稱.
不僅如此, 它還可以將field所對(duì)應(yīng)的Object下面的field也dump出來(lái). 這個(gè)功能非常的實(shí)用. 當(dāng)我需要重復(fù)性的檢查一些固定模式的對(duì)象值的時(shí)候, 可以用他做成一個(gè)腳本, 然后一勞永逸的一直執(zhí)行下去.
例如, 如果我現(xiàn)在知道HttpContext的地址. 然后我需要知道它對(duì)應(yīng)的請(qǐng)求的UTC Time Stamp, http Method, URL, Response status code等等內(nèi)容時(shí), 應(yīng)該怎么辦? 這些數(shù)據(jù)并不全都直接顯示在HttpContext上面. UTC Time Stamp在HttpContext上面可以找到. HttpMethod則在HttpContext下面的HttpRequest下面this._request._httpMethod. URI則離得更遠(yuǎn), _request._url.m_String. Response Status Code又在另外一個(gè)對(duì)象上this._response._statusCode. 下面舉例我如何通過(guò)SOS去DUMP一個(gè)Http的請(qǐng)求地址.
0:014> !do 00000001956f77a8 Name: System.Web.HttpContext MethodTable: 000007fed5396100 EEClass: 000007fed505b938 Size: 344(0x158) bytes File: C:\Windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll Fields:MT Field Offset Type VT Attr Value Name 000007fed5395598 4000cab 8 ...IHttpAsyncHandler 0 instance 0000000000000000 _asyncAppHandler 000007fed53950c0 4000cac 10 ...b.HttpApplication 0 instance 0000000000000000 _appInstance 000007fed5395610 4000cad 18 ....Web.IHttpHandler 0 instance 0000000000000000 _handler 000007fed5396558 4000cae 20 ...m.Web.HttpRequest 0 instance 00000001956f7900 _request(...)0:014> !do 00000001956f7900 Name: System.Web.HttpRequest MethodTable: 000007fed5396558 EEClass: 000007fed505b9a0 Size: 360(0x168) bytes File: C:\Windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll Fields:MT Field Offset Type VT Attr Value Name 000007fed5399f48 4000d40 8 ...HttpWorkerRequest 0 instance 00000001956f7570 _wr 000007fed5396100 4000d41 10 ...m.Web.HttpContext 0 instance 00000001956f77a8 _context 000007fef0b968f0 4000d42 18 System.String 0 instance 00000001956fa860 _httpMethod 000007fed53cb4c0 4000d43 148 System.Int32 1 instance 2 _httpVerb 000007fef0b968f0 4000d44 20 System.String 0 instance 0000000000000000 _requestType 000007fed538ac98 4000d45 28 ...m.Web.VirtualPath 0 instance 00000001956ff140 _path 000007fef0b968f0 4000d46 30 System.String 0 instance 0000000000000000 _rewrittenUrl 000007fef0b9d608 4000d47 150 System.Boolean 1 instance 0 _computePathInfo 000007fed538ac98 4000d48 38 ...m.Web.VirtualPath 0 instance 00000001956fe068 _filePath 000007fed538ac98 4000d49 40 ...m.Web.VirtualPath 0 instance 0000000000000000 _currentExecutionFilePath 000007fed538ac98 4000d4a 48 ...m.Web.VirtualPath 0 instance 0000000000000000 _pathInfo 000007fef0b968f0 4000d4b 50 System.String 0 instance 0000000155660488 _queryStringText 000007fef0b9d608 4000d4c 151 System.Boolean 1 instance 0 _queryStringOverriden 000007fef0ba0b40 4000d4d 58 System.Byte[] 0 instance 0000000000000000 _queryStringBytes 000007fef0b968f0 4000d4e 60 System.String 0 instance 00000001956f76c0 _pathTranslated 000007fef0b968f0 4000d4f 68 System.String 0 instance 0000000155660488 _contentType 000007fef0b9c7d8 4000d50 14c System.Int32 1 instance -1 _contentLength 000007fef0b968f0 4000d51 70 System.String 0 instance 0000000000000000 _clientTarget 000007fef0b9adf8 4000d52 78 System.Object[] 0 instance 0000000000000000 _acceptTypes 000007fef0b9adf8 4000d53 80 System.Object[] 0 instance 0000000000000000 _userLanguages 000007fed53a3f68 4000d54 88 ...owserCapabilities 0 instance 0000000000000000 _browsercaps 000007feeec9b358 4000d55 90 System.Uri 0 instance 00000001957112a0 _url(...)0:014> !do 00000001957112a0 Name: System.Uri MethodTable: 000007feeec9b358 EEClass: 000007feee995d30 Size: 72(0x48) bytes File: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll Fields:MT Field Offset Type VT Attr Value Name 000007fef0b968f0 400161c 8 System.String 0 instance 0000000195711240 m_String(...)0:014> !do 0000000195711240 Name: System.String MethodTable: 000007fef0b968f0 EEClass: 000007fef071ed58 Size: 92(0x5c) bytes File: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll String: http://localhost:2000/Service.svc Fields:MT Field Offset Type VT Attr Value Name 000007fef0b9c7d8 4000103 8 System.Int32 1 instance 33 m_stringLength
從這里看到, 如果要從HttpContext上面dump Http 請(qǐng)求的地址, 需要執(zhí)行4次!do指令. 同時(shí)還要去找到其他的對(duì)象, 那么還需要更多的步驟. 如果需要檢查多個(gè)HttpContext上面相同的這些字段內(nèi)容, 將是一場(chǎng)噩夢(mèng).
如果這個(gè)事情交給NetExt來(lái)做就相當(dāng)?shù)妮p松, 只要幾個(gè)命令, 一切搞定.
0:014> !wselect _utcTimestamp, _request._httpMethod, _request._url.m_String, _response._statusCode from 00000001956f77a8 [System.Web.HttpContext] System.DateTime _utcTimestamp = -mt 000007FEF0BB96C8 00000001956F78D8 10/26/2011 11:29:15 PM (string)System.String _request._httpMethod = GET (string)System.String _request._url.m_String = http://localhost:2000/Service.svc (int32)System.Int32 _response._statusCode = c8 (0n200)從這個(gè)角度上來(lái)說(shuō), 這絕對(duì)是提高debugging效率的利器.
?
總結(jié)
NetExt針對(duì)debugging的工作做了非常多的優(yōu)化工作.
- 相對(duì)!sos.do, !wdo優(yōu)化了顯示的內(nèi)容, 很多常用的類(lèi)型都將會(huì)直接顯示出具體的內(nèi)容. 并且針對(duì)一些常用的枚舉進(jìn)行了轉(zhuǎn)義, 可以讓我們直接了解到枚舉的值所代表的意義.
- !wdo針對(duì)數(shù)組的顯示進(jìn)行了相當(dāng)多的優(yōu)化
- !wselect同樣是dump object的利器. 如果我們岙DUMP的object藏在很深的路徑下, 它能夠幫助我們介紹很多時(shí)間和工作量.
?
Sonic Guo
轉(zhuǎn)載于:https://www.cnblogs.com/developersupport/p/Debugging-NetExt-Dump-Object.html
與50位技術(shù)專(zhuān)家面對(duì)面20年技術(shù)見(jiàn)證,附贈(zèng)技術(shù)全景圖總結(jié)
以上是生活随笔為你收集整理的Windbg Extension NetExt 使用指南 【2】 ---- NetExt 的基本命令介绍的全部?jī)?nèi)容,希望文章能夠幫你解決所遇到的問(wèn)題。
- 上一篇: BZOJ3163 [Heoi2013]E
- 下一篇: linux源码阅读笔记 fork函