powerdbg Wiki & Documentation Rss Feed

Updated Wiki: Invoke-DbgCommand

piers7 — Mon, 15 Nov 2010 16:17:34 GMT

Invoke-DbgCommand

Allows invoking arbitary debugger commands. This can be used to access functionality that has not been exposed with its own CmdLet, or to access the raw textual output of a command (where the cmdlet doesn't support the -raw switch)

This cmdlet is aliased 'idc'

Example

PowerDbg 0:000> Load-DbgExtension sos mscorwks
PowerDbg 0:000> Invoke-DbgCommand !help
-------------------------------------------------------------------------------
SOS is a debugger extension DLL designed to aid in the debugging of managed
programs. Functions are listed by category, then roughly in order of
importance. Shortcut names for popular functions are listed in parenthesis.
Type "!help <functionname>" for detailed info on that function.

Object Inspection                  Examining code and stacks
-----------------------------      -----------------------------
DumpObj (do)                       Threads
DumpArray (da)                     CLRStack
...

Notes

Command output is returned to the pipeline as a collection of strings, one per line
The cmdlet returns control when the command completes in the debugger (ie the next command prompt is read). If you issue a command that will never return (eg 'g' in the case of a process that subsiquently does not fail, and you have no breakpoints setup), PowerDbg will never return control to the prompt.
Debugger commands that prompt for user input should be avoided.

Updated Wiki: Home

piers7 — Mon, 15 Nov 2010 16:08:20 GMT

PowerDbg is a PowerShell library that enables you to easily create PowerShell scripts to automate a WinDbg / CDB debugging session. You can use PowerDbg for Kernel Mode or User Mode, Post-Mortem debugging or Live Debugging and for native or managed code.

PowerShell has several advantages over the WinDbg Scripting Language. A few of them are:

- Easier to create scripts
- Leverage the .NET Framework
- Debugging and tracing features
- Code reuse through functions and cmdlets
- Easier maintenance
- Easier to build large scripts
- Easier to format and display the important information

Whether you’re an old hand frustrated with WinDbg scripting, or you’re having your ‘first memory dump’ freak-out, PowerDbg is for you. And hopefully for everyone in the middle too.

News

Version 6 should run all Version 5 scripts without too much (any?) modifications, but that’s one of the things we’ll be testing during the alpha period. If you find any problems, shout.

Version 5 is still available.

Updated Wiki: New-DbgSession

piers7 — Mon, 15 Nov 2010 16:05:44 GMT

New-DbgSession

To use PowerDbg you must first establish a ‘session’. This establishes PowerDbg’s internal connection between a local debugger and either a memory dump, live process or remote debugger.

Sessions are established using the New-DbgSession cmdlet, and can be instantiated in one of four ways:
- attach to a running process by name (-process)
- launch a process under the debugger (-command)
- opening a memory dump in the debugger (-dump)
- connecting to an existing debugger configured as a server (-remote)

Additionally PowerDbg can be instructed to auto-load SOS (if possible), using the -sos parameter. This can only be performed if the process in question has already loaded the CLR, and so is not applicable to the -command method.

Example

The PowerDbg 'unhandled exception' demo can be run under the debugger as follows (note the quotes which allow us to pass an argument to the process being launched):

PS > New-DbgSession -command '.\blah\ManagedScenarios.exe UnhandledExceptionScenario'
PS > Send-DbgGo
...
(1104.730): CLR exception - code e0434f4d (first chance)
(1104.730): CLR exception - code e0434f4d (!!! second chance !!!)
KERNELBASE!RaiseException+0x39:
000007fe`fdedaa7d 4881c4c8000000  add     rsp,0C8h
PS >

Since the the debugger immediately breaks into the launched process, we have to use Send-DbgGo to allow the process to continue on (and subsiquently fail). When creating a session to a memory dump or a remote debugger already halted at the point of interest, this would be unnecessary.

