netext | WinDbg extension for data mining managed heap

netext is a C++ library. netext has no bugs, it has no vulnerabilities and it has low support. However netext has a Non-SPDX License. You can download it from GitHub.

Getting started - Open WinDBG. Load netext - Make sure you open the appropriate 32-bits or 64-bits extension (32-bits dumps require winbg 32-bits and netext 32-bits) - For detailed help, run: ".browse !whelp" - Run: "windex] #windex) -tree" and follow the instructions - All the rest will be intuitive - For scripts, see wfrom] #wfrom) and wselect] #wselect) - Download the training material here: [- Training material is NOW up-to-date. Common Resources [List of available commands] #menu) [Examples] #examples). You can do select like queries to .NET objects including sublevel fields. For example, to get the url of a HttpContext it is necessary to 1. !do the httpcontext instance, get address of _request 2. !do the HttpRequest instance, get the address of _url 3. !do the URI instance, get the address of m_String 4. !do the instance of the string object. It also works very well showing arrays (!wdo, !wselect and !wfrom) and providing link to the objects or showing the items value depending on the content of the array. Commands to Show Object Details -------------------------------------- - wdo] #wdo) - Display ad-hoc objects or arrays from GAC or Stack - wselect] #wselect) - Display ad-hoc fields (and level fields) for an object or for all item in an array - wfrom] #wfrom) - Perform SQL-like analysis of Heap objects enabling comparison, expression evaluation and indexed filtering. - wpe ] #wpe) - Dump Exception Object. Enumerate objects --------------------- - windex] #windex) - index and display objects based in different filters like object with of type HttpContext - wstack] #wstack) - dump unique stack objects - wheap] #wheap) - list objects without indexing and show thottled heap sampling - wgchandles] #wgchandles) - Dump GC root handles - wdae ] #wdae) - Dump all exceptions in the heap. Process commands ---------------- - wclrstack] #wclrstack) - Dump current thread’s stack trace (only managed thread) - wthreads] #wthreads) - Dump thread information - wver] #wver) - Show version of the .NET framework(s) present in the process or dump and extension version - wupdate] #wupdate) - Check for new versions and compare with current. If a new version is found, it tries to open the update page - wdomain ] #wdomain) - Dump all Application Domains - wmodule] #wmodule) - List modules based on a pattern - wtime] #wtime) - Show UTC and local time - wapppool] #wapppool) - Display AppPool details - wk] #wk) - Dump current thread’s stack trace in mixed mode (native and managed) - wp] #wp) - Step over managed code. This is similar to F10 in Visual Studio. - wt] #wt) - Step into managed code. This is similar to F11 in Visual Studio. - wvar] #wvar) - List process’s environment variable. - (new) wsetruntime] #wsetruntime) - List process’s environment variable. Special Purpose ------------------ - wdict] #wdict) - Display dictionary objects - whash] #whash) - Display HashTable objects - whttp] #whttp) - List HttpContext Objects - wconfig] #wconfig) - Show all .config file lines in memory - wservice] #wservice) - List WCF service Objects - weval] #weval) - Evaluate expression list - wclass] #wclass) - Show "reflected" class definition (fields, properties and methods)\(new) - wkeyvalue] #wkeyvalue) - Display pair key/value for NameObjectCollection type objects - wcookie] #wcookie) - Display HTTP cookies using filters and grouping - wruntime] #wruntime) - Display HTTP Runtime Info including Active Requests count - wtoken] #wtoken) - Display WIF tokens and claims - wsocket] #wsocket) - Dump socket information - wxml] #wxml) - Dump a XML document - wmakesource] #wmakesource) - It tries to reflect the current frame into source code - wopensource] #wopensource) - Open source file based on the IP provided - (not working in .NETCore) wconcurrentdict] #wconcurrentdict) - Dump a concurrent dictionary - wsql] #wsql) - Dump a concurrent dictionary.