DebuggingExtensions

The few "debugging extensions" that have been created at Criteo to help post-mortem .NET applications analysis are now available:

• as a stand alone tool to load a .NET application memory dump and start automatic thread, thread pool, tasks and timer analysis. zip

• as a WinDBG extension to get the same level of details plus more commands such as getting a method signature based on its address. zip

• as a .NET Core console tool to load a .NET application memory dump and show merged threads call stack à la Visual Studio "parallel stacks" (works also on Linux) zip. Note that you could install it as a global CLI tool

  • "dotnet tool install --global dotnet-pstacks" to install it
  • "dotnet pstacks <pid or .dmp file path>" to get your parallel stacks

• as a .NET standard assembly to build and render parallel stacks from a memory dump file or a live process (on Windows only). zip More analyzers and commands will be added as needed.

• as a GUI tool first published in 2011 to chase .NET memory leaks. The source code is now available and dumps are droppable into the snapshot listview to compare them automatically.

• as a .NET Core console tool to analyze duplicated strings in a .NET application (live/memory dump) (works also on Linux) Note that you could install it as a global CLI tool

  • "dotnet tool install --global dotnet-dstrings" to install it
  • "dotnet dstrings <pid or .dmp file path>" to get the statistics

Introduction

Most of the code is detailed in the blog series related to ClrMD:

Part 1: Bootstrap ClrMD to load a dump.

Part 2: Find duplicated strings with ClrMD heap traversing.

Part 3: List timers by following static fields links.

Part 4: Identify timers callback and other properties.

Part 5: Use ClrMD to extend SOS in WinDBG.

Part 6: Manipulate memory structures like real objects.

Part 7: Manipulate nested structs using dynamic.

Part 8: Spelunking inside the .NET Thread Pool.

Part 9: Deciphering Tasks and Thread Pool items.

part 10: Getting another view on thread stacks with ClrMD

The detailed features are available either as a stand alone tool or a WinDBG extension. More commands will be added as needed.

Source Code

The DebuggingExtensions Visual Studio 2017 solution contains three projects:

1. ClrMDStudio: WPF application that loads a dump file on which commands to be executed

2. gsose: "Grand Son Of Strike Extension" for WinDBG that exposes the same commands (and more)

3. pstacks: .NET Core console application that loads a dump file (+ attachs to a live process on Windows) and shows merged parallel stacks

4. ParallelStacks.Runtime: .NET Assembly (and available as a nuget too) to let you build and render parallel stacks from your own code

5. LeakShell: .NET WinForms application to easily spot leaky class instances

6. dstrings: .NET Core console application that displays duplicated strings statistics

These projects depends on Nuget packages:

• ClrMD: C# library to explore dump files.
• DynaMD: C# dynamic-based helpers on top of ClrMD.
• ClrMDExports: Helper to write WinDBG/LLDB extensionss on top of ClrMD.