Once a PowerDbg session exists you can interact with it using any of the Get-Dbg* cmdlets, or by using Invoke-DbgCommand to send commands directly.

Notes

Each PowerShell window running PowerDbg can only support one such session at a time
The session is automatically terminated when the PowerDbg module is unloaded (Remove-Module PowerDbg)
The debugger is attached invasively, and so the debuggee will terminate when the session is ended

Updated Wiki: New-DbgSession

piers7 — Mon, 15 Nov 2010 16:04:37 GMT

New-DbgSession

Example

The PowerDbg 'unhandled exception' demo can be run under the debugger as follows (note the quotes which allow us to pass an argument to the process being launched):

PS > New-DbgSession -command 'C:\dev\PowerDbg\dev\src\Scenarios\ManagedScenarios\bin\Debug\ManagedScenarios.exe UnhandledExceptionScenario'
PS > Send-DbgGo
...
(1104.730): CLR exception - code e0434f4d (first chance)
(1104.730): CLR exception - code e0434f4d (!!! second chance !!!)
KERNELBASE!RaiseException+0x39:
000007fe`fdedaa7d 4881c4c8000000  add     rsp,0C8h
PS >

Notes

Each PowerShell window running PowerDbg can only support one such session at a time
The session is automatically terminated when the PowerDbg module is unloaded (Remove-Module PowerDbg)
The debugger is attached invasively, and so the debuggee will terminate when the session is ended

Updated Wiki: Load-DbgExtension

piers7 — Mon, 15 Nov 2010 16:01:54 GMT

Load-DbgExtension

Loads a debugger extension into the debugger. Having the SOS extension loaded is essential for any PowerDbg commands that work with managed objects.
This is the equivilent of the debugger's .load and .loadby commands.

Examples

Loading an extension based on the location of a module loaded in the process (.loadby):

> Load-DbgExtension sos mscorwks
> Invoke-DbgCommand !help

Loading an extension from the debugger's program directory or fully qualified path (.load):

> Load-DbgExtension sosex
> Load-DbgExtension C:\psscor2\amd64\psscor2.dll
> Invoke-DbgCommand !help

Notes

You can use Get-DbgModules to check which modules are loaded before executing this
Using the -sos parameter on New-DbgSession will auto-load SOS for you, if the process has the CLR loaded. This already accounts for module name differences between .Net 2 processes (mscorwks) and .Net 4 processes (CLR)
Invoke-DebuggerCommand .chain will show all loaded debugger extensions
Copying debugger extensions other than SOS (like SOSEX) to the matching debugger folder for the bittyness of the extension will save time

Updated Wiki: Load-DbgExtension

piers7 — Mon, 15 Nov 2010 16:01:30 GMT

Load-DbgExtension

Examples

Loading an extension based on the location of a module loaded in the process (.loadby):

> Load-DbgExtension sos mscorwks
> Invoke-DbgCommand !help

Loading an extension from the debugger's program directory or fully qualified path (.load):

> Load-DbgExtension sosex
> Load-DbgExtension C:\psscor2\amd64\psscor2.dll
> Invoke-DbgCommand !help

Notes

You can use Get-DbgModules to check which modules are loaded before executing this
Using the -sos parameter on New-DbgSession will auto-load SOS for you, if the process has the CLR loaded. This already accounts for module name differences between .Net 2 processes (mscorwks) and .Net 4 processes (CLR)
Invoke-DebuggerCommand .chain will show all loaded debugger extensions
Copying debugger extensions other than SOS (like SOSEX) to the matching debugger folder for the bittyness of the extension will save time

Updated Wiki: New-DbgSession

piers7 — Mon, 15 Nov 2010 15:47:53 GMT

New-DbgSession

To use PowerDbg you must first establish a ‘session’. This establishes PowerDbg’s internal connection between a local debugger and either a memory dump, live process or remote debugger.

