Quick tips: Getting detailed info on modules and setting breakpoints on .net

Hello,

Sometimes i have to do live debugging in order to understand what’s going on inside a process. Usually when this happens i need to set breakpoints on specific methods. Let’s say that I what to set a specific breakpoint on a method inside Microsoft.Sharepoint.dll (this is just an example, the same applies to every managed dll).

First thing I do is to list domains using !DumpDomain. The output is somewhat similar to below (I’m interested on modules address and modules names)

Assembly: 000000000018a850 [C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SharePoint\12.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll]

ClassLoader: 0000000007852980

SecurityDescriptor: 000000000230da48

  Module Name

00000642800c2e30 C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SharePoint\12.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll

Assembly: 000000001fd54b50 [C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\48d21411\ee495e7c\App_Browsers.pprtnn5a.dll]

ClassLoader: 00000000684cf630

SecurityDescriptor: 000000000230da48

  Module Name

000006428311a8a8 C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\48d21411\ee495e7c\App_Browsers.pprtnn5a.dll

Now that I know the module address of the module i´m interested in lets dig into the types it defines. To do that use !DumpModule –mt <module address>

The output is similar to the one below

0:000> !DumpModule -mt 00000642800c2e30

Name: C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SharePoint\12.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll

Attributes: PEFile

Assembly: 000000000018a850

LoaderHeap: 0000000000000000

TypeDefToMethodTableMap: 0000064280250020

TypeRefToMethodTableMap: 00000642802568c0

MethodDefToDescMap: 0000064280259028

FieldDefToDescMap: 0000064280291958

MemberRefToDescMap: 0000064280302c18

FileReferencesMap: 00000642803108c8

AssemblyReferencesMap: 00000642803108d0

MetaData start address: 000000000af87fac (6417184 bytes)

Types defined in this module

              MT TypeDef Name

------------------------------------------------------------------------------

0000064280cd64c0 0x02000002 DotfuscatorAttribute

0000064280cd6600 0x02000003 Microsoft.SharePoint.CoreResource

00000642808e4640 0x02000004 Microsoft.SharePoint.Library.SPRequest

00000642809ff400 0x02000005 Microsoft.SharePoint.Library.SPCharArray

0000064280cd67c0 0x02000006 Microsoft.SharePoint.DirectorySoap.SPDirectoryManagementProxy

0000064280cd6980 0x02000007 Microsoft.SharePoint.DirectorySoap.ContactFlags

0000064280cd6b00 0x02000008 Microsoft.SharePoint.DirectorySoap.RequestStatus

0000064280cd6d40 0x02000009 Microsoft.SharePoint.DirectorySoap.RequestInfo

0000064280cd6f00 0x0200000a Microsoft.SharePoint.DirectorySoap.RequestResponse

0000064280cd7000 0x0200000b Microsoft.SharePoint.DirectorySoap.DistributionGroupFlags

(…)

Types referenced in this module

              MT TypeRef Name

------------------------------------------------------------------------------

00000642788c0cd8 0x01000011 System.Object

000006424bb22900 0x01000012 System.Web.Services.Protocols.SoapHttpClientProtocol

00000642788c10b8 0x01000013 System.Enum

00000642bcf23248 0x01000014 System.Web.SiteMapProvider

00000642bcf7b298 0x01000015 System.Web.UI.IHierarchicalDataSource

(…)

Now let’s say i´m interested on type Microsoft.SharePoint.DirectorySoap.RequestInfo. To list all methods use !DumpMT –md <mt address>

0:000> !DumpMT -md 0000064280cd6d40

EEClass: 0000064280d01848

Module: 00000642800c2e30

Name: Microsoft.SharePoint.DirectorySoap.RequestInfo

mdToken: 02000009 (C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SharePoint\12.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll)

BaseSize: 0x30

ComponentSize: 0x0

Number of IFaces in IFaceMap: 0

Slots in VTable: 11

--------------------------------------

MethodDesc Table

           Entry MethodDesc JIT Name

000006427809f660 0000064278930388 PreJIT System.Object.ToString()

000006427809dc60 0000064278930390 PreJIT System.Object.Equals(System.Object)

000006427809dc90 00000642789303a8 PreJIT System.Object.GetHashCode()

0000064278092ca0 00000642789303b0 PreJIT System.Object.Finalize()

0000064280ce12f0 0000064280cd6c90 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.get_RequestorEmail()

0000064280ce12f8 0000064280cd6c98 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.set_RequestorEmail(System.String)

0000064280ce1300 0000064280cd6ca0 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.get_Justification()

0000064280ce1308 0000064280cd6ca8 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.set_Justification(System.String)

0000064280ce1310 0000064280cd6cb0 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.get_RequestId()

0000064280ce1318 0000064280cd6cb8 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo.set_RequestId(System.Guid)

0000064280ce1320 0000064280cd6cc0 NONE Microsoft.SharePoint.DirectorySoap.RequestInfo..ctor()

This shows some very interesting info like MethodDesc (used to set breakpoints) and JIT information. To set a breakpoint just use !bpmd –md <methoddesc>

0:000> !bpmd -md 00000642789303b0

Now you can press “g” (go) and let the breakpoint be hit.

Have fun

Bruno