[{"title":"Read My Blog Over SSH","date":"2026-08-13T07:46:00-05:00","permalink":"/posts/2026-08-13-read-my-blog-over-ssh/","content":"\n### Try it\n\nIn your terminal, run: `ssh ssh.naveensrinivasan.com`, and you don’t need any authentication. The host key fingerprint for this server is `SHA256:hK3ttqzsSBKUN18Wxu6eB0JB6lu4v4UBt6n8BX2WkIw`.\n\n### Why SSH?\n\nI have enjoyed the minimalism of the man pages, and it is also cool to have the blog accessible via SSH. \n\nThe added benefits include no browsers, no cookies, no accounts, and no scrapers.  Most of my content is words and code, and there are a few images that won't be rendered, which is fine. I don't have gifs, or videos. IMO, most of the tech blogs should be like man pages.  Also, I think most of my readers are on the terminal, and they already trust the transport. \n\n### What happens if the server is compromised? \n\nI assumed that this box is going to be compromised and built things around this premise to reduce the blast radius. I have this server on a DigitalOcean $6.00/month droplet, and I don't have any other resources on the DigitalOcean account, which means lateral movement should not be an issue. \n\nThere aren't any CI jobs pushing updates to the server for the SSH TUI, and the blog content is pulled from https://naveensrinivasan.com/index.json on a schedule, which means there aren’t any keys. If there is an update, I scp the TUI app from my laptop. \n\nI have the blog running with a dedicated user and not root. The SSH TUI service binds to port 22 (more on this later) with `CAP_NET_BIND_SERVICE` only. There is a separate host key for the blog, and another for OpenSSH. \n\nReaders will trust the blog’s keys, not my OpenSSH keys on 222. And I run the blog as a systemd service with hardened settings to reduce the blast radius.\n\n### What does the reader get?\n\nA list of articles to read with a simple keyboard shortcut and an About link, a minimalist blog that emulates something like Linux man pages. \n\nWriting without images pushes me to make my posts clearer and more engaging so readers understand everything easily!\n\n### What's under the hood?\n\nIt is a Go app built on https://github.com/charmbracelet/wish and https://github.com/charmbracelet/bubbletea, running on Ubuntu 24.0. \n\n### How is it configured to serve on port 22 and still have admin access to the server?\n\nThe default SSH port is 22, and when they SSH into my blog, I don’t want them to use a custom port. When a reader hits ssh.naveensrinivasan.com , I want them to land on my blog and not a default shell, and I also need a real OpenSSH login, and two of them cannot run on port 22. \n\nSo I have configured the blog app to run on 22 and moved OpenSSH to 222. My blog readers will get the TUI, and I can get in with ssh -p 222.\n\nI have explicitly avoided authentication, comments, and personalization. There's no state on the blog side, so there's no state to protect. Anyone with an SSH client gets the same read-only view, and that's the entire security model."},{"title":"Finding Hidden Internal Apps Through Public Certificate Logs","date":"2026-08-07T07:06:00-05:00","permalink":"/posts/2026-08-07-finding-hidden-internal-apps-through-public-certificate-logs/","content":"\nHere is how anyone can unwrap the organization's internal tools/products that no one is supposed to know about.\n\nTypically, in software organizations, most of us don't want to share internal applications on the internet, but we unintentionally share application names by requesting certificates. The issued certs get into the Certificate Transparency (CT) logs https://certificate.transparency.dev/, which are a Merkle tree that allows the rest of the world to see them. With this, anyone can access internal finance, upcoming products that had code names, etc.\n\nIMO, one of the easiest ways for folks to get CT logs for any given domain is to use something like https://sslmate.com/help/reference/certspotter_authorization_api (this API provides a throttled, free tier), which provides all the certificate entries (and believe me, lots of these domains are open on the public internet). Think of this like Shodan, but instead of searching with an IP or CIDR range, the bad actor can use a name. Once they get the hostnames, they can start searching for vulnerabilities or open applications.\n\nGetting the DNS is just the start; from there, they can check whether it is available on the internet, look for weak cookies, CORS checks, dump the JS bundles, and look for open API endpoints. (There are often API endpoints left open without any authentication.\n\nFetching all the above data does not require an LLM, since these are deterministic. There are easily available tools like https://github.com/g0ldencybersec/gungnir that actively monitor CT logs for new certificates and can provide information in a matter of seconds when a new hostname pops up.  Even a not-so-motivated actor can also use this data, along with the help of an LLM, to cause some significant impact on your systems.\n\n![Gungnir monitoring CT logs for newly issued certificates](/ctlogs.png)\n\nWith the advent of AI Slop, many of these applications get built and left open on the internet, and it has been observed that many dev/staging environments are open. For a motivated actor, crossing the threshold into other areas is not impossible.\n\nIf your organization has a private PKI, then you already know what to do. If not, the easiest fix is to get a wildcard cert like `*.internal.foo.com` which can reduce the blast radius.\n\nIf there is one thing to walk away with after reading this post, it is to go and check the CT logs for the domains you are interested in ;)\n"},{"title":"Measuring an eBPF Cache Without Leaving the Kernel","date":"2026-08-02T20:46:00-05:00","permalink":"/posts/2026-08-02-measuring-an-ebpf-cache-without-leaving-the-kernel/","content":"\nWhen testing our eBPF agent, I don’t always get the same experience as our users, especially in performance critical sections. I realize that the benchmark test suite isn’t always enough, because user's environments can be completely different from our benchmarks.\n\nI recently implemented a perf feature, which was inode caching for file access policies, and wanted to understand how it is being used in the users' environments based on their workloads. I wanted to proactively gather insights about the cache, including cache hits and misses, so I built metrics to measure the feature.\n\nMy goal was to gather eBPF metrics based on the user’s usage and quickly answer questions about why things are slow (improve MTTR).  To do this, I wanted:\n\n1. Record perf/usage counters at the kernel to show how that particular feature is being used.\n2. Performance is essential, as our metrics collection will be at the kernel.\n   1. So I cannot use ring buffers for sending messages from kernel to userspace for the above-mentioned counters.\n   2. I didn’t want any spin locks or shared maps, or even LRU caches.\n3. I wanted metrics collection to be “on” always for obvious reasons.\n4. I wanted the metrics to be a rolling window instead of a counter (more on this later).\n\n### The Data Structure\n\n1. A per CPU map for storing metrics (to avoid locks on the hot path)\n2. The `inode_cache_stats` struct,\n3. And a one entry array holding the epoch.\n\nThe per CPU map stores the `inode_cache_stats`, which avoids locking and the perf penalty. But this comes with a downside: userspace has to aggregate metrics from multiple maps, as each CPU has its own map, which in turn has its own store of `inode_cache_stats`. I run a timer from userspace to collect and aggregate this data. I understand that when there are no locks, the scrape can land in between increments and counts will be approximate, which is fine for ratios.\n\n![One array of 300 slots per CPU](/buckets.png)\n\n_One array of 300 slots per CPU_\n\nI store the epoch timestamp from the very first time in the array that every CPU shares, and there aren’t using any sleepable hooks lsm.s/\n\n```c\n#define BUCKET_WIDTH_NS 1000000000ULL  // 1 second buckets\n#define MAX_BUCKETS 300                // 300 seconds = 5 minutes\n\nstruct inode_cache_stats {\n    __u64 abs_bucket;\n    __u64 lookups;\n    __u64 hits_no_policy;\n    __u64 hits_allow;\n    __u64 hits_deny;\n    __u64 misses_walk;\n    __u64 fills;\n};\n```\n\nIn `inode_cache_stats`, every field is a counter except `abs_bucket`.\n\n```c\nnow        = bpf_ktime_get_ns()\nabs_bucket = (now - epoch) / BUCKET_WIDTH_NS\nslot       = abs_bucket % MAX_BUCKETS\n```\n\n![Two seconds, five minutes apart, same slot](/slots.png)\n\n_Two seconds, five minutes apart, same slot_\n\nThe `abs_bucket` is an absolute bucket number since epoch, and I use it to calculate the slot. For example, if `abs_bucket` is either `347` or `547`, it will land in slot `47`.\n\nEvery slot in the map will be `56` bytes, and there are `300` slots per CPU. On a 16-CPU box, the whole thing is about `270` KB of kernel memory, which IMO is good for the value it adds.\n\nWhat I am building is my own version of the RRDtool https://en.wikipedia.org/wiki/RRDtool.\n\nHere is our increment counter, which increments the values in `inode_cache_stats`, and this will be invoked wherever the cache is being used, like fetching, hits, etc.\n\n```c\nvoid stats_inc(u32 counter)\n{\n    u64 now        = ktime();\n    u64 abs_bucket = (now - epoch) / BUCKET_WIDTH_NS;\n    u32 slot       = abs_bucket % MAX_BUCKETS;\n\n    struct inode_cache_stats *b = \u0026stats_map[slot]; // per CPU map\n\n    if (b-\u003eabs_bucket != abs_bucket) {\n        memset(b, 0, sizeof(*b));\n        b-\u003eabs_bucket = abs_bucket;\n    }\n\n    switch (counter) {\n        case CACHE_STATS_LOOKUPS:        b-\u003elookups++; break;\n        case CACHE_STATS_HITS_NO_POLICY: b-\u003ehits_no_policy++; break;\n        case CACHE_STATS_HITS_ALLOW:     b-\u003ehits_allow++; break;\n        case CACHE_STATS_HITS_DENY:      b-\u003ehits_deny++; break;\n        case CACHE_STATS_MISSES_WALK:    b-\u003emisses_walk++; break;\n        case CACHE_STATS_FILLS:          b-\u003efills++; break;\n    }\n}\n```\n\n### Results\n\nHere are the results from our test suite, where I opened the same file in a loop, and the VM was doing its normal work at the same time, so not every lookup was because of our test suite.\n\nWith the data available as a map globally (yes, I am aware of the threat vector where anyone with escalated privileges can manipulate the map), I can scrape the map data and calculate the summary. In this example, I am using `bpftool` and some python scripting.\n\n```python\n➜ main ✗ % sudo bpftool -j map dump id 17238 | python3 -c '\nimport json,sys\nkeys=[\"lookups\",\"hits_no_policy\",\"hits_allow\",\"hits_deny\",\"misses_walk\",\"fills\"]\ntot={k:0 for k in keys}\nfor e in json.load(sys.stdin):\n    for cpu in e[\"values\"]:\n        b=bytes(int(x,16) for x in cpu[\"value\"])\n        for k,n in zip(keys,[int.from_bytes(b[i:i+8],\"little\") for i in range(8,56,8)]):\n            tot[k]+=n\nprint(json.dumps(tot, indent=2))\nlookups=tot[\"lookups\"]\nhits=tot[\"hits_no_policy\"]+tot[\"hits_allow\"]+tot[\"hits_deny\"]\nprint(\"hit_rate\", round(hits/lookups, 4) if lookups else None)\n'\n```\n\nResults after our test suite run.\n\n```json\n{\n  \"lookups\": 466908,\n  \"hits_no_policy\": 462005,\n  \"hits_allow\": 610,\n  \"hits_deny\": 0,\n  \"misses_walk\": 4293,\n  \"fills\": 4293\n}\n```\n\nFrom the above result\n\n1. `lookups` :  This was `466,908` lookups for the cache.\n2. `hits_no_policy` :  `462,005`; this was the number of cache hits where I didn’t have a file access policy. So the code could exit early and avoid walking up the stack, since I had already done it once.\n3. `hits_allow`:  `610` times, I found a cached entry with a rule and allowed access.\n4. `hits_deny` : I didn’t have any denies, which is expected as our test suite didn’t include a policy that would trigger any denies.\n5. `misses_walk` : The code had to walk up the stack to construct the path and then check the policy if access to these was allowed.\n6. `fills` : Fills are when the code fills the cache after walking up the stack to construct the path and evaluating the file access policy.\n7. The lookups math works: `462,005(hits_no_policy) + 610 (hits_allow) + 0 (hits_deny) + 4,293 (misses_walk)  = 466,908`.\n\nDuring the run, the number of distinct inodes that were accessed was `4,293`, and for each one of these, the code walked up the stack to construct the path exactly once to evaluate the file access policy,\n\nI was surprised by the high number of hits_no_policy, which makes sense as the system will have other file opens.\n\nThis idea is not specific to the inode cache metric, but can be used for other features to understand usage in user's environments and also, in this post, I am not diving into inode caching.\n"},{"title":"How Do I Profile eBPF Code?","date":"2026-07-22T16:47:00-05:00","permalink":"/posts/2026-07-22-how-do-i-profile-ebpf-code/","content":"If we are running any eBPF workload or writing eBPF code, we want to measure its performance impact, and in this post we will demonstrate an example of how to do it.\n\nIn this example, our goal is to measure the performance of file open operations, one of the most critical functions in the OS. Our code used file open hooks in eBPF, we wanted to measure the performance overhead introduced by adding this hook.\n\nTo identify likely bottlenecks, we need a simple C test harness with the fewest dependencies, designed to measure file open performance.\n\n```c\n#define _GNU_SOURCE\n#include \u003cfcntl.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003ctime.