Sessions are established using the New-DbgSession cmdlet, and can be instantiated in one of four ways:
- attach to a running process by name (-process)
- launch a process under the debugger (-command)
- opening a memory dump in the debugger (-dump)
- connecting to an existing debugger configured as a server (-remote)

For example, the PowerDbg 'unhandled exception' demo can be run under the debugger as follows (note the quotes which allow us to pass an argument to the process being launched):

PS > New-DbgSession -command 'C:\dev\PowerDbg\dev\src\Scenarios\ManagedScenarios\bin\Debug\ManagedScenarios.exe UnhandledExceptionScenario'
PS > Send-DbgGo
...
(1104.730): CLR exception - code e0434f4d (first chance)
(1104.730): CLR exception - code e0434f4d (!!! second chance !!!)
KERNELBASE!RaiseException+0x39:
000007fe`fdedaa7d 4881c4c8000000  add     rsp,0C8h
PS >

Each PowerShell window running PowerDbg can only support one such session at a time
The session is automatically terminated when the PowerDbg module is unloaded (Remove-Module PowerDbg)
The debugger is attached invasively, and so the debuggee will terminate when the session is ended

Updated Wiki: New-DbgSession

piers7 — Mon, 15 Nov 2010 15:43:55 GMT

To use PowerDbg you must first establish a ‘session’. This establishes PowerDbg’s internal connection between a local debugger and either a memory dump, live process or remote debugger.

Sessions are established using the New-DbgSession cmdlet, and can be instantiated in one of three ways:
- connecting to an existing debugger configured as a server (-remote)
- opening a memory dump in the debugger (-dump)
- launching a process under the debugger (-command)

For example, the PowerDbg 'unhandled exception' demo can be run under the debugger as follows:

PS > New-DbgSession -command 'C:\dev\PowerDbg\dev\src\Scenarios\ManagedScenarios\bin\Debug\ManagedScenarios.exe UnhandledExceptionScenario'
PS > Send-DbgGo
...
(1104.730): CLR exception - code e0434f4d (first chance)
(1104.730): CLR exception - code e0434f4d (!!! second chance !!!)
KERNELBASE!RaiseException+0x39:
000007fe`fdedaa7d 4881c4c8000000  add     rsp,0C8h
PS >

(Note the quotes which allow us to pass an argument to the process being launched)

Since the the debugger immediately breaks into the launched process, we have to use Send-DbgGo to allow the process to continue on (and subsiquently fail). When creating a session to a memory dump or a remote debugger already halted at the point of interest, this would be unnecessary.

Once a PowerDbg session exists you can interact with it using any of the Get-Dbg* cmdlets, or by using Invoke-DbgCommand to send commands directly.

Note the following:

Each PowerShell window running PowerDbg can only support one such session at a time
The session is automatically terminated when the PowerDbg module is unloaded (Remove-Module PowerDbg)
The debugger is attached invasively, and so the debuggee will terminate when the session is ended

Updated Wiki: Documentation

piers7 — Mon, 15 Nov 2010 15:29:14 GMT

Current Release

The current release of PowerDbg is Version 6.
This is currently in alpha status whilst we attempt to determine what bugs / missing features need to be fixed before a release is worth doing.

Getting Started

Download and Setup PowerDbg
Establish a PowerDbg Session
Use the commands below to explore your process

Commands

Session Management
New-DbgSession	Establishes a PowerDbg session with the debugger
Exit-DbgSession	Terminates the current PowerDbg session
Load-DbgExtension	Loads a debugger extension into to the active session
Invoke-DbgCommand	Executes an arbitrary command against the debugger
Exploration
Get-DbgArray	Expands the contents of a managed array
Get-DbgClrHeap	Locate objects on the managed heap by type or MT
Get-DbgDictionaryContents	Enumerate Dictionary<T,T> collections
Get-DbgListContents	Enumerate List<T> collections
Get-DbgObject	Views the contents of a reference-type object
Get-DbgValueClass	Views the contents of a value-type object
Process State
Get-DbgClrThreads	Lists managed threads
Get-DbgComState	View the COM apartment state associated with each thread
Get-DbgModules	Lists modules loaded into the process
Get-DbgRunaway	View the kernel and user time associated with each thread
Analysis
Analyze-PowerDbgThreads
Misc
Start-DebuggerOnly	Launches a debugger without creating a PowerDbg session
Get-DbgHangDump	Takes an immediate full minidump of a given process

