PowerDbg - Automated Debugging using WinDbg and PowerShell

Closed Feature: Provide command outputs as pipeline objects [26930]

piers7 — Thu, 16 May 2013 08:16:58 GMT

Currently PowerDBG caches command outputs on a global variable, which can be used by various of the Parse... methods.

Instead PowerDBG should parse the command outputs inline, and output pipeline objects that can be further filtered and pipelined. The output from !do should look a lot like the original object, for example.

Where this is not appropriate, the command text should be passed to the pipeline instead

Closed Feature: Auto-detect location of Debugging Tools [26986]

piers7 — Thu, 16 May 2013 08:16:58 GMT

Currently PowerDBG ships with a hard-coded default location for the debugging tools, that suits internal Microsoft usage.
Instead this path should be auto-detected, where possible, with the ability to explicitly specify the debugging location via a parameter when needed.

Closed Task: Need a better structure for integration tests [27214]

piers7 — Thu, 16 May 2013 08:16:58 GMT

Structure for unit tests is pretty good, but the 'RunTests.ps1' that has all the integration tests in there is starting to look pretty messy. This needs splitting up / factoring out etc...

Closed Issue: Get-DbgClrHeap fails on 32 bit [28870]

piers7 — Thu, 16 May 2013 08:16:57 GMT

Needs regex patterns updated or modified to cope with different SOS output
Needs unit tests to be split between 32 bit and 64 bit output formats

Closed Issue: Get-DbgRunaway fails on 32 bit [28871]

piers7 — Thu, 16 May 2013 08:16:57 GMT

Needs regex patterns updated or modified to cope with different SOS output
Needs unit tests to be split between 32 bit and 64 bit output formats

Created Issue: No support for Load-DbgExtension sos clr [33211]

manukahn — Wed, 10 Oct 2012 12:06:42 GMT

When running on windows 8 it is not possible to load the sos or any other extension using the clr switch. There is no alternative but to put the full path of the framework (i.e. C:\Windows\Microsoft.NET\Framework\v4.0.30319)

New Post: Support for windows 8 and WDK in PowerDbg

manukahn — Wed, 10 Oct 2012 11:44:07 GMT

In windows 8 debugging tools for windows comes in a new form called WDK.

The home directory of the good old tools is now : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64 (for the 64 bit version) and C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86 (for the 32 bit version)Unfortunately the PowerDbg module does not know that.

When loading the module it looks for the home directory of "debugging tools for windows" and put it in a global variable. ($debuggerRoot)

We have to change the module file and add the correct directories.

So open the module file (PowerDbg.psm1) and change the function Get-DbgToolsLocation (line 428) so serach path will include the correct folders:

$searchPaths = "$env:programfiles\Debugging Tools for Windows (x64)",
"$env:programfiles\Debugging Tools for Windows (x86)",
"$env:programfiles (x86)\Windows Kits\8.0\Debuggers\x64", #windows 8
"$env:programfiles (x86)\Windows Kits\8.0\Debuggers\x86", #windows 8
"C:\debuggers" # for Microsoft internal installs

As we can see from the code PowerDbg works with only one version at a time. (The first folder in the list)
To switch between x64 and x86 we have to change the order of the folder in the list. I think that a parameter should control that. (TBD)

Manu

Source code checked in, #99885

Project Collection Service Accounts — Mon, 01 Oct 2012 21:24:31 GMT

Upgrade: New Version of LabDefaultTemplate.xaml. To upgrade your build definitions, please visit the following link: http://go.microsoft.com/fwlink/?LinkId=254563

Source code checked in, #99884

Project Collection Service Accounts — Mon, 01 Oct 2012 21:16:08 GMT

Checked in by server upgrade

Commented Issue: Bug in dumpobjRegex throws error with Get-DbgObject [32931]

BRiddle — Thu, 12 Jul 2012 20:25:50 GMT

While trying to use Get-DbgObject with recent dumps from .Net v4 taken on WinServer 2008, I hit a number of situations on which Get-DbgObject throws an exception while parsing the return from its "!do" equivalent call. I tracked this to a regex call in "Parse-DumpObject" at line 1527 in the current packaged download. The line sequence reads as follows where the actual exception is thrown on line 1530 based on the parsing of the contents of $line:

# Parse a line using regex
$match = $dumpobjRegex.Match($line)
if(-not ($match.Success)){
Write-Verbose "Failing line $line"
throw "Regex failing on '$line'"
}

In my case, the raw call for my target object address returned a '+' sign in the truncated class type column.