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003csched.h\u003e\n#include \u003csys/mman.h\u003e\n#include \u003csys/syscall.h\u003e\n\nstatic inline uint64_t now_ns(void) {\n    struct timespec ts;\n    clock_gettime(CLOCK_MONOTONIC, \u0026ts);   /* VDSO, no syscall */\n    return (uint64_t)ts.tv_sec * 1000000000ull + ts.tv_nsec;\n}\n\nint main(int argc, char **argv) {\n    const char *path = argv[1];\n    uint64_t n      = strtoull(argv[2], NULL, 10);\n    uint64_t warm   = n / 10;\n\n    /* preallocate + prefault + lock: no page faults in the loop */\n    uint32_t *d = mmap(NULL, n * sizeof(uint32_t), PROT_READ|PROT_WRITE,\n                       MAP_PRIVATE|MAP_ANONYMOUS|MAP_POPULATE, -1, 0);\n    mlock(d, n * sizeof(uint32_t));\n    for (uint64_t i = 0; i \u003c n; i++) d[i] = 0;   /* fault everything in */\n\n    for (uint64_t i = 0; i \u003c n; i++) {\n        uint64_t t0 = now_ns();\n        long fd = syscall(SYS_openat, AT_FDCWD, path, O_RDONLY);   /* raw, no libc wrapper */\n        uint64_t t1 = now_ns();\n        if (fd \u003e= 0) close(fd);\n        d[i] = (uint32_t)(t1 - t0);\n    }\n\n    /* dump after the loop only */\n    for (uint64_t i = warm; i \u003c n; i++) printf(\"%u\\n\", d[i]);\n    return 0;\n}\n```\nThe goal of the code example above is to keep it simple and reopen the same file under warm cache conditions, minimizing unrelated filesystem and disk I/O variability and helping identify the p50/p99. The code invokes `syscall(SYS_openat, …)` instead of the libc `openat()` wrapper, and the first 10% of the results are discarded as a warmup period.\n\nThis test harness would produce results of opening a file x number of times and how long it took to open. So we could use this to measure the before and after of when the eBPF hook attached. \n\n### Setup\nWhen profiling the eBPF code, we want perf tool to be able to resolve symbols so we can analyze where the issue is in our code. To do that, we have to run these commands.\n```bash\nsudo sysctl -w net.core.bpf_jit_enable=1\nsudo sysctl -w net.core.bpf_jit_kallsyms=1\n```\n\nThe above commands enable jit and expose jit-compiled BPF symbols so the perf report can display program names instead of unknown addresses.\n\nTo check whether the symbols appear in the `perf` tool, run your eBPF code and use a command like this.\n\n```bash\nsudo bpftool prog show | rg -A4 ' lsm '\nsudo rg 'bpf_prog_[0-9a-f]+_ '/proc/kallsyms | rg 'security|path|file|open'\n```\n\nIn the above rg command, we are checking for lsm as we are measuring LSM hooks.\n\nAlso, we are using a custom kernel version, so perf for that kernel version is not in the standard path, and we have it installed in our example: `PERF=/usr/lib/linux-tools/6.8.0-134-generic/perf`\n\n### Measuring \n\nNow that we have set up all the necessary tools, the first step is to measure without the eBPF code running, and this is where using the above C code can help. We measure the code by opening the file /etc/hostname  and piping the results to a file so that we can calculate the p50/p99.\n\n```bash\nsudo taskset -c 3 chrt -f 99 ./bench /etc/hostname 100000 \u003e /tmp/samples.txt \n```\nThe `taskset -c 3` pins execution to `CPU 3`, reducing CPU migration noise, and `chrt -f 99` gives the benchmark extremely high CPU priority. It runs before almost all normal programs and keeps running until it finishes, blocks, or is interrupted. The C code discards the first 10%; the file should contain 90,000 samples.txt.\n\nNext, run the eBPF code and execute something like this.\n\n```bash\nsudo $PERF record \\\n  -g \\\n  --call-graph fp \\\n  -e cycles:k \\\n  -F 997 \\\n  -o ~/perf.data \\\n  -- \\\n  taskset -c 3 \\\n  chrt -f 99 \\\n  ./bench /etc/hostname 200000 \\\n  \u003e /tmp/samples.txt\n```\n\nThe `-g` records the call stacks, `--call-graph fp` unwinds stacks using frame pointers, and `-e` samples CPU cycles in kernel mode only, which includes syscall, VFS, LSM, and eBPF execution and not userspace benchmark work. The `-F 997` requests 997 samples per second, and the non-round frequency helps avoid periodic alignment.\n\nAfter running the above, run this command to sort the data.\n```bash\nsudo \"$PERF\" report -i ~/perf.data --stdio --sort comm,dso,symbol \u003e perf.txt \n```\n![alt text](/flamegraph-ebpf-perf.png)\n\n_Flamegraph of the same perf.data, generated with Inferno. The stack of interest here is bpf_lsm_file_open and everything above it._\n\nHere is an example output from perf.txt, which shows that the time being spent on bpf_lsm_file_open and its tail calls is where the performance bottleneck is. This turned out to be in a hot path, which meant every allocation-to-CPU cycle shaving will make a significant impact on the performance of the system.\n```text\n|\n|          |                     |                     |          |          |–90.52%–do_dentry_open\n|          |                     |                     |          |          |          |\n|          |                     |                     |          |          |           --89.78%–bpf_lsm_file_open\n|          |                     |                     |          |          |                     |\n|          |                     |                     |          |          |                      --89.30%–0xffffffffc0288c18\n|          |                     |                     |          |          |                                |\n|          |                     |                     |          |          |                                |–87.40%–bpf_prog_b06f413955402a4b_tail_call_security_check\n|          |                     |                     |          |          |                                |          |\n|          |                     |                     |          |          |                                |          |–77.57%–bpf_prog_934361d723613c1c_enforce_access_policy\n|          |                     |                     |          |          |                                |          |          |\n|          |                     |                     |          |          |                                |          |          |–57.87%–bpf_prog_a0f18f4b0b140d77_path_check_callback\n|          |                     |                     |          |          |                                |          |          |          |\n|          |                     |                     |          |          |                                |          |          |          |–29.94%–bpf_probe_read_kernel\n|          |                     |                     |          |          |                                |          |          |          |          |\n|          |                     |                     |          |          |                                |          |          |          |          |–18.88%–copy_from_kernel_nofault\n|          |                     |                     |          |          |                                |          |          |          |          |\n|          |                     |                     |          |          |                                |          |          |          |           --4.99%–copy_from_kernel_nofault_allowed\n|          |                     |                     |          |          |                                |          |          |          |\n|          |                     |                     |          |          |                                |          |          |          |–4.88%–htab_map_hash\n|          |                     |                     |          |          |                                |          |          |          |\n|          |                     |                     |          |          |                                |          |          |           --2.29%–copy_from_kernel_nofault\n```\n\nThis post focuses on the profiling method rather than a specific result, and the overhead you'll see depends heavily on what your hook actually does, so we're leaving the numbers out and focusing on how to get them yourself.\n\nNow, from the above, we can start analyzing where the time is being spent and perf-tune the code along with the p50/p99 of the C code with eBPF running. \n\nBy doing this, we can clearly identify the perf impact of the eBPF code and likely pinpoint where optimizations are required. It can be as simple as caching something or coming up with a better algorithm based on where the problem is. "},{"title":"When LLVM's Optimizer Breaks Your eBPF Program","date":"2025-11-03T01:50:49Z","permalink":"/posts/2025-11-03-when-llvms-optimizer-breaks-your-ebpf-program/","content":"\nThis is a weird bug I ran into while working on the ebpf. A call to the built-in function ‘memset’ is not supported, and the confusing part was that I was using `__builtin_memset`. Here is the code.\n\n```c\n#include \"vmlinux.h\"\n#include \u003cbpf/bpf_helpers.h\u003e\n#include \u003cbpf/bpf_core_read.h\u003e\n\n#define PATH_MAX 1024\n\nstruct path_key {\n char container_path[PATH_MAX];  // 1024 bytes\n char directory_path[PATH_MAX];  // 1024 bytes\n};\n\nstruct {\n __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);\n __uint(max_entries, 1);\n __type(key, u32);\n __type(value, struct path_key);\n} temp_map SEC(\".maps\");\n\nSEC(\"kprobe/vfs_open_broken\")\nint broken_no_barrier(struct pt_regs *ctx)\n{\n u32 idx = 0;\n struct path_key *out = bpf_map_lookup_elem(\u0026temp_map, \u0026idx);\n if (!out)\n  return 0;\n\n __builtin_memset(out-\u003econtainer_path, 0, sizeof(out-\u003econtainer_path));\n __builtin_memset(out-\u003edirectory_path, 0, sizeof(out-\u003edirectory_path));\n\n const char *path = \"/some/path\";\n bpf_probe_read_kernel_str(out-\u003edirectory_path,\n      sizeof(out-\u003edirectory_path), path);\n\n return 0;\n}\n\nchar LICENSE[] SEC(\"license\") = \"GPL\";\n```\n\nAnd when I commented out one of `__builtin_memset` it worked, and so it had to be how LLVM was compiling the code, which is most likely the reason for this.  \n\n```\ncall void @llvm.memset.p0.i64(ptr noundef nonnull align 1 dereferenceable(2048) %3, i8 0, i64 2048, i1 false), !dbg !131\n```\nLLVM merged my two 1K memsets into a single 2K operation. \n\n### Fix\n\nI had to insert an asm volatile memory barrier after each memset `asm volatile(\"\" ::: \"memory\");` https://docs.ebpf.io/ebpf-library/libbpf/ebpf/barrier/ and this prevents the LLVM optimizer from merging the two memsets into one."},{"title":"google peer bonus","date":"2024-05-23T02:01:16Z","permalink":"/posts/third-peer-bonus/","content":"I am deeply honored to once again receive the Google Peer Bonus award for my contributions to the open-source community in 2024. This recognition feels incredibly rewarding. Thank you, Google!\n\nI have been fortunate to receive this award in the past, in both 2021 and 2022. The Google Peer Bonus is a small yet significant token of appreciation from Google to open-source contributors. It serves as a “thank you” for the time and effort invested in the open-source community.\n\nThis year, my work on the [https://github.com/guacsec/guac](https://github.com/guacsec/guac) project has been particularly rewarding. Being part of such an impactful initiative makes this recognition even more special.\n\n![](https://imgur.com/MNCyiaR.png)\n![](https://i.imgur.com/HknykHT.jpg)\n![](https://i.imgur.com/sKUifM9.png)\nThank you, Google, for acknowledging the passion and dedication of open-source contributors worldwide. This award is a reminder of the impact and value of our collaborative efforts.\n\n\n\n"},{"title":"Enhancing Security with Custom OpenSSF Scorecard Checks","date":"2024-01-24T12:51:58-06:00","permalink":"/posts/custom-openssf-scorecard-check/","content":"\nThe [Open Source Security Foundation (OpenSSF) Scorecard](https://github.com/ossf/scorecard) is essential for performing automated security checks in open-source projects. However, its standard checks might not address all organizations' specific security policies and compliance requirements. To overcome this limitation, developers can extend the Scorecard with custom checks by integrating it as a dependency in a Go binary. This method enables organizations to apply their distinctive security standards directly within their development workflows.\n\n## Integrating Scorecard as a Dependency\n\nOrganizations looking to create custom checks can incorporate the Scorecard as a dependency in their Go projects. They achieve this by importing the Scorecard modules into their Go binary, enabling them to utilize Scorecard's libraries and functions to craft and execute custom checks.\n\n```mermaid\ngraph LR\nA[Start] --\u003e B[Import Scorecard]\nB --\u003e C[Define Custom Checks]\nC --\u003e D[Register Checks]\nD --\u003e E[Execute Checks]\nE --\u003e F{End}\n```\n\n[![](https://mermaid.ink/img/pako:eNpVz8FugzAMBuBXiXwGlEBoIYdKKzBp0k7tbaSHCNyCuiQoBKkd4t3HuFS72f4sy_8MjW0RBNycGjryeZLmrT575fyFhOGBHOsPPVjnybmxDhvl2os0x42KusRrb5AU0-itJkWHzX1cudi4rE9460eP7iXlJlVdPbCZPL6g2uB9rky7QAAanVZ9u741S0OIBN-hRgliLVvl7hKk-dtTk7fnp2lAeDdhANPQKo9lr9Y0GsRVfY_rdFDmy9p_PYgZHiDCOIuTiMWM7_M45XnGsgCeIFLKIprvdzSjPOG7OOFLAD_bDRbljHNGk5xlNE3SnC-_wcNjjQ?type=png)](https://mermaid.live/edit#pako:eNpVz8FugzAMBuBXiXwGlEBoIYdKKzBp0k7tbaSHCNyCuiQoBKkd4t3HuFS72f4sy_8MjW0RBNycGjryeZLmrT575fyFhOGBHOsPPVjnybmxDhvl2os0x42KusRrb5AU0-itJkWHzX1cudi4rE9460eP7iXlJlVdPbCZPL6g2uB9rky7QAAanVZ9u741S0OIBN-hRgliLVvl7hKk-dtTk7fnp2lAeDdhANPQKo9lr9Y0GsRVfY_rdFDmy9p_PYgZHiDCOIuTiMWM7_M45XnGsgCeIFLKIprvdzSjPOG7OOFLAD_bDRbljHNGk5xlNE3SnC-_wcNjjQ)\n\n\n## Example: Custom Check for Gradle Wrapper Integrity\n\nhttps://github.com/naveensrinivasan/scorecard-customchecks\n\nTo illustrate the importance and application of a custom check, let's delve into the process of verifying the integrity of the Gradle wrapper JAR file in a repository. This is a critical check because the Gradle wrapper is a key component in many Java-based projects, acting as a script that facilitates the consistent execution of the build.\n\nThe Gradle wrapper serves an essential purpose: it automatically downloads the correct version of Gradle, ensuring that the build process is consistent and reliable across different environments. However, this also introduces a potential security risk. If the wrapper is tampered with, it could lead to the execution of malicious code or the introduction of vulnerabilities in the project.\n\nHere's where the custom check for the integrity of the Gradle wrapper JAR comes into play. By verifying the integrity of the Gradle wrapper, we can ensure that it has not been altered or compromised. This is crucial for maintaining the security and reliability of the build process.\n\nYou can see the implementation of this check in the checkGradleWrapperJar function at https://github.com/naveensrinivasan/scorecard-customchecks/blob/25014958694758e9b949af302aaf8b9ae14e5afc/main.go#L92-L129 in `main.go`. \n\nThis example demonstrates how to implement a custom check using Scorecard as a dependency. The function works by iterating through the repository's files, specifically targeting .jar files. It then calculates the SHA checksum of each file and compares it against a list of known, safe checksums for the Gradle wrapper JAR file. If a checksum doesn't match, it indicates a potential compromise, and the score for this check is reduced accordingly.