Previous Releases

Version 5

Updated Wiki: Documentation

piers7 — Mon, 15 Nov 2010 15:26:09 GMT

Current Release

The current release of PowerDbg is Version 6.
This is currently in alpha status whilst we attempt to determine what bugs / missing features need to be fixed before a release is worth doing.

Getting Started Guides

Download and Setup PowerDbg
Establishing your first PowerDbg ‘session’

Commands

Session Management
New-DbgSession	Establishes a PowerDbg session with the debugger
Exit-DbgSession	Terminates the current PowerDbg session
Load-DbgExtension	Loads a debugger extension into to the active session
Invoke-DbgCommand	Executes an arbitrary command against the debugger
Exploration
Get-DbgArray	Expands the contents of a managed array
Get-DbgClrHeap	Locate objects on the managed heap by type or MT
Get-DbgDictionaryContents	Enumerate Dictionary<T,T> collections
Get-DbgListContents	Enumerate List<T> collections
Get-DbgObject	Views the contents of a reference-type object
Get-DbgValueClass	Views the contents of a value-type object
Process State
Get-DbgClrThreads	Lists managed threads
Get-DbgComState	View the COM apartment state associated with each thread
Get-DbgModules	Lists modules loaded into the process
Get-DbgRunaway	View the kernel and user time associated with each thread
Analysis
Analyze-PowerDbgThreads
Misc
Start-DebuggerOnly	Launches a debugger without creating a PowerDbg session
Get-DbgHangDump	Takes an immediate full minidump of a given process

Previous Releases

Version 5

Updated Wiki: Home

piers7 — Mon, 15 Nov 2010 15:03:40 GMT

Whether you’re an old hand frustrated with WinDbg scripting, or you’re having your ‘first memory dump’ freak-out, PowerDbg is for you. And hopefully for everyone in the middle too.

News

Version 6 should run all Version 5 scripts without too much (any?) modifications, but that’s one of the things we’ll be testing during the alpha period. If you find any problems, shout.

Version 5 is still available.

Updated Wiki: Home

piers7 — Mon, 15 Nov 2010 15:00:43 GMT

Whether you’re an old hand frustrated with WinDbg scripting, or you’re having your ‘first memory dump’ freak-out, PowerDbg is for you. And hopefully for everyone in the middle too.

News

Version 6 has been released as alpha. This is a really exciting release that makes it even easier to write scripts or otherwise just hack around against the debugger, and includes the PowerDbgConsole, a bootstrapper designed to make setting up an interactive PowerDbg debugging session a one-liner. Its faster, easier to use and has full 64 bit support. Download it now.

Version 6 should run all Version 5 scripts without too much (any?) modifications, but that’s one of the things we’ll be testing during the alpha period. If you find any problems, shout.

Version 5 is still available.

Updated Wiki: Version 6

piers7 — Mon, 15 Nov 2010 14:59:18 GMT

PowerDbg Version 6

With this release we're really focusing on making PowerDbg (and by extension WinDbg) as easy to use as possible, whilst at the same time enabling a much richer debugging experience that really leverages the power of PowerShell.

