How to live debug managed code using windbg

For native code, we are easy to live debug and get the local variable, parameter, register fore function returned value.

Today I want to introduce how to live debug managed code using windbg.

1. .load sos.dll 

2.  Check threads

0:027> !threads
ThreadCount: 19
UnstartedThread: 0
BackgroundThread: 16
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
                                              PreEmptive                                                Lock
       ID OSID        ThreadOBJ     State   GC     GC Alloc Context                  Domain           Count APT Exception
   0    1 2688 0000000001305f40      6020 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 STA System.IO.FileNotFoundException (0000000003793a98)
   2    2 1de8 0000000001310240      b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Finalizer)
   4    3 2634 000000001dfa1de0   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  11    4 225c 000000001dfa06a0      1220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 Ukn
  12    5  ca8 000000001dfa0c70    80a220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Threadpool Completion Port)
  13    6 2790 000000001dfa2980   180b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Threadpool Worker)
  15    7 222c 000000001dfa1240   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA System.Net.Sockets.SocketException (00000000037c7d88)
  16    8 131c 000000001dfa1810    80a220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Threadpool Completion Port)
  17    9 2b44 000000001dfa23b0   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  18    a 15dc 000000001dfa2f50   200b020 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  19    b 1910 000000001dfa3520   200b020 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  20    c 1c9c 000000001dfa00d0   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  21   10 22b0 000000001ef528a0   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  22   11 2edc 000000001ef55cf0   200b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA
  23   13 272c 000000001ef52e70      7220 Enabled  0000000003fe5bc0:0000000003fe7538 000000001f344210     0 STA
  25   18 27c4 000000001ef545b0   180b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Threadpool Worker)
   8    f 2f34 000000001ef55150   880b220 Enabled  0000000000000000:0000000000000000 00000000012fd0a0     0 MTA (Threadpool Completion Port)
  24    d 2124 000000001ef53a10   880b220 Enabled  0000000003fcb0b0:0000000003fcb538 00000000012fd0a0     0 MTA (Threadpool Completion Port)
  26   17 1dd8 000000001ef53fe0   880b220 Enabled  0000000003fe3950:0000000003fe5538 00000000012fd0a0     0 MTA (Threadpool Completion Port)

3. The main threads APT is STA, in case it's id is 23

  23   13 272c 000000001ef52e70      7220 Enabled  0000000003fe5bc0:0000000003fe7538 000000001f344210     0 STA

4. check the call stack

0:027> ~23e!clrstack
OS Thread Id: 0x272c (23)
Child-SP         RetAddr          Call Site
xxxxxxoooo(hidden)
000000002da6bc00 000007fa8694aee6 System.Reflection.RuntimeMethodInfo.Invoke(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo, Boolean)
000000002da6bda0 000007fa282e2d59 System.Reflection.RuntimeMethodInfo.Invoke(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo)
000000002da6bdf0 000007fa8783d552 Perseus.Plugins.DotNetInvokeClass.InvokeTest(Intrenal.Focus.TestEngine.Plugins.DotNetPlugin.TestInvokeInformation, Perseus.DataTypes.ITestCaseData, Internal.Focus.TestEngine.ModuleBuilderPlugins.IRuntimeFactory)
000000002da6ca80 000007fa868ac2d6 System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage, Int32, Boolean)
000000002da6cbc0 000007fa868ac19e System.Runtime.Remoting.Messaging.ServerObjectTerminatorSink.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage)
000000002da6cc10 000007fa868abe5c System.Runtime.Remoting.Messaging.ServerContextTerminatorSink.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage)
000000002da6cc80 000007fa8783d552 System.Runtime.Remoting.Channels.CrossContextChannel.SyncProcessMessageCallback(System.Object[])
000000002da6d1f0 000007fa868ab913 System.Runtime.Remoting.Channels.CrossContextChannel.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage)
000000002da6d280 000007fa868ab02f System.Runtime.Remoting.Channels.ChannelServices.SyncDispatchMessage(System.Runtime.Remoting.Messaging.IMessage)
000000002da6d310 000007fa868aaf60 System.Runtime.Remoting.Channels.CrossAppDomainSink.DoDispatch(Byte[], System.Runtime.Remoting.Messaging.SmuggledMethodCallMessage, System.Runtime.Remoting.Messaging.SmuggledMethodReturnMessage ByRef)
000000002da6d370 000007fa8783d552 System.Runtime.Remoting.Channels.CrossAppDomainSink.DoTransitionDispatchCallback(System.Object[])
000000002da6d8c0 000007fa868aa9da System.Runtime.Remoting.Channels.CrossAppDomainSink.DoTransitionDispatch(Byte[], System.Runtime.Remoting.Messaging.SmuggledMethodCallMessage, System.Runtime.Remoting.Messaging.SmuggledMethodReturnMessage ByRef)
000000002da6d930 000007fa868aa84c System.Runtime.Remoting.Channels.CrossAppDomainSink.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage)
000000002da6da00 000007fa868aa706 System.Runtime.Remoting.Proxies.RemotingProxy.CallProcessMessage(System.Runtime.Remoting.Messaging.IMessageSink, System.Runtime.Remoting.Messaging.IMessage, System.Runtime.Remoting.Contexts.ArrayWithSize, System.Threading.Thread, System.Runtime.Remoting.Contexts.Context, Boolean)
000000002da6da70 000007fa8693aaee System.Runtime.Remoting.Proxies.RemotingProxy.InternalInvoke(System.Runtime.Remoting.Messaging.IMethodCallMessage, Boolean, Int32)
000000002da6db30 000007fa877ed6bd System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(System.Runtime.Remoting.Proxies.MessageData ByRef, Int32)
000000002da6e170 000007fa28198316 Perseus.Plugins.DotNetCase.InvokeTest(Perseus.DataTypes.ITestCaseData)
000000002da6e2f0 000007fa28192eb6 Internal.Focus.TestEngine.InternalHarness+ExecuteTestGroupThread+TestThreadPool.InvokeTest(Boolean ByRef, System.Exception ByRef, Perseus.DataTypes.TestResults ByRef, Internal.Focus.TestEngine.Case)
000000002da6e790 000007fa28192573 Internal.Focus.TestEngine.InternalHarness+ExecuteTestGroupThread+TestThreadPool.ExecuteTest()
000000002da6ea50 000007fa868d2bdb Internal.Focus.TestEngine.InternalHarness+ExecuteTestGroupThread+TestThreadPool.ExecuteTestThread()
000000002da6eb90 000007fa8696a9bd System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000002da6ebe0 000007fa8783d552 System.Threading.ThreadHelper.ThreadStart()

5. Check it's parameter

0:029> ~23e!clrstack -p

(too much code, dont' want to list them here)

Reference:

http://msdn.microsoft.com/en-us/library/bb190764.aspx

http://blogs.msdn.com/b/alejacma/archive/2009/08/10/managed-debugging-with-windbg-threads-part-2.aspx

CLRStack [-a] [-l] [-p] [-n] Provides a stack trace of managed code only.

• The -p option shows arguments to the managed function.

• The -l option shows information on local variables in a frame. The SOS Debugging Extension cannot retrieve local names, so the output for local names is in the format = .

• The -a(all) option is a shortcut for -l and -pcombined.

• The -n option disables the display of source file names and line numbers. If the debugger has the option SYMOPT_LOAD_LINES specified, SOS will look up the symbols for every managed frame and if successful will display the corresponding source file name and line number. The -n (No line numbers) parameter can be specified to disable this behavior.

The SOS Debugging Extension does not display transition frames on x64 and IA-64-based platforms.