\n\nThis custom check is vital for projects that rely on Gradle, as it ensures the integrity and security of a critical component of the build process. By integrating such a check into the Scorecard, organizations can automatically and continuously verify the safety of their build tools, significantly reducing the risk of introducing security vulnerabilities through compromised build processes.\n\n### Implementation Steps\n1. Import Scorecard Libraries: The Go binary includes imports from the github.com/ossf/scorecard/v4 package, which provides the necessary functions and types to interact with the Scorecard framework.\n\n2. Define Custom Checks: Custom checks, such as checkGradleWrapperJar, are defined within the Go binary. These checks use Scorecard's types and functions to perform specific security validations.\n\n3. Register Checks: \nYou register the custom checks with Scorecard's check runner, which permits their execution as part of the Scorecard suite.\n\n4. Execute Checks: \nWhen you run the Go binary, it initializes the Scorecard checks, incorporating the custom ones, and executes them against the target repository.\n### Benefits of Using Scorecard as a Dependency\n- Seamless Integration: \nBy using Scorecard as a dependency, you can seamlessly integrate custom checks into the existing Scorecard framework.\n- Consistency: Custom checks benefit from the same output format and scoring system used by standard Scorecard checks, ensuring consistency in reporting.\n- Customization: Organizations can tailor the security checks to their specific needs, going beyond the default checks provided by Scorecard.\n\n## Conclusion\nIncorporating OpenSSF Scorecard as a dependency in a Go binary is a strategic approach to extending its capabilities with custom checks. This method provides a flexible and powerful way to enhance the security of open-source projects by enforcing specific security policies and compliance standards.\n\nThe example of the Gradle wrapper integrity check illustrates just one of the many possibilities that custom checks offer, empowering organizations to maintain a robust security posture tailored to their unique requirements. As the digital landscape continues to evolve, the ability to adapt and address specific security challenges becomes paramount. Thus, custom checks with OpenSSF Scorecard represent a proactive and efficient solution, ensuring that organizations can keep pace with the ever-changing security demands of open-source software development.\n\n## Engage with Us\nWe would love to hear from you! If you've implemented custom checks in your projects, please share your experiences and insights in the comments below. Your contributions will help enrich our collective understanding and effectiveness in open-source security. Also, if you have any questions or specific challenges you'd like to discuss regarding integrating custom checks with the OpenSSF Scorecard, feel free to start a conversation. Let's collaborate to foster a more secure and robust open-source community.\n\n"},{"title":"Hackers and Painters","date":"2023-02-24T14:23:23-06:00","permalink":"/posts/hackers-and-painters/","content":"\n![](https://i.imgur.com/ejtEz5P.jpg)\nHackers and Painters\" https://www.amazon.com/Hackers-Painters-Big-Ideas-Computer/dp/1449389554 by Paul Graham is a book that celebrates the lives of nerds who challenge the status quo and create new things. Graham points out that school is nothing but a glorified babysitter and that being a nerd is the ultimate rebellion. He discusses the history of wealth creation and the importance of making the right language choices in programming.\n\n In \"Beating the Averages,\" Graham talks about how Lisp was a crucial language choice that allowed his team to create a more robust and flexible web application than its competitors. Throughout the book, Graham emphasizes the importance of creativity and innovation and argues that society should encourage and celebrate those who think outside the box. \n\nIn one of his most memorable quotes, Graham writes, \"Kids are smarter than they're allowed to be. They're all geniuses, but society, especially schools, beat it out of them.\" This quote is a poignant reminder of the importance of nurturing children's potential and creativity rather than stifling it through traditional educational systems.\"\n\n\n"},{"title":"OSS Trailblazer: My Journey of 4,155 Contributions and Membership in Prominent Open Source Organizations","date":"2022-12-24T16:12:15-08:00","permalink":"/posts/2022-oss-contributions/","content":"\n***2022***\n![](https://i.imgur.com/wCVTIe9.png)\n\n***2021***\n![](https://i.imgur.com/v9Ihe8x.png)\n\n\n*TLDR*: I have consistently contributed to open source projects on GitHub for the past two years, making 4,155 contributions in the past year alone. As a result of my dedication, I have become a member of several organizations and received a Google Peer Bonus award. I have also had the opportunity to speak at Linux Foundation conferences about supply chain security. My contributions to the open source community and supply chain security have been rewarding and fulfilling, and I look forward to continuing my work in this field.\n\n---\n\nAs an OSS contributor who is passionate about open source software and supply chain security, I am thrilled to share that I have made [4,155 contributions on GitHub](https://github.com/naveensrinivasan?tab=overview\u0026from=2022-12-01\u0026to=2022-12-24) in the past year. I am proud to say that I have not missed a single day of contribution in the past 2 years, starting on December 30, 2020.\n\nMy dedication to open source development has allowed me to make valuable contributions to the community and opened up new opportunities for me. Through my contributions to supply chain security projects with the [OpenSSF](https://github.com/ossf) organization, I became a member of the [Sigstore](https://github.com/sigstore/) and [SLSA-GitHub-Generator](https://github.com/slsa-framework/slsa-github-generator) organizations.\n\nBecoming a member of these organizations was a challenging task and required significant hard work and dedication. To be considered for membership, I had to consistently contribute high-quality code and actively participate in the development process. I also had to demonstrate a strong understanding of the project goals and vision and be willing to collaborate with other team members.\n\nBut the effort was worth it, as being a member of these organizations has given me access to valuable resources and opportunities for learning and growth. I have worked with talented OSS contributors worldwide, shared my knowledge and experience with others, and made a meaningful impact on the open source community.\n\nIn addition to my contributions to these organizations, I was also recognized for my efforts with a [Google Peer Bonus award in 2022 second year in a row](https://naveensrinivasan.com/posts/2022-09-06-google-peer-bonus/). This award is given to exceptional contributors who have contributed significantly to open source projects, and I am honored to have received it.\n\nI have also had the privilege of speaking at [Linux Foundation conferences](https://events.linuxfoundation.org/) about supply chain security and sharing my knowledge and experience with others in the industry. These conferences have allowed me to engage in meaningful discussions about the future of open source software and learn about new developments in the field.\n\nOverall, my contributions to open source development and supply chain security have been a rewarding and fulfilling experience. I am grateful for the opportunities I have had to positively impact the community and improve the security and reliability of supply chains. I look forward to continuing my work in this field and contributing even more.\n\n"},{"title":"google peer bonus","date":"2022-08-26T02:01:16Z","permalink":"/posts/2022-09-06-google-peer-bonus/","content":"I am honored to – once again – be a recipient of this award Google hands out to open source contributors annually. Getting this token of appreciation feels incredible. Thank you, Google! I have been a recipient of this award before, in 2021.\n\nThe award is a small token of appreciation from Google to open-source contributors. It is a way for Google to say “thank you” for the time and effort you have put into the open source community.\n![](https://i.imgur.com/HknykHT.jpg)\n\n\n\n"},{"title":"Zero Trust Development Environment","date":"2021-09-30T23:48:46Z","permalink":"/posts/zero-trust-development-environment/","content":"![](https://i.imgur.com/eHwmG9V.jpg)\n*[Photo by novia wu on Unsplash](https://unsplash.com/photos/JyepCoDqics?utm_source=unsplash\u0026utm_medium=referral\u0026utm_content=creditShareLink)*\n\nI am paranoid about running unknown code on my machine. I have been using a MacBook for some years now, but the way I used to install any software was `brew` like most developers.\n\nLater I asked the question, \"How do I trust my `brew installs`?\" But like most of us, I had to try new packages and deploy software to do my work.\n\nI contribute to many different [OSS projects](https://github.com/naveensrinivasan), and I also wanted to keep the environments separate. For example, one of the OSS projects requires `go 1.15` whereas the other one needs `go 1.17`.\n\nThe question I get asked is, aren't you overblowing the situation? No, I am not, and here are few examples of supply chain issues https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises and a great article by Paulo Gomes, [Golang: stop trusting your dependencies!](https://itnext.io/golang-stop-trusting-your-dependencies-a4c916533b04)\n\nHere are the things that I wanted for my new ENV\n1. I wanted an automatable environment.\n1. It has to be on a Linux box. \n1. It would be nice to have an immutable environment.\n1. It should be easy to maintain, and it would be great to have a community.\n1. I was ready to pay not more than $20 for my ENV per month. I meant for the hardware on a cloud instance. In my opinion, the cost of security is worth it. \n\nWith the above requirements, I ran into NixOS and nixpkgs. \nNixOS has a high learning curve like anything else, but I think it is worth the time spent on learning it. \n\nNow my environment is still a Macbook with a terminal. I only install packages from the App Store or signed packages, which has reduced my attack vector. \n\nI have different shell ENVs with nixpkgs for various projects:\n* https://github.com/naveensrinivasan/dotvim/blob/master/lnd.nix\n* https://github.com/naveensrinivasan/dotvim/blob/master/blog.nix\n* https://github.com/naveensrinivasan/dotvim/blob/master/shell.nix\n\nI have tmux sessions for each ENV, which are still running on a single cloud instance VM. I can update packages and don't have to worry about messing with the ENV's or compromising my machine security. \n\nIt would be best if you were comfortable using CLI-based ENV. I have been using vim for a while now, and I don't miss my UI for writing code. \n"},{"title":"Stunning Tribble","date":"2021-09-27T00:37:38Z","permalink":"/posts/stunning-tribble/","content":"\n## Defending from including OSV/CVE in go dependencies\n\ntldr: If you want to avoid including OSV/CVE in your `go.mod/go.sum` you can utilize this https://github.com/naveensrinivasan/stunning-tribble tool do that. Here is an example of how this is being used in scorecard https://github.com/ossf/scorecard/blob/9df865c4f83cfb36bae487125e5ccbc6aef448c6/Makefile#L64-L72\n\nI contribute to a project that is primarily focused on supply chain security https://github.com/ossf/scorecard which is part of Open Source Security Foundation, which is also part of Linux Foundation.\n\nWe happened to realize that between version 1.2.0 and 2.0.0 we have included a library that happens to have OSV(https://osv.dev) https://deps.dev/go/github.com%2Fossf%2Fscorecard/v1.2.0/comparev2=v2.0.0%2Bincompatible. This was accidental, and we wanted to check how to avoid this in the future. \n\nThe goal was to make this process part of every PR to check to be aware of any new OSV that we could be introducing. We also wanted an option to ignore any pre-existing OSV until we fix them.\n\nSo this led to https://github.com/naveensrinivasan/stunning-tribble.  Stunning-tribble takes input as stream and looks for OSV from osv.dev.\nThe stream is based on the format `go list -m -f '{{if not (or .Main)}}{{.Path}}@{{.Version}}_{{.Replace}}{{end}}' all`. This will provide all the dependencies, including the replace directives. \n\nThe tool is specifically built with the idea of not having any external dependency to avoid it having any OSV.\n\nTo ignore existing OSV pass them as CSV `stunning-tribble GO-2020-0018,GO-2020-0016` \n\nSupply chain security is one of the new ways in which lots of attacks are happening https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises\n\n\n\n\n"},{"title":"Google Peer Bonus Award","date":"2021-08-04T13:34:31Z","permalink":"/posts/google-peer-bonus-award/","content":"\nI’m honored to receive this award Google hands out to open source contributors annually. Getting this token of appreciation feels fantastic, and I’m humbled and grateful I was nominated and selected as a recipient. Thank you, Google!\n\n![](https://i.imgur.com/sKUifM9.png)\n\nThank you Google and Abhishek!\n\n"},{"title":"How to debug the CrashLoopBackOff in Kubernetes when pod is not starting","date":"2016-05-26T02:01:16Z","permalink":"/?p=3163/","content":"Here is my learning of how I debugged the CrashLoopBackOff in kubernetes when the pod wasn\u0026#8217;t starting.\n\nI wanted to deploy the \u003ca href=\"https://hub.docker.com/_/jenkins/\" target=\"_blank\"\u003ejenkins docker\u003c/a\u003e image in the cluster. As mentioned in the jenkins docker  repo I wanted to mount an external drive which is an AWS EBS volume.  Here is my deployment yaml.