Status

Alpha
Grab the 6.10.10.10 release from Downloads, or grab a 'bleeding edge' build from source control under .\dev\out\Modules

New Features

Wherever possible we now returned structured (PSObject) data from commands, that can be filtered, pilelined etc... The CSV file is depricated. The raw output from a command can always be retrieved with the -raw switch.
Cmdlet aliases to reflect the WinDbg experience as closely as possible
Both 32 and 64 bit support for implemented cmdlets (nb: WOW64 not supported this release)
Bundled sample debugging scenarios, that can be built and used for training purposes (these actually form the basis of our integration tests)
PowerDbgConsole - provides a really easy way to get a PowerDbg session up and running against a process or an existing memory dump. Optional whether WinDbg UI is shown (remote mode) or whether whole session runs against (hidden) CDB process.
(TODO) Caching when debugging against a dump, so re-executing the same command is much faster.

We've also now got a 'build' process that makes it easier for us to develop new commands, but that's more a housekeeping thing.

Backwards Compatibility

It's the intent that all existing v5 scripts should still run as-is. This will need testing however...

CmdLet Naming

After a bit of tooing and fro-ing over this we are going to genuinely PowerShell-ize the cmdlet names (so !dumpobject = Get-DbgObject, !threads = Get-DbgClrThreads). As much as anything there is considerable advantage in being able to type 'help *Dgb' and see all the cmdlets that we've exposed.
The cmdlet names will still reflect (as much as possible) the underlying SOS / PSSCOR2 command names, in many cases just with the 'dump' prefix stripped off.

Internal functions (not exposed on the module interface) will tend to reflect more the name of the WinDBG command / extension that they are operating with. For example Get-DbgObject uses a function called Parse-DumpObject, Get-DbgArray uses Parse-DumpArray

Commands

(get-command -module WinDbg)

Anything without a hyperlink is proposed and has not been implemented. This list may change, and reflects us doing our laundry in public.

Basic commands

These map 1:1 with an underlying WinDbg / SOS command, and will typically have an alias that matches the original WinDbg command.

CmdLet	SOS command
Get-DbgArray	!dumparray
Get-DbgClrHeap	!dumpheap
Get-DbgClrThreads	!clrthreads
Get-DbgComState	!comstate
Get-DbgModules	lm k
Get-DbgObject	!dumpobject
Get-DbgValueClass	!dumpvc
Get-DbgRunaway	!runaway
Get-DbgStackObjects	!dumpstackobjects
Get-DbgSyncBlocks	!synkblk
Get-DbgMethodDesc	!dumpmd
Get-DbgMethodTable	!dumpmt
Get-DbgException	!printexception
Get-DbgObjectSize	!objsize

Composite Commands

These combine multiple debugger commands to save time and facilitate analysis.

CmdLet	Description
Get-DbgDictionaryContents was Dump-Dictionary	Gets the objects contained in a managed dictionary, by traversing the backing array
Get-DbgListContents	Gets the objects contained in a managed List<T>, by traversing the backing array
* Get-DbgThreadAnalysis	Provides more detail on thread activity, including CPU time, locks held, COM apartment model and current state

Updated Wiki: Get-DbgDictionaryContents

piers7 — Mon, 15 Nov 2010 14:58:37 GMT

Get-DbgDictionaryContents

Dumps the contents of a dictionary as a key,value list of addresses.

This is a 'higher level' function that consists of extracting the address for the dictionary's backing array, traversing the array contents to extract the individual dictionary entries and extracting the key and value addresses, all of which would otherwise be done 'by hand'.

PowerDbg > $types = Get-DbgClrHeap -type Dictionary
PowerDbg > $values = ($types[0].instances | % { Get-DbgDictionaryContents $_.Address })
PowerDbg > $values

key                                                         value
---                                                         -----
000000000275d7f8                                            000000000275e948
000000000275d820                                            000000000275e968


PowerDbg > $values | % { $_.key } | Get-DbgObject

__Fields        : {System.Object, System.Object, System.Object, System.Object...}
__Name          : System.String
__MethodTable   : 000007fee876ec90
__EEClass       : 000007fee837b038
__Size          : 36(0x24) bytes
__String        : Test1
m_arrayLength   : 6
m_stringLength  : 5
m_firstChar     : 54
Empty           : static
WhitespaceChars : static