MT Field Offset Type VT Attr Value Name
000007fef8a2d440 4000072 4c System.Boolean 1 instance 0 aborted
000007fef8a2d440 4000073 4d System.boolean 1 instance 0 closeCalled
000007fef0af3608 4000074 8 ...ct+ExceptionQueue 0 instance 0000000000000000 exceptionQueue

The fix I came up with is to edit the declaration for $dumpobjRegex made just prior in the code to the ParseDumpObject function. (This is at line 1446 in the latest full download) and add the "+" sign to the allowable content values for that column.

So the line there from the current release that reads:
\s+(?<Type>[ \.\w,-_\[\]\`]{0,24})? # Type is 20 chars, 4 extra w/sp in .net 4, optional

becomes:

\s+(?<Type>[ \.\+\w,-_\[\]\`]{0,24})? # Type is 20 chars, 4 extra w/sp in .net 4, optional

This resolved this particular problem with Get-DbgObject.
-Bob
Comments: ** Comment from web user: BRiddle **

This is the same issue, but differs from the fix provided in the issue titled "Get-DbgObject fails on a "Socket". The workaround provided in that the fix from that issue had added the plus sign without the escape symbol.

I may be wrong, but from my read of the PowerShell documentation, putting the '+' sign without the escape I used in my "\+" addition does not mean add the plus to the allowable list of characters/sequences; but instead means that the regex should match "repeating instances of the specified pattern". So "\w+" means match repeating patterns of "\w" rather than to allow the plus sign as an escaped, literal character within that match set.

Created Issue: Bug in dumpobjRegex throws error with Get-DbgObject [32931]

BRiddle — Thu, 12 Jul 2012 20:16:38 GMT

New Post: CDB process exited with the error code -1073741502

kbninja13 — Fri, 08 Jun 2012 17:51:01 GMT

Hello Everyone,

first post and am a bit of a noob with powerdbg (but am seriously loving it, i have used windbg for years so automating debugging is pretty fun).

I am seeing some inconsistent behaviour when i am using powerdbg. when i open a powershell console, periodically when i attempt to execute my powerdbg scripts i get the following error returned:

CDB process exited with error code -1073741502
At C:\Users\sbanks\Documents\WindowsPowerShell\Modules\PowerDbg\PowerDbg.psm1:144 char:14
+         throw <<<< "CDB process exited with error code $($SCRIPT:windbgProcess.ExitCode)"
    + CategoryInfo          : OperationStopped: (CDB process exi...ode -1073741502:String) [], RuntimeException
    + FullyQualifiedErrorId : CDB process exited with error code -1073741502

sometimes if i rerun the script it works, but more often than not i need to launch a new powershell in order to run my script.

Is there something i am not doing that is causing this error? or if anyone has encountered this what have they done to work around it? i am considering maybe putting in some conditional logic to launch a new powershell when this occurs but before i do that just wanted to see if others have this issue

Commented Issue: New-DbgSession with -dump option failed. [32553]

geopgin — Thu, 07 Jun 2012 16:13:49 GMT

Very new to PowerDbg...

When I try creating a new debug session as following,
PS C:\> New-DbgSession -dump C:\temp\DUMP417d.dmp

this attemp throwed an exception as below.

Exception calling "Start" with "1" argument(s): "The system cannot find the file specified"
At C:\Users\dchung\Documents\WindowsPowerShell\Modules\PowerDbg\PowerDbg.psm1:540 char:40
+ [System.Diagnostics.Process]::Start <<<< ($startInfo) # nb: returns process handle as function return
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

You cannot call a method on a null-valued expression.
At C:\Users\dchung\Documents\WindowsPowerShell\Modules\PowerDbg\PowerDbg.psm1:238 char:23
+ while($reader.Peek <<<< () -ge 0){ # -1 indicates no chars to be read
+ CategoryInfo : InvalidOperation: (Peek:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Create a PowerDbg session using Connect-Dbg first
At C:\Users\dchung\Documents\WindowsPowerShell\Modules\PowerDbg\PowerDbg.psm1:269 char:14
+ throw <<<< 'Create a PowerDbg session using Connect-Dbg first';
+ CategoryInfo : OperationStopped: (Create a PowerD...nnect-Dbg first:String) [], RuntimeException
+ FullyQualifiedErrorId : Create a PowerDbg session using Connect-Dbg first

Is there anyone successfully created a dump debug session?

thanks in advance
Comments: ** Comment from web user: geopgin **

i corrected this by...