\n\n[gist id = \u0026#8220;98aa6da98ebb9b7e3d7f996c8ef2cb38\u0026#8221;]\n\nAfter starting the deployment the pod never came up and this the output of  _kubectl get pod_\n\n_NAME                                      READY      STATUS                  RESTARTS  AGE_\n  \n _jenkins-3317895845-x84u3  0/1       CrashLoopBackOff      10                 27m_\n\nThe next step was to issue the _kubectl describe pod jenkins-3317895845-x84u3_\n\n[gist id = \u0026#8220;7a79af84b53fc923aa609997fdb4fcfd\u0026#8221;]\n\nSo from the logs I could make out the container is being pulled correctly but it is failing on **StartContainer**.  Now based on this information the next step was to get the docker logs. But the docker logs aren\u0026#8217;t accessible from my box because it is managed by kubernetes. The only way to get the docker logs was to actually ssh into the box.\n\nBut which box should I ssh? The describe output has the node information which is _Node: ip-172-20-0-29.us-west-2.compute.internal/172.20.0.29_ . This_ _is the private ip of the box in aws but with that information you should be able to figure out the public ip to ssh.\n\nNow I know I have to ssh but where is the key for this server. If you have used the \u003ca href=\"http://releases.k8s.io/release-1.2/cluster/kube-up.sh\" target=\"_blank\"\u003ekube-up.sh\u003c/a\u003e then the keys would be stored  in this location _~/.ssh/kube\\_aws\\_rsa. ssh -i ~/.ssh/kube\\_aws\\_rsa admin@public-ip-oftheabovenode._\n\nAfter_ _sshing into the box I issued the command _sudo docker ps -a | grep naveen _because the container could have been stopped and looked for naveen because that was my container name. This gave me container id which was stopped with exit status as 1.\n\nAnd this was the output of docker logs command\n\n_admin@ip-172-20-0-29:~$ sudo docker logs c98a338268a1_\n  \n_touch: cannot touch ‘/var/jenkins\\_home/copy\\_reference_file.log’: Permission denied_\n  \n_Can not write to /var/jenkins\\_home/copy\\_reference_file.log. Wrong volume permissions?_\n\nwhich identified the _/var/jenkins_home  _which was mounted with aws ebs voulme  didn\u0026#8217;t have permission to write by the jenkins user \u003ca href=\"https://github.com/kubernetes/kubernetes/issues/2630\" target=\"_blank\"\u003ehttps://github.com/kubernetes/kubernetes/issues/2630\u003c/a\u003e.\n\nAnd after doing all of this I realized I could have done _kubectl logs jenkins-3317895845-x84u3_ which would have given the same output without having to ssh into the box. But knowing this handy because when things go wrong we really need to debug the root cause."},{"title":"Enable Shortcat app in OSX","date":"2016-04-25T14:13:47Z","permalink":"/?p=3141/","content":"\u003ca href=\"https://shortcatapp.com/\" target=\"_blank\"\u003eShortcat\u003c/a\u003e app is a software that I use everyday to keep me productive and reduce my dependency on mouse.\n\nBut if you have OSX El Captain you get a message to enable the assistive devices,. But it has been changed from the previous versions of OSX.\n\nTo enable the assistive devices navigate to  **System Preferences \u003e Security \u0026 Privacy \u003e Privacy \u003e Accessibility** and enable for shortcat app."},{"title":"My Docker aliases","date":"2016-04-23T14:35:57Z","permalink":"/?p=3061/","content":"I  have been using docker very often now and because I have been spending most of time in the terminal it made sense to use alias to reduce the typing.\n\n[gist id = \u0026#8220;d6b41d000b93f3ecc3e7a1b900c7382c\u0026#8221;]\n\nI have curated this from others and have also customized to what I want.\n\n\u0026nbsp;\n\nAll my aliases are stored in my github repo \u003ca href=\"https://github.com/naveensrinivasan/dotvim/blob/master/zshrc\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/dotvim/blob/master/zshrc\u003c/a\u003e\n\n\u0026nbsp;\n\n\u0026nbsp;"},{"title":"How I try avoid using mouse","date":"2016-03-28T00:57:41Z","permalink":"/?p=2901/","content":"Like most of the Dev\u0026#8217;s I love using my Keyboard more than mouse. I am big vim fan and have been using vim for over 7-8 years. I still consider myself novice.\n\nHere are the ways I manage to use keyboard over mouse\n\n  * \u003ca href=\"https://shortcatapp.com/\" target=\"_blank\"\u003eShortcat\u003c/a\u003e \u0026#8211; Great app get rids of use mouse in OSX \u0026#8211; This is a Paid App , which IMHO is the best investment for me. There is also a trial version.\n  * MacVim \u0026#8211; I have been using MacVim as my primary text editor.\n  * \u003ca href=\"https://chrome.google.com/webstore/detail/cvim/ihlenndgcmojhcghmfjfneahoeklbjjh?hl=en\" target=\"_blank\"\u003ecVim\u003c/a\u003e \u0026#8211; Vim features within chrome. The best part is it allows custom vimrc.\n  * IntelliJ Vim Plugin \u0026#8211; \u003ca href=\"https://github.com/JetBrains/ideavim\" target=\"_blank\"\u003ehttps://github.com/JetBrains/ideavim\u003c/a\u003e also allow vimrc\n  * Here is a plugin \u003ca href=\"https://github.com/athiele/key-promoter-fork\" target=\"_blank\"\u003ehttps://github.com/athiele/key-promoter-fork\u003c/a\u003e for IntelliJ \u0026#8211; show hints when using the mouse for something which could be done with the keyboard.\n  * \u003ca href=\"https://github.com/eczarny/spectacle\" target=\"_blank\"\u003eSpectacle\u003c/a\u003e \u0026#8211; For window management in OSX with keyboard.\n\n\u003cp style=\"padding-left: 30px;\"\u003e\n  \u003ca href=\"http://104.197.135.42/wp-content/uploads/2016/03/Screen-Shot-2016-03-27-at-10.24.42-PM.png\" rel=\"attachment wp-att-3001\"\u003e\u003cimg class=\"size-medium wp-image-3001 alignleft\" src=\"http://104.197.135.42/wp-content/uploads/2016/03/Screen-Shot-2016-03-27-at-10.24.42-PM-300x208.png\" alt=\"Screen Shot 2016-03-27 at 10.24.42 PM\" width=\"300\" height=\"208\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2016/03/Screen-Shot-2016-03-27-at-10.24.42-PM-300x208.png 300w, https://www.naveensrinivasan.com/wp-content/uploads/2016/03/Screen-Shot-2016-03-27-at-10.24.42-PM-768x533.png 768w, https://www.naveensrinivasan.com/wp-content/uploads/2016/03/Screen-Shot-2016-03-27-at-10.24.42-PM.png 844w\" sizes=\"(max-width: 300px) 100vw, 300px\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n_Remapped caps lock \u0026#8211; ^ Control Key_\n\n\u0026nbsp;\n\nHere is my vimrc  \u003ca href=\"https://github.com/naveensrinivasan/dotvim/blob/master/vimrc\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/dotvim/blob/master/vimrc\u003c/a\u003e. One of the things I do  is , set no-op for arrow keys makes me a better vim user.  I have tried vim hard mode \u003ca href=\"https://github.com/wikitopian/hardmode\" target=\"_blank\"\u003ehttps://github.com/wikitopian/hardmode\u003c/a\u003e and have failed few times. That is something I want to enable to get rid of bad habits.\n\nStill have to try \u003ca href=\"https://neovim.io/\" target=\"_blank\"\u003eNeovim\u003c/a\u003e. I especially like the neovim engine can be plugged into existing editor which is great.\n\nAnd  I have ordered myself \u003ca href=\"https://ultimatehackingkeyboard.com/\" target=\"_blank\"\u003eUltimate hacking Keyboard\u003c/a\u003e . The one of the reasons I am excited about this is ,you could use home row keys as mouse which would really replace mouse with this keyboard.\n\n\u0026nbsp;\n\n\u0026nbsp;"},{"title":"Taking it up a notch with my standing desk with fluidstance","date":"2016-03-11T01:09:50Z","permalink":"/?p=2781/","content":"I have been standing at work for the past 2  years. And I have seen significant improvement with respect to my productivity and non-drowsiness with standing desk. The one draw back with that I have seen was standing in a position where I put a lot of stress on one of the legs. And I wanted ti try something different.\n\nThat\u0026#8217;s when I saw \u003ca href=\"http://www.fluidstance.com\" target=\"_blank\"\u003efluidstance\u003c/a\u003e. Bought myself one which brings in a new challenge. I have been using it for a week and it is great  has made me sore in the places which I didn\u0026#8217;t when I was standing without it.\n\n\u003ca href=\"http://104.197.135.42/wp-content/uploads/2016/03/IMG_0557.jpg\" rel=\"attachment wp-att-2791\"\u003e\u003cimg class=\"alignnone size-medium wp-image-2791\" src=\"http://104.197.135.42/wp-content/uploads/2016/03/IMG_0557-300x225.jpg\" alt=\"IMG_0557\" width=\"300\" height=\"225\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2016/03/IMG_0557-300x225.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2016/03/IMG_0557-768x576.jpg 768w, https://www.naveensrinivasan.com/wp-content/uploads/2016/03/IMG_0557-1024x768.jpg 1024w\" sizes=\"(max-width: 300px) 100vw, 300px\" /\u003e\u003c/a\u003e\n\nIt is also a fun toy!"},{"title":"Solution to Adventcode Day 7 in FSharp","date":"2016-01-12T22:33:14Z","permalink":"/?p=2641/","content":"Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  * ````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  *```` \n  * `````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  * ````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  *```` \n  *````` \n  * ``````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  * ````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  *```` \n  * `````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  * ````Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  * ```Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  * ``Here is my solution to \u003ca href=\"http://adventofcode.com/day/7\" target=\"_blank\"\u003eadventcode problem 7 \u003c/a\u003e using F#.\n\nI am using the adventofcode to improve my functional programming skills. The gist of the problem is to solve the logic gates which is represented as 16 bit integer\u0026#8217;s  and these depend on other gates.\n\nThe puzzle starts of with simple problem\n\n  * `123 -\u003e x`\n  * `456 -\u003e y`\n  *`` \n  *``` \n  *```` \n  *````` \n  *`````` \n  * `NOT y -\u003e i`\n\nwhere the if you solve the above the code should work. But the complexity comes in when the order of the gates are not as expected and so the code would have solve the dependent ones before solving the entire solution.\n\nOne of the things that I really love about the FP code is union types and pattern matching.\n\nThat is the composite  type that could hold multiple different data types. In a non-functional static language I would have ended up creating nested types for each one of these.\n\nMy solutions to the adventofcode is here \u003ca href=\"https://github.com/naveensrinivasan/adventcode/\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/adventcode/\u003c/a\u003e\n\nAfter finishing I realized that I could have used the Tree structure which could help in traversal of the tree.\n\n[gist id = \u0026#8220;6d162d9f631cd636d14b\u0026#8221;] which would have made this problem simpler.\n\nHere is my solution.\n\n[gist id = \u0026#8220;6165418036481bae3756\u0026#8221;]"},{"title":"Parsing GitHub API","date":"2015-12-09T16:46:57Z","permalink":"/?p=2571/","content":"I have been contributing to \u003ca href=\"https://github.com/octokit/octokit.net\" target=\"_blank\"\u003ehttps://github.com/octokit/octokit.net\u003c/a\u003e project. It is the API for accessing GitHub. One of the recent questions that came up was to get the list of \u003ca href=\"https://github.com/octokit/octokit.net/issues/968\" target=\"_blank\"\u003ehttps://github.com/octokit/octokit.net/issues/968\u003c/a\u003e.\n\nThe API\u0026#8217;s are published in HTML \u003ca href=\"https://developer.github.com/v3/\" target=\"_blank\"\u003ehttps://developer.github.com/v3/\u003c/a\u003e\n\nThere are about 63 + categories that have API. Wanted to parse all of these with least manual intervention.\n\n[gist id = \u0026#8220;58fa8eb57e61535f10db\u0026#8221;]\n\nThe above goes to the main URL looks for all sub-categories and download\u0026#8217;s each of the web pages and extracts \u003cspan class=\"pl-s\"\u003e\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003e\u003cem\u003eGET\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003e\u003c/em\u003e\u003c/span\u003e_, \u003cspan class=\"pl-s\"\u003e\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003eDELETE\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003e\u003c/span\u003e, \u003cspan class=\"pl-s\"\u003e\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003ePATCH\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003e\u003c/span\u003e, \u003cspan class=\"pl-s\"\u003e\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003ePOST\u003cspan class=\"pl-pds\"\u003e\u0026#8220;\u003c/span\u003e\u003c/span\u003e_\n\nThis uses the \u003ca href=\"https://www.nuget.org/packages/HtmlAgilityPack\" target=\"_blank\"\u003eHtmlAgility\u003c/a\u003e for parsing.\n\nAnd the output would look something like this.\n\n![][1]\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n [1]: https://camo.githubusercontent.com/03204325907aae77bb2f865117271bf28136d5ca/68747470733a2f2f7062732e7477696d672e636f6d2f6d656469612f4356766c6b5878564141456d7454332e706e67"},{"title":"fsharp docker image","date":"2015-11-11T02:41:14Z","permalink":"/?p=2481/","content":"The fsharp project has a official docker image \u003ca href=\"https://github.com/fsprojects/docker-fsharp\" target=\"_blank\"\u003ehttps://github.com/fsprojects/docker-fsharp\u003c/a\u003e . The one issue with that is it is based on mono 4.0.4 which is buggy and fsharp does not work very well. The latest alpha release of the mono with which fsharp works well is 4.2.0. The 4.2.0 isn\u0026#8217;t available in stable channels.\n\nSo I created a docker image with the latest mono from their alpha repo and using the latest fsharp from the github.\n\n\u003ca href=\"https://github.com/naveensrinivasan/fsharp-docker\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/fsharp-docker\u003c/a\u003e\n\n[github file = \u0026#8220;/naveensrinivasan/fsharp-docker/blob/master/Dockerfile\u0026#8221;]\n\nIt is also available in the docker hub. You could get it by\n\ndocker pull naveensrinivasan/fsharp"},{"title":"View the http redirect and response message from an external authentication provider using ETW","date":"2015-06-29T02:57:26Z","permalink":"/?p=1510/","content":"Recently I had to troubleshoot messages that were being sent from an web application hosted on IIS to an external authentication provider. The logs from the application wasn\u0026#8217;t something closer to the metal and wasn\u0026#8217;t really providing all the details. I really wanted something like fiddler for the webserver. I could have a ran network traces to troubleshoot the issue but the problem was it wasn\u0026#8217;t happening consistently. It was sporadic. I knew there would be ETW traces that would have this information. The IIS web logs don\u0026#8217;t capture this information.