__Fields        : {System.Object, System.Object, System.Object, System.Object...}
__Name          : System.String
__MethodTable   : 000007fee876ec90
__EEClass       : 000007fee837b038
__Size          : 36(0x24) bytes
__String        : Test2
m_arrayLength   : 6
m_stringLength  : 5
m_firstChar     : 54
Empty           : static
WhitespaceChars : static

PowerDbg > $values | % { $_.key } | Get-DbgObject | % { $_.__String }
Test1
Test2

In a future release we will probably auto-expand the key and value addresses, and possibly even detect string keys and expand them all the way to the string literal.

Updated Wiki: Get-DbgObject

piers7 — Mon, 15 Nov 2010 14:56:33 GMT

Get-DbgObject

Equivilent to !dumpobject

This cmdlet returns the information about a reference-type object at a given address as a synthetic powershell object that mimics the original object's structure:

PowerDbg > Get-DbgObject 000000000275e948

__Fields                         : {System.Object, System.Object, System.Object}
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

For comparison, the original object structure was as follows:

        private string _privateStringField;
        public int IntAutoProperty { get; set; }
        public bool Enabled;    // Public field

You can see that the fields in the original object have been converted into properties on the returned object (the strange naming for IntAutoProperty being the result of the C# compiler's naming convention for auto-generated property backing fields).

Instance-level metadata is retained in the double-underscore properties you see above (MethodTable, EEClass etc...), and the per-field metadata that you see in !dumpobject output can be accessed via the Fields collection.

PowerDbg > $obj.__Fields | format-table

MT        Field     Offset    Type      VT        Attr      Value     Name
--        -----     ------    ----      --        ----      -----     ----
000007... 4000001   8         System... 0         instance  000000... _priva...
000007... 4000002   14        System... 1         instance  1         Enabled
000007... 4000003   10        System... 1         instance  1         <IntAu...

The cmdlet takes either the object address (as a parameter) or can accept pipeline input of either addresses or objects with an 'Address' property. This makes it easy to pipe the output from other commands to dump-object, for example thet output from dump-heap:

PowerDbg > $type = Get-DbgClrHeap -type ManagedScenarios.ADataStructure | ? { $_.ClassName -eq 'ManagedScenarios.ADataStructure' }
PowerDbg > $type.Instances | format-table -AutoSize

Address          MT               Size ClassName
-------          --               ---- ---------
000000000275e948 000007ff000549e8 32   ManagedScenarios.ADataStructure
000000000275e968 000007ff000549e8 32   ManagedScenarios.ADataStructure

PowerDbg > $type.Instances | Get-DbgObject | format-table

__Fields     __Name       __MethodTabl __EEClass    __Size      _privateStr Enabled     <IntAutoPro
                          e                                     ingField                perty>k__Ba
                                                                                        ckingField
--------     ------       ------------ ---------    ------      ----------- -------     -----------
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 1           1
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 0           2

Since the output from Get-DbgObject is, itself, a pipeline object, you can filter on it using normal powershell operations. This makes ripping through large arrays, dictionaries etc... looking for specific things much easier. A trivial example from the above - filtering on the Enabled property of the original object:

PowerDbg > $type.Instances | Get-DbgObject | ? { $_.Enabled -eq 1 }

__Fields                         : {System.Object, System.Object, System.Object}
__Name                           : ManagedScenarios.ADataStructure
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

Updated Wiki: Get-DbgObject

piers7 — Mon, 15 Nov 2010 14:55:46 GMT

Get-DbgObject

Equivilent to !dumpobject

This cmdlet returns the information about a class-type object at a given address as a synthetic powershell object that mimics the original object's structure:

PowerDbg > Get-DbgObject 000000000275e948

__Fields                         : {System.Object, System.Object, System.Object}
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

For comparison, the original object structure was as follows:

        private string _privateStringField;
        public int IntAutoProperty { get; set; }
        public bool Enabled;    // Public field

PowerDbg > $obj.__Fields | format-table

MT        Field     Offset    Type      VT        Attr      Value     Name
--        -----     ------    ----      --        ----      -----     ----
000007... 4000001   8         System... 0         instance  000000... _priva...
000007... 4000002   14        System... 1         instance  1         Enabled
000007... 4000003   10        System... 1         instance  1         <IntAu...