Modifying the Get-DbgToolsLocation() function, specifically the $searchpaths to include the windows kit paths.

"C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86",
"C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64"

What didn't work...

I created a path and included the above dirs, did not work. Had to delete the path before the above worked

Commented Issue: New-DbgSession with -dump option failed. [32553]

geopgin — Thu, 07 Jun 2012 14:37:26 GMT

I'm seing the exact same thing. Are you using the windows 8 toolkit? Did you find a resolution for this issue?

Created Issue: New-DbgSession with -dump option failed. [32553]

jivy210 — Wed, 11 Apr 2012 18:45:05 GMT

Created Issue: Get-DbgObject fails on a "Socket" [32303]

pjank — Thu, 23 Feb 2012 11:39:10 GMT

Example output from 'dumpobj -raw':

Address: 0000000003aafc70
Name: System.Net.Sockets.Socket
MethodTable: 0000064281182c00
EEClass: 0000064281166930
Size: 120(0x78) bytes
(C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll)
Fields:
MT Field Offset Type VT Attr Value Name
0000064278435ed8 40029ef 8 System.Object 0 instance 0000000000000000 m_AcceptQueueOrConnectResult
00000642811854a0 40029f0 10 ...t.SafeCloseSocket 0 instance 0000000003aafd08 m_Handle
000006428112e938 40029f1 18 System.Net.EndPoint 0 instance 0000000003a58ec0 m_RightEndPoint
000006428112e938 40029f2 20 System.Net.EndPoint 0 instance 0000000003d00e68 m_RemoteEndPoint
00000642784357b8 40029f3 68 System.Boolean 1 instance 1 m_IsConnected
00000642784357b8 40029f4 69 System.Boolean 1 instance 0 m_IsDisconnected
00000642784357b8 40029f5 6a System.Boolean 1 instance 1 willBlock
00000642784357b8 40029f6 6b System.Boolean 1 instance 1 willBlockInternal
00000642784357b8 40029f7 6c System.Boolean 1 instance 0 isListening
...
000006428118bc78 40029fd 30 ...s.Socket+CacheSet 0 instance 0000000003d00ee8 m_Caches
...

Current $dumpobjRegex (build 6.10.10.22) doesn't like that "Socket+CacheSet" above and throws a "Regex failing on '$line'" exception.

I've changed line 1446:
\s+(?<Type>[ \.\w,-_\[\]\`]{0,24})? # Type is 20 chars, 4 extra w/sp in .net 4, optional
into:
\s+(?<Type>[ \.\w+,-_\[\]\`]{0,24})? # Type is 20 chars, 4 extra w/sp in .net 4, optional
and it seems, like that helped.

Created Issue: Add Support for Process ID on Running Processes [32259]

JStinebaugh — Tue, 14 Feb 2012 20:00:53 GMT

I work in an area that still has alot of COM applications, which means many instances of dllhost.exe. This module would be extremely useful in a current effort, but can't be used because windbg won't accept -pn dllhost.exe when there are multiple occurrences of the process. It would be nice to have PID support similar to what adplus.vbs provides.

Created Issue: Get-DbgArray ignores -start and -length parameters unless -details [31707]

jkff — Tue, 08 Nov 2011 11:43:40 GMT

This seems a bug to me, as I may be interested in getting just the MT's and addresses of a subset of array elements, without getting their details.

The code for Get-DbgArray only adds "-start" and "-length" in the "elseif ($details)" branch - I think it should be in all three branches.

Created Issue: Parse-DumpHeap should use an ArrayList after all - unusably slow otherwise [31705]

jkff — Tue, 08 Nov 2011 10:54:31 GMT

I'm using PowerDbg to debug a huge and complicated memory leak, and dumpheap takes an eternity (didn't finish in several minutes) to parse an array of 35000 objects from raw windbg output.

When I re-introduced usage of ArrayList in the code, things finished rather quickly (perhaps a minute) and I didn't see anything work wrong, despite the comment in code that usage ArrayList drops NoteProperty's.

Also, I found this post, which may be of help: http://powershell.com/cs/forums/p/5507/8890.aspx

Created Issue: Install.bat does not succeed in XP [31643]

JoeChakra — Thu, 27 Oct 2011 05:53:34 GMT

It is attempting to access %USERPROFILE%\Documents rather than "%USERPROFILE%\My Documents" in Windows XP