\n\nHere is a example of the SAML authentication process\n\n[\u003cimg class=\" size-full wp-image-1511 aligncenter\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/500px-saml.jpg\" alt=\"500px-SAML\" width=\"500\" height=\"469\" /\u003e][1]\n\nIn the application I was working with, IIS was the relying party and the user was to be authenticated with Identity Provider.\n\nI wanted to troubleshoot the \u0026#8220;AuthnRequest\u0026#8221; and \u0026#8220;Auth Resp\u0026#8221; from and to the IIS. This can be applied to any external authentication like credit card authentication.\n\nI fired my favorite tool \u003ca href=\"http://blogs.msdn.com/b/vancem/archive/tags/perfview/\" target=\"_blank\"\u003ePerfview\u003c/a\u003e and captured all the IIS traces along with other defaults. I wasn\u0026#8217;t really interested in the .NET Code.\n\nHere is the command line for Perfview to the IIS Providers\n  \n[gist id = \u0026#8220;86a6d7daac73484ef504\u0026#8221;]\n\nIf for some reason that does not work.  You could always use the additional providers in Perfview and add these providers which are IIS and HTTP providers.\n\n[gist id = \u0026#8220;5ac34bdd047d2d80cc44\u0026#8221;]\n\nI let perfview do its job and then stopped the trace when there was an issue.\n\nHere are the ETW events that capture the SAML Request that was sent from IIS to the IDP\n\nEvent Name\n\n  1. IIS\\_Trace/IISGeneral/GENERAL\\_RESPONSE_HEADERS\n  2. Microsoft-Windows-IIS/EventID(47)\n  3. IIS\\_Trace/IISGeneral/GENERAL\\_RESPONSE\\_ENTITY\\_BUFFER\n  4. Microsoft-Windows-IIS/EventID(49)\n  5. IIS\\_Trace/IISGeneral/GENERAL\\_REQUEST_HEADERS\n\n[\u003cimg class=\"alignleft size-full wp-image-1515\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/samlrequest.jpg\" alt=\"SamlRequest\" width=\"660\" height=\"231\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlrequest.jpg 1157w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlrequest-300x105.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlrequest-768x269.jpg 768w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlrequest-1024x358.jpg 1024w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][2]\n\nHere are the ETW events that capture the SAML Response that was being posted from the IDP to the IIS\n\n  1. IIS\\_Trace/IISGeneral/GENERAL\\_REQUEST_ENTITY\n  2. Microsoft-Windows-IIS/EventID(51)\n\n[\u003cimg class=\"alignleft size-full wp-image-1514\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/samlresponse.jpg\" alt=\"samlresponse\" width=\"660\" height=\"39\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlresponse.jpg 1177w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlresponse-300x18.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlresponse-768x46.jpg 768w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/samlresponse-1024x61.jpg 1024w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][3]\n\nWith this I was able to troubleshoot message that was being sent and received to the IIS.\n\n\u0026nbsp;\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/06/500px-saml.jpg\n [2]: https://naveensrinivasan.files.wordpress.com/2015/06/samlrequest.jpg\n [3]: https://naveensrinivasan.files.wordpress.com/2015/06/samlresponse.jpg"},{"title":"Getting my Yoga stats from Yogaglo","date":"2015-06-17T19:16:33Z","permalink":"/?p=1499/","content":"\u003cdiv\u003e\n  \u003ch1\u003e\n  \u003c/h1\u003e\n  \n  \u003cp\u003e\n    I am Yogi and have practiced some sort physical workout for a while now. IMHO physical strength/ movement have always attributed to better clarity in my life! This post shows how I managed to get my \u003ca title=\"Yogaglo\" href=\"https://www.yogaglo.com/mypractice\" target=\"_blank\"\u003eyogaglo\u003c/a\u003e stats to track and measure my practice.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    \u003ca href=\"https://naveensrinivasan.files.wordpress.com/2015/06/naveensrinivasan-trx.jpg\"\u003e\u003cimg class=\" wp-image-1503 size-large alignnone\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/naveensrinivasan-trx.jpg?w=343\" alt=\"NaveenSrinivasan-TRX\" width=\"343\" height=\"1024\" /\u003e\u003c/a\u003e\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    I am strong believer in habit loops and always have found that has worked a lot for me. One of the good books on this which I recommend to other is\u003ca title=\"Power Of Habit\" href=\"http://www.amazon.com/The-Power-Habit-What-Business/dp/081298160X\" target=\"_blank\"\u003ehttp://www.amazon.com/The-Power-Habit-What-Business/dp/081298160X\u003c/a\u003e and also another good resource is \u003ca href=\"http://getupandcode.com/\" target=\"_blank\"\u003ehttp://getupandcode.com/\u003c/a\u003e which is a audio podcast fitness and technology.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    I have been practicing Yoga for a while now and I would like to track my practice. I usually go to studio twice a week to be part of the \u003ca title=\"Sangha\" href=\"https://en.wikipedia.org/?title=Sangha\" target=\"_blank\"\u003eSangha\u003c/a\u003e and the rest 4-5 days I practice twice a day.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    I knew yogaglo had my stats information stored in their site because when I logged into the site it did provide me with history. But I wanted the API to query based on the raw data. I wanted to track how often I worked and what kind of classes have I done. My goal was to work on the strengthening my core and I usually like to track that and API would help with this kind of information.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    Thanks to tools like \u003ca title=\"fiddler\" href=\"http://www.telerik.com/fiddler\" target=\"_blank\"\u003efiddler\u003c/a\u003e or \u003ca href=\"http://mitmproxy.org/\" target=\"_blank\"\u003ehttp://mitmproxy.org/\u003c/a\u003e I could look at the http traffic that was sent with the headers. The headers are important because it contained the authentication token information. FYI I have set yogaglo to remember my login information which meant I have cookies that it could send across part of the http request.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    Here is the code to download the yogaglo stats\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    [gist https://gist.github.com/naveensrinivasan/2e40f409bf6c386766c6]\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    You could take the json and dump into excel and get some amazing stats using \u003ca href=\"https://support.office.com/en-us/article/Introduction-to-Microsoft-Power-Query-for-Excel-6E92E2F4-2079-4E1F-BAD5-89F6269CD605\" target=\"_blank\"\u003epowerquery\u003c/a\u003e.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    I am not a excel whiz to do it. I used the json to convert it to C# objects using\u003ca href=\"http://json2csharp.com/\" target=\"_blank\"\u003ehttp://json2csharp.com/\u003c/a\u003e and here is the code it generated.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    [gist https://gist.github.com/naveensrinivasan/0cf3cecede742c3587dc]\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    With that here is a simple query to get total duration by date.\n  \u003c/p\u003e\n  \n  \u003cp\u003e\n    [gist https://gist.github.com/naveensrinivasan/213c2092babc23d7c772]\n  \u003c/p\u003e\n\u003c/div\u003e"},{"title":"Use Eventsource  to get the duration of a Start Stop of Custom ETW events","date":"2015-06-08T19:53:29Z","permalink":"/?p=1493/","content":"The \u003ca href=\"https://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.EventSource/\" target=\"_blank\"\u003eEventSource\u003c/a\u003e library provides an option to get duration of Custom ETW start and stop events and when used with Perfview we could leverage this to stop tracing when the duration is more than what we expect.\n\nWhat it is for example ,there could an external API call the application makes that has to be traced with the start and when it finishes then the stop of the event is called. Ideally we would have a ability to view the duration of these events similar to ASP.NET calls.  The EventSource Library along with Perfview provides this ability to view the duration between the start and stop events.\n\nHere is a code sample with CustomEvent\n\n[gist https://gist.github.com/naveensrinivasan/7e54c72dc628ae7da69e]\n\nAnd here is the output from Perfview with the duration.\n\n[\u003cimg class=\"alignleft wp-image-1495 size-full\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/startstopetw.jpg\" alt=\"StartStopETW\" width=\"494\" height=\"204\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/06/startstopetw.jpg 494w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/startstopetw-300x124.jpg 300w\" sizes=\"(max-width: 494px) 100vw, 494px\" /\u003e][1]\n\nHow often we want to capture trace when the performance of our custom event goes down to figure out what went wrong. This is very much possible with this.\n\nHere is the command\n\nPerfView /StopOnEtwEvent:*CustomEvent//Start;TriggerMSec=2000 collect\n\nThis would record the ETW events on a flight recorder mode and would stop when the CustomEvent took more than 2 seconds. This is one of the features I really like because it is a great asset to DevOps to see when the issue arises.\n\nHere is an example of Perfview Stop reason that shows why perfview stopped which clearly  indicates when the duration of event took more than 2000 milliseconds.\n\n[\u003cimg class=\"alignleft size-full wp-image-1496\" src=\"https://naveensrinivasan.files.wordpress.com/2015/06/perfviewstopreason.jpg\" alt=\"PerfviewStopReason\" width=\"660\" height=\"44\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/06/perfviewstopreason.jpg 897w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/perfviewstopreason-300x20.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/06/perfviewstopreason-768x51.jpg 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][2]\n\nThere is a bug in perfview that would not record Stop triggered events. I have reported this and I hope this would be fixed in the next public release.\n\nThe source code for these samples are here\n\n\u003ca href=\"https://github.com/naveensrinivasan/ETWSamples\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/ETWSamples\u003c/a\u003e\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/06/startstopetw.jpg\n [2]: https://naveensrinivasan.files.wordpress.com/2015/06/perfviewstopreason.jpg"},{"title":"Log dynamic Custom objects in ETW using EventSource","date":"2015-05-29T03:35:50Z","permalink":"/?p=1489/","content":"With the latest release of \u003ca href=\"http://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.EventSource\" target=\"_blank\"\u003eEventSource\u003c/a\u003e we could create dynamic events without having to create class that inherits from EventSource. This is will be not be good for Performance.\n\nUsing these methods we could either log Anonymous objects or Classes that have the EventData Attribute applied to it. The caveat is that these objects public properties alone will be serialized. These properties have to be of native types like string,int,datetime, guid , IEnumerable. If you don\u0026#8217;t want a property to be serialized you could apply the attribute EventIgnore.\n\nThe source code for this repository is in \u003ca href=\"https://github.com/naveensrinivasan/ETWSamples\" target=\"_blank\"\u003ehttps://github.com/naveensrinivasan/ETWSamples\u003c/a\u003e\n\nHere is the sample code of using  Dynamic eventsource to generate ETW traces\n\n[gist https://gist.github.com/naveensrinivasan/83ded09f7d754ad0b3a8]\n\nHere is the trace from Perfview generated using\n\n[gist https://gist.github.com/naveensrinivasan/11a793b35a18fc9546dd]\n\n[\u003cimg class=\" size-full wp-image-1490 aligncenter\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/dynamicetw.jpg\" alt=\"DynamicETW\" width=\"660\" height=\"171\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/dynamicetw.jpg 929w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/dynamicetw-300x78.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/dynamicetw-768x199.jpg 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][1]\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/05/dynamicetw.jpg"},{"title":"The case of slow Visual Studio startup","date":"2015-05-20T01:23:35Z","permalink":"/?p=1469/","content":"In this post I would use Perfview /ETW to diagnose the delayed start-up of visual studio.\n\nTo analyze the problem start-up VS within Perfview as a run command\n\n[gist https://gist.github.com/naveensrinivasan/5eb6406d6d38f2143acb]\n\nThis would launch visual studio and collect etw traces. I have also enabled CodeMarkers , which is ETW traces for Visual Studio in case if you want to trace any extensions performance.\n\n[\u003cimg class=\"alignleft size-full wp-image-1474\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/perfview-main.jpg\" alt=\"perfview-main\" width=\"660\" height=\"353\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfview-main.jpg 1000w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfview-main-300x161.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfview-main-768x411.jpg 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][1]After it completes I choose the CPU Stacks and filtered with devenv.exe process.\n\nOn the CPU window I choose call-tree tab which displays the threads.[\u003cimg class=\"alignleft size-full wp-image-1475\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/perfviewcpuview.jpg\" alt=\"perfviewcpuview\" width=\"660\" height=\"501\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfviewcpuview.jpg 961w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfviewcpuview-300x228.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/perfviewcpuview-768x583.jpg 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][2]The most amount of time is spent on the start-up thread and that is what we want to zoom into.\n\n[\u003cimg class=\"alignleft size-full wp-image-1477\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/groupedcall-stacks.png\" alt=\"groupedcall-stacks\" width=\"660\" height=\"426\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/groupedcall-stacks.png 835w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/groupedcall-stacks-300x194.png 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/groupedcall-stacks-768x496.png 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][3]When I expanded it does not show the information and everything is grouped into OTHER which does not help me.