PowerDbg > $type = Get-DbgClrHeap -type ManagedScenarios.ADataStructure | ? { $_.ClassName -eq 'ManagedScenarios.ADataStructure' }
PowerDbg > $type.Instances | format-table -AutoSize

Address          MT               Size ClassName
-------          --               ---- ---------
000000000275e948 000007ff000549e8 32   ManagedScenarios.ADataStructure
000000000275e968 000007ff000549e8 32   ManagedScenarios.ADataStructure

PowerDbg > $type.Instances | Get-DbgObject | format-table

__Fields     __Name       __MethodTabl __EEClass    __Size      _privateStr Enabled     <IntAutoPro
                          e                                     ingField                perty>k__Ba
                                                                                        ckingField
--------     ------       ------------ ---------    ------      ----------- -------     -----------
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 1           1
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 0           2

PowerDbg > $type.Instances | Get-DbgObject | ? { $_.Enabled -eq 1 }

__Fields                         : {System.Object, System.Object, System.Object}
__Name                           : ManagedScenarios.ADataStructure
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

Updated Wiki: Get-DbgClrThreads

piers7 — Mon, 15 Nov 2010 14:53:54 GMT

Get-DbgClrThreads

Equivilent to !threads

Provides a list of the managed threads in the process, as PSObjects. The -live and -special parameters of the underlying SOS command are supported.

Example: Viewing the Exception For A Thread

One of the things that !threads reports is the address of the exception (if any) currently on the stack for each thread. In the case of a crash mode dump for an unhandled exception, that exception is the one that's just about to kill your process. So seeing what the exception actually is is pretty useful.

(In this example the threads are rendered using Format-List (the default) otherwise you don't see the column with the ExceptionAddress in. Piping the output to Out-GridView is what I'd normally recommend)

PowerDbg > Get-DbgClrThreads

DbgID            : 0
ID               : 1
OSID             : 15cc
ThreadOBJ        : 000000000042aff0
State            : a02
GC               : Enabled
GC Alloc Context : 000000000275fea0:000000000275ffd0
Domain           : 00000000003cf120
Lock Count       :
APT              : MTA
Exception        : System.InvalidOperationException (000000000275fd58)
ExceptionAddress : 000000000275fd58

DbgID            : 2
ID               : 2
OSID             : 630
ThreadOBJ        : 0000000000554340
State            : b22
GC               : Enabled
GC Alloc Context : 0000000000000000:0000000000000000
Domain           : 00000000003cf120
Lock Count       :
APT              : MTA
Exception        : (Finalizer)
ExceptionAddress : Finalizer

The first has an exception, so we want to see what the exception message is:

PowerDbg > $ex = (Get-DbgClrThreads)[0].ExceptionAddress | Get-DbgObject
PowerDbg > $ex._message | Get-DbgObject

__Fields        : {System.Object, System.Object, System.Object, System.Object...}
__Name          : System.String
__MethodTable   : 000007fee876ec90
__EEClass       : 000007fee837b038
__Size          : 162(0xa2) bytes
__String        : If you can read this, you're too close! 21:02:49
m_arrayLength   : 69
m_stringLength  : 48
m_firstChar     : 49
Empty           : static
WhitespaceChars : static

Ah. It all makes sense now.

Updated Wiki: Get-DbgClrHeap

piers7 — Mon, 15 Nov 2010 14:51:52 GMT

Get-DbgClrHeap

Equivilent to !dumpheap

Provides information on the contents of the managed heap. Each type on the heap (or matching type if a -type filter specified) is returned as an object with properties for the MethodTable (MT), Count, ClassName etc...

