Get-DbgObject

Equivilent to !dumpobject

This cmdlet returns the information about a reference-type object at a given address as a synthetic powershell object that mimics the original object's structure:

PowerDbg > Get-DbgObject 000000000275e948

__Fields                         : {System.Object, System.Object, System.Object}
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

For comparison, the original object structure was as follows:

        private string _privateStringField;
        public int IntAutoProperty { get; set; }
        public bool Enabled;    // Public field


You can see that the fields in the original object have been converted into properties on the returned object (the strange naming for IntAutoProperty being the result of the C# compiler's naming convention for auto-generated property backing fields).

Instance-level metadata is retained in the double-underscore properties you see above (MethodTable, EEClass etc...), and the per-field metadata that you see in !dumpobject output can be accessed via the Fields collection.

PowerDbg > $obj.__Fields | format-table

MT        Field     Offset    Type      VT        Attr      Value     Name
--        -----     ------    ----      --        ----      -----     ----
000007... 4000001   8         System... 0         instance  000000... _priva...
000007... 4000002   14        System... 1         instance  1         Enabled
000007... 4000003   10        System... 1         instance  1         <IntAu...

The cmdlet takes either the object address (as a parameter) or can accept pipeline input of either addresses or objects with an 'Address' property. This makes it easy to pipe the output from other commands to dump-object, for example thet output from dump-heap:

PowerDbg > $type = Get-DbgClrHeap -type ManagedScenarios.ADataStructure | ? { $_.ClassName -eq 'ManagedScenarios.ADataStructure' }
PowerDbg > $type.Instances | format-table -AutoSize

Address          MT               Size ClassName
-------          --               ---- ---------
000000000275e948 000007ff000549e8 32   ManagedScenarios.ADataStructure
000000000275e968 000007ff000549e8 32   ManagedScenarios.ADataStructure

PowerDbg > $type.Instances | Get-DbgObject | format-table

__Fields     __Name       __MethodTabl __EEClass    __Size      _privateStr Enabled     <IntAutoPro
                          e                                     ingField                perty>k__Ba
                                                                                        ckingField
--------     ------       ------------ ---------    ------      ----------- -------     -----------
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 1           1
{System.O... ManagedSc... 000007ff0... 000007ff0... 32(0x20)... 00000000... 0           2

Since the output from Get-DbgObject is, itself, a pipeline object, you can filter on it using normal powershell operations. This makes ripping through large arrays, dictionaries etc... looking for specific things much easier. A trivial example from the above - filtering on the Enabled property of the original object:

PowerDbg > $type.Instances | Get-DbgObject | ? { $_.Enabled -eq 1 }

__Fields                         : {System.Object, System.Object, System.Object}
__Name                           : ManagedScenarios.ADataStructure
__MethodTable                    : 000007ff000549e8
__EEClass                        : 000007ff00193610
__Size                           : 32(0x20) bytes
_privateStringField              : 000000000275d7f8
Enabled                          : 1
<IntAutoProperty>k__BackingField : 1

Last edited Nov 15, 2010 at 2:56 PM by piers7, version 2

Comments

No comments yet.