\n\nThe reason for that is perfview groups call-stacks for better viewing. I cleared the \u0026#8220;groupparts\u0026#8221; textbox and then expanded the start-up thread.\n\n[\u003cimg class=\"alignleft wp-image-1478 size-full\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/actualcallstacks.jpg\" alt=\"actualcallstacks\" width=\"660\" height=\"352\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/actualcallstacks.jpg 1366w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/actualcallstacks-300x160.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/actualcallstacks-768x409.jpg 768w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/actualcallstacks-1024x546.jpg 1024w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][4]From the call-stacks I could make almost 42% of time is spent on Xamarin and DevExpress extensions within VS. Now I could turn them off and have a better performance.\n\nPerfview is great tool for identifying where the time is being spent!\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/05/perfview-main.jpg\n [2]: https://naveensrinivasan.files.wordpress.com/2015/05/perfviewcpuview.jpg\n [3]: https://naveensrinivasan.files.wordpress.com/2015/05/groupedcall-stacks.png\n [4]: https://naveensrinivasan.files.wordpress.com/2015/05/actualcallstacks.jpg"},{"title":"Managed Stack Explorer using ClrMD","date":"2015-05-14T23:14:45Z","permalink":"/?p=1457/","content":"How often we run into an issue in the field where we just want to see the managed call-stack where the exception is or where the thread is hung. One of the options is debugger or something like ETW.\n\nSo I built a managed stack explorer\n\n\u003ca title=\"http://naveensrinivasan.github.io/ManagedStackExplorer/\" href=\"http://naveensrinivasan.github.io/ManagedStackExplorer/\" target=\"_blank\"\u003ehttp://naveensrinivasan.github.io/ManagedStackExplorer/\u003c/a\u003e\n\n[\u003cimg class=\"alignleft\" src=\"https://raw.githubusercontent.com/naveensrinivasan/ManagedStackExplorer/master/screenshot.jpg\" alt=\"\" width=\"1204\" height=\"1560\" /\u003e][1]\n\nManaged Stack Explorer provides call stack for .NET applications using managed code with thread local variables. The API as of now does not provide values for the local variables. When it is available we can update it.\n\nIt is a single executable without any other dll\u0026#8217;s. It uses [Costura][2] to embed dll.\n\nThe debug shim works specific to processor and would not be able to get call-stacks if it is not. So x86 exe cannot get call-stacks of x64. That\u0026#8217;s reason for x86 and x64 specific exe\u0026#8217;s. There is no difference in code other than how it is compiled.\n\nIt is work in progress and I would love some feedback and code contributions.\n\nThe github site also has link to download the pre-complied executables.\n\n [1]: https://raw.githubusercontent.com/naveensrinivasan/ManagedStackExplorer/master/screenshot.jpg\n [2]: https://github.com/Fody/Costura"},{"title":"Measure GC Allocations and Collections using TraceEvent","date":"2015-05-12T01:14:34Z","permalink":"/?p=1437/","content":"In this post I will explore  how we could use \u003ca href=\"https://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.TraceEvent/\" target=\"_blank\"\u003eTraceEvent\u003c/a\u003e to measure our code (even at function level) for GC Allocations and Collections.\n\n\u003cdiv id='gallery-1' class='gallery galleryid-1437 gallery-columns-1 gallery-size-full'\u003e\n  \u003cfigure class='gallery-item'\u003e \n  \n  \u003cdiv class='gallery-icon landscape'\u003e\n    \u003cimg width=\"400\" height=\"400\" src=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/showmethecode.jpg\" class=\"attachment-full size-full\" alt=\"\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/showmethecode.jpg 400w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/showmethecode-150x150.jpg 150w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/showmethecode-300x300.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/showmethecode-100x100.jpg 100w\" sizes=\"(max-width: 400px) 100vw, 400px\" /\u003e\n  \u003c/div\u003e\u003c/figure\u003e\n\u003c/div\u003e\n\nSave this with \u0026#8220;.linq\u0026#8221; extension and then open in  linqpad.\n\n[gist https://gist.github.com/naveensrinivasan/b72fd80876eb67557ae8]\n\nHere is the TL;DR\n\nWhy would I want to know GC events on a function level? Doesn\u0026#8217;t the PerfMon counter  provide that information on an application level? Isn\u0026#8217;t Premature optimization root of all evil?\n\nYes, for most of the part Premature optimization is not necessary. And PerfMon GC counter\u0026#8217;s would give answers for the whole application. But it is usually after we build the application and when we start running into performance issues we start looking at them.\n\nThe motivation behind this are two things \u003ca href=\"https://msdn.microsoft.com/en-us/magazine/cc500596.aspx\" target=\"_blank\"\u003eMeasure Early and Often for Performance\u003c/a\u003e and \u003ca href=\"http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/DEV-B333\" target=\"_blank\"\u003eEssential Truths Everyone Should Know about Performance in a Large Managed Codebase\u003c/a\u003e\n\nIf you haven\u0026#8217;t read or watched the above video please do it. It let\u0026#8217;s us know why and how to do it.\n\nIn the above video Dustin talks about Roslyn code base and how they used \u003ca href=\"http://blogs.msdn.com/b/vancem/archive/tags/perfview/\" target=\"_blank\"\u003ePerfview \u003c/a\u003eto measure Roslyn code base and identify potential bottlenecks early to avoid Perf issues.\n\nOne of the key differences between managed code and native code with respect to performance is GC. If GC is working hard then your application might not be able to get the performance that you are expecting. GC is good but if we don\u0026#8217;t know which calls allocate what amount of data then it is an issue. Especially if you have a section code that is hit very often and which requires a lot of Perf, it is good know where the allocations are coming from. It is not explicit always.\n\nIn the above video Dustin shows few examples of Roslyn code where they were able to identify subtle issues that could allocate a lot when you are trying to get the most out of the code.There is also \u003ca href=\"https://github.com/mjsabby/RoslynClrHeapAllocationAnalyzer\" target=\"_blank\"\u003eRoslyn Heap Allocation Analyzer\u003c/a\u003e which looks at the code help us identify allocations which isn\u0026#8217;t necessary. It is a cool project.\n\nI took one of the examples from the video as a motivation to check if  I could measure and make it a utility in my toolbox to help me when I need one.\n\n[gist https://gist.github.com/naveensrinivasan/9153a580b7f4bda55a38]\n\nIn the above example I am trying look for a word \u0026#8220;pede\u0026#8221; in the lorem ipsum text. The code could get it using \u0026#8220;foreach\u0026#8221; or using the \u0026#8220;Any\u0026#8221; operator. I would like to run this few times to check what are the allocations and how long does it take. I used LINQPad as a scratch pad.\n\nHere is the result of GC Allocations of using \u0026#8220;Any\u0026#8221; for 500 iterations and NOT the foreach\n\n[\u003cimg class=\"alignleft wp-image-1440 size-large\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/gcallocations.jpg?w=660\" alt=\"GCAllocations\" width=\"660\" height=\"272\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gcallocations.jpg 675w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gcallocations-300x124.jpg 300w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][1]\n\nThe were 118 allocations of Enumerator and 146 allocations Func. GC usually allocates 100K each time it allocates that\u0026#8217;s what is shown in the allocation amount column.\n\nAnd here is GC Allocations when using \u0026#8220;foreach\u0026#8221;\n\n[\u003cimg class=\"alignleft size-full wp-image-1445\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/gcallocationwithforeach.jpg\" alt=\"GCAllocationWithForEach\" width=\"472\" height=\"237\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gcallocationwithforeach.jpg 472w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gcallocationwithforeach-300x151.jpg 300w\" sizes=\"(max-width: 472px) 100vw, 472px\" /\u003e][2]\n\nThere are hardly any new allocations compared to the previous one.\n\nHere is the GC Collections when using  \u0026#8220;Any\u0026#8221;\n\n[\u003cimg class=\"alignleft size-full wp-image-1447\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/gccollection.jpg\" alt=\"GCCollection\" width=\"660\" height=\"395\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gccollection.jpg 704w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/gccollection-300x179.jpg 300w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][3]\n\nThere were 18 GC Collections using Any.\n\nHere it is using foreach  and there were 0 collections.\n\n[\u003cimg class=\"alignleft size-full wp-image-1448\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/zeorcollections.jpg\" alt=\"ZeorCollections\" width=\"229\" height=\"65\" /\u003e][4]\n\nHere is measure it time duration results using Any\n\n[\u003cimg class=\"alignleft size-full wp-image-1449\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/measurewithany.jpg\" alt=\"MeasureWithAny\" width=\"660\" height=\"223\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/measurewithany.jpg 759w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/measurewithany-300x102.jpg 300w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][5]\n\nAnd here it is using Foreach\n\n[\u003cimg class=\"alignleft size-full wp-image-1450\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/measurewithforeach.jpg\" alt=\"MeasureWithForEach\" width=\"660\" height=\"253\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/measurewithforeach.jpg 744w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/measurewithforeach-300x115.jpg 300w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][6]\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/05/gcallocations.jpg\n [2]: https://naveensrinivasan.files.wordpress.com/2015/05/gcallocationwithforeach.jpg\n [3]: https://naveensrinivasan.files.wordpress.com/2015/05/gccollection.jpg\n [4]: https://naveensrinivasan.files.wordpress.com/2015/05/zeorcollections.jpg\n [5]: https://naveensrinivasan.files.wordpress.com/2015/05/measurewithany.jpg\n [6]: https://naveensrinivasan.files.wordpress.com/2015/05/measurewithforeach.jpg"},{"title":"Look ma I figured out why my ETW  EventSource isn’t tracing","date":"2015-05-05T13:47:39Z","permalink":"/?p=1414/","content":"The \u003ca title=\"EventSource\" href=\"https://msdn.microsoft.com/en-us/library/system.diagnostics.tracing.eventsource%28v=vs.110%29.aspx\" target=\"_blank\"\u003eEventSource \u003c/a\u003eclass in the framework 4.5 helps in writing custom ETW tracing.\n\nWhen using EventSource class built within the framework, if the order of the methods don\u0026#8217;t match ordinal number position in the class it would fail generating ETW traces. The EventSource has dependency on the order of the methods in the class.\n\nThis code would produce a valid ETW traces\n\n[gist https://gist.github.com/naveensrinivasan/a1fcd0ec78d2473499d5]\n\nThis one would fail producing any ETW Traces.\n\n[gist https://gist.github.com/naveensrinivasan/0247d4e644a3da2bff04]\n\nThe difference between them are the order of the methods. If you notice in the failing ETW tracing class the **FailedTraceEvent **is Second and the **FailedDetailedEvent **is first which is causing the trace not to be generated. The actual exception text would\n\n\u003e Event FailedDetailedEvent is givien event ID 1 but 2 was passed to WriteEvent.\n\nIt\u0026#8217;s one of those quirks that I ran into when building ETW tracing.\n\n**How to troubleshoot these kind of failures?**\n\nBy default these kind of failed ETW exceptions would not be raised to be handled by the client code. The reason being,in production if you enable ETW tracing and all of a sudden the application crashes would not be something that we would want.\n\nTo troubleshoot this, use ETW tracing for exceptions. Use ETW to trace custom ETW failures. How cool is this?  My choice of tool is \u003ca title=\"Perfview\" href=\"http://blogs.msdn.com/b/vancem/archive/tags/perfview/\" target=\"_blank\"\u003ePerfview.\u003c/a\u003e\n\n[\u003cimg class=\"alignleft wp-image-1424 size-large\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/may-3-2015-etw-exception.jpg?w=660\" alt=\"may-3-2015-etw-exception\" width=\"660\" height=\"107\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-etw-exception.jpg 1348w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-etw-exception-300x49.jpg 300w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-etw-exception-768x124.jpg 768w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-etw-exception-1024x166.jpg 1024w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][1]\n\nWithin Perfview in the Events Window I enter **Test|Ex** in the filter text box which is shown in the above picture. FYI filter text box supports Regular expression. So by entering Test|Ex, I am filtering events with Test or Ex which for exceptions. With that information I could filter all the TestEvent\u0026#8217;s and any exceptions that have been raised which shows ArgumentException.\n\nThe call-stack of the ArgumentException shows on the static contructor **.cctor** of  FailedEvent.\n\n[\u003cimg class=\"alignleft wp-image-1434 size-large\" src=\"https://naveensrinivasan.files.wordpress.com/2015/05/may-3-2015-exception-callstack.jpg?w=660\" alt=\"may-3-2015-exception-callstack\" width=\"660\" height=\"366\" srcset=\"https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-exception-callstack.jpg 681w, https://www.naveensrinivasan.com/wp-content/uploads/2015/05/may-3-2015-exception-callstack-300x167.jpg 300w\" sizes=\"(max-width: 660px) 100vw, 660px\" /\u003e][2]\n\n [1]: https://naveensrinivasan.files.wordpress.com/2015/05/may-3-2015-etw-exception.jpg\n [2]: https://naveensrinivasan.files.wordpress.com/2015/05/may-3-2015-exception-callstack.jpg"},{"title":"Making an Image Easier to Debug","date":"2011-06-20T17:45:24Z","permalink":"/?p=1368/","content":"I am doing security review for a managed application which is obfuscated. So I am doing a lot of   disassembling code at runtime using Windbg. One of the issues is that code gets JIT optimized because of the retail build. This makes it harder for me debug when mapping it back. Realized  that I could turnoff  JIT Optimization\u0026#8217;s using the ini file.