PowerDbg > $types = Get-DbgClrHeap -type Dictionary
PowerDbg > $types

MT               Count ClassName
--               ----- ---------
000007ff00054a70 1     System.Collections.Generic.Dictionary`2[[System.Strin...
000007fee877c290 1     System.Collections.Generic.Dictionary`2[[System.Strin...
000007ff00055f60 1     System.Collections.Generic.Dictionary`2+Entry[[System...
000007fee877cb28 2     System.Collections.Generic.Dictionary`2+Entry[[System...

Each type returned has an Instances property containing the addresses of all the instances of that type:

PowerDbg > $types[3].Instances | format-table -AutoSize

Address          MT               Size ClassName
-------          --               ---- ---------
0000000002716d98 000007fee877cb28 120  System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[Syst...
0000000002732d58 000007fee877cb28 248  System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[Syst...

The entries within the Instances list can be piped directly to Get-DbgObject, or passed as the parameter to Get-DbgDictionaryContents

PowerDbg > $types[3].Instances | Get-DbgObject

__Fields      : {}
__Name        : System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[System.Resources.ResourceLocat
                or, mscorlib]][]
__MethodTable : 000007fee877cb28
__EEClass     : 000007fee8421650
__Size        : 120(0x78) bytes
__Array       : Rank 1, Number of elements 3, Type VALUETYPE

__Fields      : {}
__Name        : System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[System.Resources.ResourceLocat
                or, mscorlib]][]
__MethodTable : 000007fee877cb28
__EEClass     : 000007fee8421650
__Size        : 248(0xf8) bytes
__Array       : Rank 1, Number of elements 7, Type VALUETYPE

Finding the Right Type

Since the -type parameter is a simple string match, you will often get back a list of more types than you expect. In the example above, matching on Dictionary also brought back the internal helper classes that a Dictionary object uses.

The simplest way of locating exactly the type you are looking for is, unfortunately, to just eyeball the items after piping to Format-List. If you need to do so programatically, crafting the right regex to further constrain the set based on the ClassName property is possible. In the following example I match a dictionary with a particular generic param, and I explicitly exclude the nested helper class:

PowerDbg > $type = $types | ? { ($_.ClassName -match 'AData') -and -not ($_.ClassName -match '\+Entry') }
PowerDbg > $type

MT         : 000007ff00054a70
Count      : 1
TotalSize  : 88
Class Name : System.Collections.Generic.Dictionary`2[[System.String, mscorlib],
             [ManagedScenarios.ADataStructure, ManagedScenarios]]
Instances  : {System.Object}
ClassName  : System.Collections.Generic.Dictionary`2[[System.String, mscorlib],
             [ManagedScenarios.ADataStructure, ManagedScenarios]]

In a future release we may well expose the generic parameters as properties on the type object, which would make filtering much easier.

Updated Wiki: Home

piers7 — Mon, 15 Nov 2010 14:48:12 GMT

Whether you’re an old hand frustrated with WinDbg scripting, or you’re having your ‘first memory dump’ freak-out, PowerDbg is for you. And hopefully for everyone in the middle too.

News

Version 5 is still available.

Updated Wiki: Documentation

piers7 — Mon, 15 Nov 2010 14:46:26 GMT

Current Release

The current release of PowerDbg is Version 6.
This is currently in alpha status whilst we attempt to determine what bugs / missing features need to be fixed before a release is worth doing.

Getting Started

Download and Setup PowerDbg
Establishing a PowerDbg ‘session’

Commands

Session Management

New-DbgSession
Exit-DbgSession
Load-DbgExtension
Invoke-DbgCommand

Exploration

Process State

Get-DbgClrThreads
Get-DbgComState
Get-DbgModules
Get-DbgRunaway

Analysis

Analyze-PowerDbgThreads

Misc

Start-DebuggerOnly
Get-DbgHangDump

Previous Releases

Version 5