\n\n[sourcecode]\n  \n[.NET Framework Debugging Control]\n  \nGenerateTrackingInfo=1\n  \nAllowOptimize=0\n  \n[/sourcecode]\n\nAnother use of \u003ca href=\"http://msdn.microsoft.com/en-us/library/9dd8z24x.aspx\" target=\"_blank\"\u003efeature \u003c/a\u003ewhich I guess wasn\u0026#8217;t really intended for.\n\n\u003cpre\u003e\u003c/pre\u003e"},{"title":"Updating .NET String in memory with Windbg","date":"2011-06-14T16:42:24Z","permalink":"/?p=1353/","content":"In this post I would show a simple trick to update .NET strings in memory with Windbg. The caveat is make sure the string that you\u0026#8217;re updating is long enough to fit into the string buffer. If not there would be a memory corruption.\n\nHere is a simple windows form application with title \u0026#8220;Good\u0026#8221;\n\n[\u003cimg class=\"alignnone size-full wp-image-1356\" title=\"updatestring\" src=\"http://104.197.135.42/wp-content/uploads/2011/06/updatestring13.jpg\" alt=\"\" width=\"301\" height=\"300\" /\u003e][1]\n\nThe goal is to update the title from \u0026#8220;Good\u0026#8221; to \u0026#8220;Bad\u0026#8221;.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nbutton1.Click += (s,b) =\u003e Text = _caption;\n\n[/sourcecode]\n\n\u003cspan class=\"Apple-style-span\" style=\"font-family:Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif;font-size:13px;line-height:19px;white-space:normal;\"\u003eI am updating the title in the button click.\u003c/span\u003e\n\nHere is the actual string object within the debugger\n\n\u003cpre\u003e0:006\u0026gt; !do 0294d0a0\nName:        System.String\nMethodTable: 59b9fb64\nEEClass:     598d8bb0\nSize:        22(0x16) bytes\nFile:        C:WindowsMicrosoft.NetassemblyGAC_32mscorlib\nv4.0_4.0.0.0__b77a5c561934e089mscorlib.dll\nString:      Good\nFields:\n      MT    Field   Offset                 Type VT     Attr    Value Name\n59ba2b30  40000ed        4         System.Int32  1 instance        4 m_stringLength\n59ba1f80  40000ee        8          System.Char  1 instance       47 m_firstChar\n59b9fb64  40000ef        8        System.String  0   shared   static Empty\n    \u0026gt;\u0026gt; Domain:Value  004b0308:02941228 \u0026lt;\u0026lt;\u003c/pre\u003e\n\nI would be using the \u003ca title=\"e\" href=\"http://msdn.microsoft.com/en-us/library/ff545308(VS.85).aspx\" target=\"_blank\"\u003ee\u003c/a\u003e  command to update the memory. The **ezu **command is used for updating  Null-terminated Unicode string .\n\nNotice the first character starts in the 8th offset from the above. So we would have start updating the string only from the 8th offset. The first 8 bytes of object are for syncblock index and method table pointer.\n\nHere is the command to update the string memory.\n\n\u003e ezu 0294d0a0+8 \u0026#8220;Bad\u0026#8221;\n\nAnd the updated form title.\n\n[\u003cimg class=\"alignnone size-full wp-image-1358\" title=\"bad\" src=\"http://104.197.135.42/wp-content/uploads/2011/06/bad2.jpg\" alt=\"\" width=\"301\" height=\"300\" /\u003e][2]\n\n [1]: http://104.197.135.42/wp-content/uploads/2011/06/updatestring13.jpg\n [2]: http://104.197.135.42/wp-content/uploads/2011/06/bad2.jpg"},{"title":"Who is is blocking my UI Thread? Diagnosing the cause using Windbg","date":"2011-04-01T18:59:06Z","permalink":"/?p=1344/","content":"It so happens most of the applications block the UI thread and do sync I/O, which is most common reason for “Not Responding” window. Here is a post \u003chttp://blogs.msdn.com/b/nathannesbit/archive/2010/12/28/detecting-ui-thread-misuse.aspx\u003e that tries helping in detecting this. I like to handle this from bottom of the stack because we have a cool tool called debugger.\n\nThe approach is simple as having a break-point on a function like “KERNEL32!WaitFor*” and checking if the current thread is a UI thread. This could also be done for other functions like Sleep on UI thread by having a break-point on “KERNELBASE!SleepEx”.\n\nHere are steps to determine if a thread is a STA thread / UI Thread. This is information is stored in TEB structure (thread environment block). Here is the output of the teb on the UI Thread\n\n\u003e 0:000\u003e dt ntdll!_TEB @$teb\n  \n\u003e +0x000 NtTib            : \\_NT\\_TIB\n  \n\u003e +0x01c EnvironmentPointer : (null)\n  \n\u003e +0x020 ClientId         : \\_CLIENT\\_ID\n  \n\u003e +0x028 ActiveRpcHandle  : (null)\n  \n\u003e +0x02c ThreadLocalStoragePointer : 0x7efdd02c\n  \n\u003e +0x030 ProcessEnvironmentBlock : 0x7efde000 _PEB\n  \n\u003e +0x034 LastErrorValue   : 0\n  \n\u003e +0x038 CountOfOwnedCriticalSections : 0\n  \n\u003e +0x03c CsrClientThread  : (null)\n  \n\u003e +0x040 Win32ThreadInfo  : (null)\n  \n\u003e +0x044 User32Reserved   : [26] 0\n  \n\u003e +0x0ac UserReserved     : [5] 0\n  \n\u003e +0x0c0 WOW32Reserved    : 0x751b2320\n  \n\u003e +0x0c4 CurrentLocale    : 0x409\n  \n\u003e +0x0c8 FpSoftwareStatusRegister : 0\n  \n\u003e +0x0cc SystemReserved1  : \\[54\\] (null)\n  \n\u003e +0x1a4 ExceptionCode    : 0\n  \n\u003e +0x1a8 ActivationContextStackPointer : 0x001a07d0 \\_ACTIVATION\\_CONTEXT_STACK\n  \n\u003e +0x1ac SpareBytes       : [36]  \u0026#8220;\u0026#8221;\n  \n\u003e +0x1d0 TxFsContext      : 0xfffe\n  \n\u003e +0x1d4 GdiTebBatch      : \\_GDI\\_TEB_BATCH\n  \n\u003e +0x6b4 RealClientId     : \\_CLIENT\\_ID\n  \n\u003e +0x6bc GdiCachedProcessHandle : (null)\n  \n\u003e +0x6c0 GdiClientPID     : 0\n  \n\u003e +0x6c4 GdiClientTID     : 0\n  \n\u003e +0x6c8 GdiThreadLocalInfo : (null)\n  \n\u003e +0x6cc Win32ClientInfo  : [62] 0\n  \n\u003e +0x7c4 glDispatchTable  : \\[233\\] (null)\n  \n\u003e +0xb68 glReserved1      : [29] 0\n  \n\u003e +0xbdc glReserved2      : (null)\n  \n\u003e +0xbe0 glSectionInfo    : (null)\n  \n\u003e +0xbe4 glSection        : (null)\n  \n\u003e +0xbe8 glTable          : (null)\n  \n\u003e +0xbec glCurrentRC      : (null)\n  \n\u003e +0xbf0 glContext        : (null)\n  \n\u003e +0xbf4 LastStatusValue  : 0xc0000139\n  \n\u003e +0xbf8 StaticUnicodeString : \\_UNICODE\\_STRING \u0026#8220;\u0026#8221;\n  \n\u003e +0xc00 StaticUnicodeBuffer : [261]  \u0026#8220;\u0026#8221;\n  \n\u003e +0xe0c DeallocationStack : 0x00320000\n  \n\u003e +0xe10 TlsSlots         : \\[64\\] (null)\n  \n\u003e +0xf10 TlsLinks         : \\_LIST\\_ENTRY [ 0x0 \u0026#8211; 0x0 ]\n  \n\u003e +0xf18 Vdm              : (null)\n  \n\u003e +0xf1c ReservedForNtRpc : 0x001d8c70\n  \n\u003e +0xf20 DbgSsReserved    : \\[2\\] (null)\n  \n\u003e +0xf28 HardErrorMode    : 0\n  \n\u003e +0xf2c Instrumentation  : \\[9\\] (null)\n  \n\u003e +0xf50 ActivityId       : _GUID {00000000-0000-0000-0000-000000000000}\n  \n\u003e +0xf60 SubProcessTag    : (null)\n  \n\u003e +0xf64 EtwLocalData     : (null)\n  \n\u003e +0xf68 EtwTraceData     : (null)\n  \n\u003e +0xf6c WinSockData      : (null)\n  \n\u003e +0xf70 GdiBatchCount    : 0x7efdb000\n  \n\u003e +0xf74 CurrentIdealProcessor : \\_PROCESSOR\\_NUMBER\n  \n\u003e +0xf74 IdealProcessorValue : 0x1010000\n  \n\u003e +0xf74 ReservedPad0     : 0 \u0026#8221;\n  \n\u003e +0xf75 ReservedPad1     : 0 \u0026#8221;\n  \n\u003e +0xf76 ReservedPad2     : 0x1 \u0026#8221;\n  \n\u003e +0xf77 IdealProcessor   : 0x1 \u0026#8221;\n  \n\u003e +0xf78 GuaranteedStackBytes : 0x1000\n  \n\u003e +0xf7c ReservedForPerf  : (null)\n  \n\u003e +0xf80 ReservedForOle   : 0x001ffd50\n\nI have shown only the partial output because we are interested only in \u0026#8220;**ReservedForOle**\u0026#8221; member which is in the **oxf80** offset. Within this structure in \u0026#8220;**0xc**\u0026#8221; offset contains the information on whether it is STA / MTA / Unkown and here is a write up on this from John Robbins \u003chttp://www.microsoft.com/msj/1099/bugslayer/bugslayer1099.aspx\u003e.  Though the posts mentions STA as **0x80** and MTA as **0x140** with current version of windows value of STA is **81** \u003cspan style=\"font-size:x-small;\"\u003e\u003cspan style=\"font-size:x-small;\"\u003e\u003cstrong\u003e\u003cspan style=\"font-size:x-small;\"\u003e \u003c/span\u003e\u003c/strong\u003e\u003c/span\u003e\u003c/span\u003eand MTA is **141**.\n  \nWith this information it was pretty easy to create a script which will give us a call-stack if a UI Thread is blocking.\n\n[sourcecode]\n  \nbm KERNEL32!WaitFor* \".if (poi(@$teb+0xf80) != 0) { .if (poi(poi(@$teb+0xf80)+0xc) = 81) {!clrstack;g} .else {g}} .else {gh}\"\n  \nbp KERNELBASE!SleepEx \".if (poi(@$teb+0xf80) != 0) { .if (poi(poi(@$teb+0xf80)+0xc) = 81) {!clrstack;g} .else {g}} .else {gh}\"\n  \n[/sourcecode]\n\nHere is a example call-stack from the above break-point which indicates that we are blocking on the UI Thread\n\n\u003e OS Thread Id: 0x76c (0)\n  \n\u003e Child SP IP       Call Site\n  \n\u003e 0029e74c 775c118e [InlinedCallFrame: 0029e74c]\n  \n\u003e 0029e748 5affbc00 DomainBoundILStubClass.IL\\_STUB\\_PInvoke(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, IntPtr, UInt32, System.Net.SocketConstructorFlags)\n  \n\u003e 0029e74c 5afa72e4 [InlinedCallFrame: 0029e74c] System.Net.UnsafeNclNativeMethods+OSSOCK.WSASocket(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, IntPtr, UInt32, System.Net.SocketConstructorFlags)\n  \n\u003e 0029e7a4 5afa72e4 System.Net.Sockets.Socket.InitializeSockets()\n  \n\u003e 0029e7f4 5afcc3ca System.Net.NetworkAddressChangePolled..ctor()\n  \n\u003e 0029e808 5afcc326 System.Net.AutoWebProxyScriptEngine+AutoDetector.Initialize()\n  \n\u003e 0029e838 5af7534d System.Net.AutoWebProxyScriptEngine+AutoDetector.get_CurrentAutoDetector()\n  \n\u003e 0029e83c 5af75263 System.Net.AutoWebProxyScriptEngine..ctor(System.Net.WebProxy, Boolean)\n  \n\u003e 0029e858 5af75202 System.Net.WebProxy.UnsafeUpdateFromRegistry()\n  \n\u003e 0029e868 5af751c8 System.Net.WebProxy..ctor(Boolean)\n  \n\u003e 0029e86c 5af74c79 System.Net.Configuration.DefaultProxySectionInternal..ctor(System.Net.Configuration.DefaultProxySection)\n  \n\u003e 0029e8b0 5af748d2 System.Net.Configuration.DefaultProxySectionInternal.GetSection()\n  \n\u003e 0029e8e4 5afcbf76 System.Net.WebRequest.get_InternalDefaultWebProxy()\n  \n\u003e 0029e914 5afcbc86 System.Net.HttpWebRequest..ctor(System.Uri, System.Net.ServicePoint)\n  \n\u003e 0029e92c 5afcbbcb System.Net.HttpRequestCreator.Create(System.Uri)\n  \n\u003e 0029e938 5afcb772 System.Net.WebRequest.Create(System.Uri, Boolean)\n  \n\u003e 0029e95c 5af94cad System.Net.WebRequest.Create(System.String)\n  \n\u003e 0029e96c 0087056e WindowsFormsApplication1.Form1.\u003c.ctor\u003eb__0(System.Object, System.EventArgs) [C:UsersnaveenDocumentsVisual Studio 2010ProjectsWindowsFormsApplication1WindowsFormsApplication1Form1.cs @ 15]\n  \n\u003e 0029e9ac 592b4ae8 System.Windows.Forms.Control.OnClick(System.EventArgs)\n  \n\u003e 0029e9c4 592b70a2 System.Windows.Forms.Button.OnClick(System.EventArgs)\n  \n\u003e 0029e9dc 59846174 System.Windows.Forms.Button.OnMouseUp(System.Windows.Forms.MouseEventArgs)\n  \n\u003e 0029e9f8 598195b5 System.Windows.Forms.Control.WmMouseUp(System.Windows.Forms.Message ByRef, System.Windows.Forms.MouseButtons, Int32)\n  \n\u003e 0029ea8c 59bda1bf System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 0029ea90 59be18dd [InlinedCallFrame: 0029ea90]\n  \n\u003e 0029eae4 59be18dd System.Windows.Forms.ButtonBase.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 0029eb28 5931de00 System.Windows.Forms.Button.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 0029eb34 593070f3 System.Windows.Forms.Control+ControlNativeWindow.OnMessage(System.Windows.Forms.Message ByRef)\n  \n\u003e 0029eb3c 59307071 System.Windows.Forms.Control+ControlNativeWindow.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 0029eb50 59306fb6 System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr)\n  \n\u003e 0029ecf4 01010a35 [InlinedCallFrame: 0029ecf4]"},{"title":"Correlating between .NET and native thread in Windbg","date":"2011-01-09T01:46:06Z","permalink":"/?p=1324/","content":"I recently saw a stackoverflow question where  someone wanted to know how they could correlate between  managed and native threads within Windbg.\n\nHere is the managed thread object within the debugger\n\n\u003e 0:004\u003e !do 02a1d6c4\n  \n\u003e Name:        System.Threading.Thread\n  \n\u003e MethodTable: 672e001c\n  \n\u003e EEClass:     67018ed8\n  \n\u003e Size:        48(0x30) bytes\n  \n\u003e File:        C:WindowsMicrosoft.NetassemblyGAC\\_32mscorlibv4.0\\_4.0.0.0__b77a5c561934e089mscorlib.dll\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 672c8a78  4000720        4 \u0026#8230;.Contexts.Context  0 instance 00000000 m_Context\n  \n\u003e 672db4b8  4000721        8 \u0026#8230;.ExecutionContext  0 instance 00000000 m_ExecutionContext\n  \n\u003e 672df9fc  4000722        c        System.String  0 instance 02a1a220 m_Name\n  \n\u003e 672dfed0  4000723       10      System.Delegate  0 instance 00000000 m_Delegate\n  \n\u003e 672e63f4  4000724       14 \u0026#8230;ation.CultureInfo  0 instance 00000000 m_CurrentCulture\n  \n\u003e 672e63f4  4000725       18 \u0026#8230;ation.CultureInfo  0 instance 00000000 m_CurrentUICulture\n  \n\u003e 672df638  4000726       1c        System.Object  0 instance 00000000 m_ThreadStartArg\n  \n\u003e \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e672daa7c  4000727       20        System.IntPtr  1 instance   542560 DONT_USE_InternalThread\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 672e29c8  4000728       24         System.Int32  1 instance        2 m_Priority\n  \n\u003e 672e29c8  4000729       28         System.Int32  1 instance        3 m_ManagedThreadId\n  \n\u003e 672cb76c  400072a      18c \u0026#8230;LocalDataStoreMgr  0   shared   static s_LocalDataStoreMgr\n  \n\u003e \u003e\u003e Domain:Value  0049f148:NotInit  \u003c\u003c\n  \n\u003e 672ce328  400072b        c \u0026#8230;alDataStoreHolder  0   shared TLstatic s_LocalDataStore\n  \n\u003e \u003e\u003e Thread:Value \u003c\u003c\n\nThe present thread’s @$teb (Thread Environment Block) is \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e7efac000\u003c/strong\u003e\u003c/span\u003e\n\n0:004\u003e ? @$teb Evaluate expression: 2130374656 = 7efac000\n\nThe DONT\\_USE\\_InternalThread is pointer to the native thread. Dumping the raw memory of the pointer should give us more information we are looking for.\n\n\u003e 0:004\u003e dd poi(02a1d6c4+20)\n  \n\u003e 00542560  67e9ee88 0000b220 00000000 056ef42c\n  \n\u003e 00542570  00000000 00000000 00000000 00000003\n  \n\u003e 00542580  00000000 00542588 00542588 00542588\n  \n\u003e 00542590  00000000 00000000 baad0000 004a4f30\n  \n\u003e 005425a0  \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e7efac000\u003c/strong\u003e\u003c/span\u003e baadf00d 00000000 00000000\n  \n\u003e 005425b0  00024dac 00000000 00000000 00000000\n  \n\u003e 005425c0  00000000 baadf00d 00541ba0 00544290\n  \n\u003e 005425d0  00544298 00000200 00544290 00544580\n\nThe pointer to teb is in the 40th offset of the  DONT\\_USE\\_InternalThread and here is the script that would get teb for each managed thread.\n\n[sourcecode]\n  \n.foreach ($thread {!dumpheap -mt 672e001c -short}) { .if ( poi(${$thread}+20) != 0) {.printf \"%p n\",dwo(poi(${$thread}+20)+40)}}\n  \n[/sourcecode]\n\n\u003e 0:004\u003e .foreach ($thread {!dumpheap -mt 672e001c -short}) { .if ( poi(${$thread}+20) != 0) {.printf \u0026#8220;%p n\u0026#8221;,dwo(poi(${$thread}+20)+40) }}\n  \n\u003e 7efdd000\n  \n\u003e 7efac000\n  \n\u003e 7ef9a000\n  \n\u003e 7ef97000\n  \n\u003e 7ef2f000\n  \n\u003e 7ef26000\n  \n\u003e 7efd7000\n  \n\u003e 7ef20000\n  \n\u003e 7ef1d000\n  \n\u003e 7ef1d000\n  \n\u003e 7ef0e000\n  \n\u003e 7efa3000\n  \n\u003e 7ef2c000\n\nSo with the above we could dump the teb structure using dt ntdll!_TEB command. In the next post I will demonstrate how this can be used to debug some cool stuff 🙂\u003c!--more--\u003e"},{"title":"Conditional BreakPoint based on callstack within Windbg – .NET","date":"2010-12-29T02:00:12Z","permalink":"/?p=1314/","content":"Someone recently asked me \u0026#8220;How to have a break-point on a method based on certain function in the call-stack?\u0026#8221;\n\nHere is the sample code to demonstrate this\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nusing System.Threading.Tasks;\n  \nusing System.Data.SqlClient;\n  \nnamespace Test\n  \n{\n      \nclass Program\n      \n{\n          \nstring connectionString = @\"Data Source=.sqlexpress;Initial Catalog=Tfs_Configuration;Integrated Security=True\";\n          \npublic void Bar()\n          \n{\n              \nusing (var c = new SqlConnection(connectionString))\n              \n{\n                  \nc.Open();\n                  \nvar command = new SqlCommand(@\"update [tbl_AccessMapping] set [DisplayName] = @param\", c);\n                  \ncommand.Parameters.Add(new SqlParameter(\"param\", \"Bar\"));\n                  \ncommand.ExecuteNonQuery();\n              \n}\n          \n}\n          \npublic void Foo()\n          \n{\n              \nusing (var c = new SqlConnection(connectionString))\n              \n{\n                  \nc.Open();\n                  \nvar command = new SqlCommand(@\"update [tbl_AccessMapping] set [DisplayName] = @param\", c);\n                  \ncommand.Parameters.Add(new SqlParameter(\"param\", \"Foo\"));\n                  \ncommand.ExecuteNonQuery();\n              \n}\n          \n}\n          \nstatic void Main(string[] args1)\n          \n{\n              \nvar s = new Program();\n              \nParallel.For(0, 2, (i) =\u003e s.Bar());\n              \nParallel.For(0, 2, (i) =\u003e s.Foo());\n              \nConsole.Read();\n          \n}\n      \n}\n  \n}\n\n[/sourcecode]\n\nThe requirement is to have a break-point on \u0026#8220;ExecuteNonQuery\u0026#8221; but it should break only if it is invoked from \u0026#8220;Foo\u0026#8221; and not from \u0026#8220;Bar\u0026#8221;.\n\nLaunched the exe within windbg and loaded sos,sosex and set a bp on System.Data.SqlClient.SqlCommand.ExecuteNonQuery suing !mbm\n\nAnd when the break-point hits the first time updated the bp using\n\n\u003e bs 0  $$\u003ea\u003c\u0026#8220;d:Debuggersx86ConditionalBP.txt\u0026#8221; Foo\n\nHere are the contents of ConditionalBP.txt\n\n[sourcecode]\n  \nad /q Contains\n  \naS /c Contains .shell -ci \"!CLRStack\" FINDSTR $arg1\n  \n.block {\n              \n.if ($spat(\"${Contains}\",\"\\*${$arg1}\\*\"))\n                  \n{\n                   \n!CLRStack\n                  \n}\n             \n.else\n                  \n{\n                  \ng\n                  \n}\n       \n}\n  \nad /q Contains\n  \n[/sourcecode]"},{"title":"Saving Dynamic Assembly in .NET 4.0 using Windbg","date":"2010-12-23T23:37:45Z","permalink":"/?p=1298/","content":"I recently had to debug a .NET 4.0 process which was loading the dependent assemblies using the \u003ca href=\"http://msdn.microsoft.com/en-us/library/system.appdomain.assemblyresolve.aspx\" target=\"_blank\"\u003eAppDomain.AssemblyResolve\u003c/a\u003e event. The dependent assemblies were stored within the executable. I couldn’t disassemble the code to look for the dependent assembly because the exe was obfuscated. FYI the dynamic assembly cannot be saved using !SaveModule and here is the reason for [I recently had to debug a .NET 4.0 process which was loading the dependent assemblies using the \u003ca href=\"http://msdn.microsoft.com/en-us/library/system.appdomain.assemblyresolve.aspx\" target=\"_blank\"\u003eAppDomain.AssemblyResolve\u003c/a\u003e event. The dependent assemblies were stored within the executable. I couldn’t disassemble the code to look for the dependent assembly because the exe was obfuscated. FYI the dynamic assembly cannot be saved using !SaveModule and here is the reason for][1] read the comments especially from Evian. Unlike psscor2.dll the sos for .NET 4.0 does not have a !dumpdynamicassembly with a save option.\n\nHere is the sample code to demonstrate this.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nusing System.Reflection;\n  \nusing TestLib;\n  \nnamespace Test\n  \n{\n   \nclass Foo1\n   \n{\n   \nint[] s = new int[2];\n   \nint v = 100;\n   \npublic Foo1()\n   \n{\n   \nConsole.WriteLine(new Class1().Foo());\n   \n}\n   \nstatic void Main(string[] args1)\n   \n{\n   \nAppDomain.CurrentDomain.AssemblyResolve += (sender, args) =\u003e\n   \n{\n   \nString resourceName = \"ConsoleApplication13.\" +new AssemblyName(args.Name).Name + \".dll\";\n   \nusing (var stream = Assembly.GetExecutingAssembly().GetManifestResourceStream(resourceName))\n   \n{\n   \nByte[] assemblyData = new Byte[stream.Length];\n   \nstream.Read(assemblyData, 0, assemblyData.Length);\n   \nreturn Assembly.Load(assemblyData);\n   \n}\n   \n};\n   \nSystem.IO.File.Delete(@\"C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication13binDebugTestLib.dll\");\n   \nvar s = new Foo1();\n   \nConsole.Read();\n   \n}\n   \n}\n  \n}\n\n[/sourcecode]\n\nI knew the Assembly had to be loaded using  System.Reflection.Assembly.Load(Byte[]) ,so ended setting a break-point on the method using command !mbm \\*Assembly.Load\\* on the launch of the executable.\n\nHere are the output of args and local variables for the above break-point\n\n\u003e 0:000\u003e !mdv\n  \n\u003e Frame 0x0: (System.Reflection.Assembly.Load(Byte[])):\n  \n\u003e [A0]:rawAssembly:0x025fc374 (System.Byte[])\n  \n\u003e [L0]:\u003c?\u003e\n\nNotice the \u0026#8220;rawAssembly\u0026#8221; argument which has the assembly contents.  Here are the raw memory contents of the address using dd 0x025fc374\n\n\u003e 0:000\u003e dd 0x025fc374\n  \n\u003e 025fc374  \u003cspan style=\"color:#ff0000;\"\u003e6a764994 00001000\u003c/span\u003e 00905a4d 00000003\n  \n\u003e 025fc384  00000004 0000ffff 000000b8 00000000\n  \n\u003e 025fc394  00000040 00000000 00000000 00000000\n  \n\u003e 025fc3a4  00000000 00000000 00000000 00000000\n  \n\u003e 025fc3b4  00000000 00000080 0eba1f0e cd09b400\n  \n\u003e 025fc3c4  4c01b821 685421cd 70207369 72676f72\n  \n\u003e 025fc3d4  63206d61 6f6e6e61 65622074 6e757220\n  \n\u003e 025fc3e4  206e6920 20534f44 65646f6d 0a0d0d2e\n\n  1. \u003cspan style=\"color:#ff0000;\"\u003e6a764994 \u003cspan style=\"color:#000000;\"\u003e:- Is the Array\u0026#8217;s  Method Table\u003c/span\u003e\u003c/span\u003e\n  2. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#000000;\"\u003e\u003cspan style=\"color:#ff0000;\"\u003e00001000\u003c/span\u003e : \u0026#8211; Is the Array size\u003c/span\u003e\u003c/span\u003e\n  3. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#000000;\"\u003eThe rest are the array contents.\u003cbr /\u003e \u003c/span\u003e\u003c/span\u003e\n\nUnlike the reference type arrays, the value type arrays  don\u0026#8217;t have a DWORD for Method table of its contents. With this information I could dump the contents from memory in to disk using .writemem command.\n\n[sourcecode]\n\n.writemem c:tempassembly.bin @ecx+8 L?(poi(@ecx+@$ptrsize)*@$ptrsize)\n\n[/sourcecode]\n\nIn x86 @ecx register contains argument for rawAssembly. The  @ecx+8 is the start  position of the first byte and that is the reason for using this as the start position for .writemem. The poi(@ecx+@$ptrsize) contains the array size which in our case is 0001000 and multiply it by @$ptrsize which is 4 in x86. The expression (poi(@ecx+@$ptrsize)*@$ptrsize) would in our case result to 4000 bytes.\n\nThe assembly.bin would contain data in hex format which has to be converted in to binary format. Here is the code to convert from Hex to Binary format.\n\n[sourcecode]\n  \nAssembly.Load( File.ReadAllBytes(@\"c:tempassembly.bin\")\n   \n.Select(x =\u003e\n   \nConvert.ToByte(\n   \nint.Parse((x.ToString(\"X\")),NumberStyles.HexNumber)\n   \n)).ToArray())\n  \n.FullName.Dump();\n  \n[/sourcecode]\n\n [1]: http://stackoverflow.com/questions/1872502/how-to-save-a-dynamically-generated-assembly-that-is-stored-in-memory/1872588#1872588"},{"title":"Dumping Generic List  in .NET within Windbg","date":"2010-12-10T03:15:43Z","permalink":"/?p=1281/","content":"Most of the code uses List\u003cT\u003e for storing items.  The present solutions don\u0026#8217; t have a way to dump List\u003cT\u003e within windbg. Even though sosex has an option to dump the List\u003cT\u003e using !mdt it still doesn\u0026#8217;t meet the scripting requirements. For example here is an output using sosex \u0026#8220;!mdt -e 029a91c0\u0026#8221;\n\n\u003e 0:000\u003e !mdt -e 029a91c0\n  \n\u003e 029a91c0 (System.Collections.Generic.List\\`1[[Test.Foo, Test]])\n  \n\u003e Count = 2\n  \n\u003e [0] 029a9200 (Test.Foo)\n  \n\u003e [1] 029a9210 (Test.Foo)\n\nI would have preferred to get the contents of the \u0026#8220;Foo\u0026#8221; object instead of just the address of Foo. So wrote a script to do that.\n\n[sourcecode]\n\n$$ pointer to the array within the List\n  \nr @$t5 = poi(${$arg1}+@$ptrsize)\n\n.if (@$ptrsize = 8 )\n   \n{\n      \nr @t7 = 20\n   \n}\n   \n.else\n   \n{\n      \nr @$t7 = 10\n   \n}\n\n.for (r $t0=0; @$t0 \u003c poi(@$t5+@$ptrsize); r$t0=@$t0+1 )\n   \n{\n       \n.if(@$t0 = 0)\n       \n{\n           \n$$ First occurence of the element in the array would be in the 20 offset for x64 and 10 offset for x86\n           \nr$t1=@$t7\n       \n}\n       \n.else\n       \n{\n           \n$$ the rest of the elements would be in the 8th offset for x64 and 4th offset for x86\n           \nr$t1= @$t7+(@$t0*@$ptrsize)\n       \n}\n       \n$$ Check for null before trying to dump\n       \n.if (poi((@$t5-@$ptrsize)+@$t1) = 0 )\n       \n{\n       \n.continue\n       \n}\n       \n.else\n       \n{\n       \n.printf \u0026quot;%N n\u0026quot; ,poi((@$t5-@$ptrsize)+@$t1)\n       \n}\n   \n} \n\n[/sourcecode]\n\nThis script should work in x86 and x64. To use the above script copy to a file and invoke it like this passing the address of List\u003cT\u003e\n\n\u003e $$\u003ea\u003c\"d:Debuggersx86dumplist.txt\" 029a91c0\n\nHere is the output from the above command.\n\n\u003e 0:000\u003e $$\u003ea\u003c\"d:Debuggersx86dumplist.txt\" 029a91c0\n  \n\u003e 029A9200\n  \n\u003e 029A9210 \n\nNow with this script I can use !mdt to get the contents of the \u0026#8220;Foo\u0026#8221; object. \n\n[sourcecode]\n  \n.foreach ($obj {$$\u003ea\u003c\"d:Debuggersx86dumplist.txt\" 029a91c0}) {!mdt $obj}\n  \n[/sourcecode]\n\n\u003e 0:000\u003e .foreach ($obj {$$\u003ea\u003c\"d:Debuggersx86dumplist.txt\" 029a91c0}) {!mdt $obj}\n  \n\u003e 029a9200 (Test.Foo)\n      \n\u003e counter:0x1 (System.Int32)\n      \n\u003e Name:029a917c (System.String: \"test\")\n  \n\u003e 029a9210 (Test.Foo)\n      \n\u003e counter:0x2 (System.Int32)\n      \n\u003e Name:029a9198 (System.String: \"test2\")\n\nThis is one of the scripts that I would use often. Hope it is useful to others also."},{"title":"Why isn’t the !bpmd in sos / windbg not working?","date":"2010-12-06T00:16:53Z","permalink":"/?p=1271/","content":"I recently noticed another blog \u003ca title=\"http://bugslasher.net/2010/11/01/how-to-break-on-the-main-function-with-the-net-clr-4-0-and-windbg/\" href=\"http://bugslasher.net/2010/11/01/how-to-break-on-the-main-function-with-the-net-clr-4-0-and-windbg/\" target=\"_blank\"\u003epost \u003c/a\u003erefer to one of my \u003ca title=\"Exploring undocumented SOS function in Windbg - .NET 4.0\" href=\"http://naveensrinivasan.com/2010/02/25/exploring-undocumented-sos-function-in-windbg-net-4-0-2/\" target=\"_blank\"\u003epost\u003c/a\u003e. The issue was, sos wasn\u0026#8217;t enabling the break-points on non-jitted functions. The classic example being \u0026#8220;Main\u0026#8221;.  Thanks to \u003ca title=\"http://www.stevestechspot.com/\" href=\"http://www.stevestechspot.com/\" target=\"_blank\"\u003eSteve \u003c/a\u003e I have been using sosex and not sos for setting break-points.\n\nFrom my previous \u003ca title=\"Exploring undocumented SOS function in Windbg - .NET 4.0\" href=\"http://naveensrinivasan.com/2010/02/25/exploring-undocumented-sos-function-in-windbg-net-4-0-2/\" target=\"_blank\"\u003epost \u003c/a\u003e you can understand how CLR is using clrn/CLRNotificationException to notify sos/sosex on JIT. With this information when I looked at the rotor \u003ca title=\"dacnotify\" href=\"http://www.koders.com/cpp/fidE4A1216FEC6BAA94CFA451D983819AE0CC78C073.aspx\" target=\"_blank\"\u003ecode\u003c/a\u003e, I noticed an interesting member variable \u0026#8220;g_dacNotificationFlags\u0026#8221;. So I decided to check the value of this variable when using !bpmd from sos and !mbm from sosex.\n\n[sourcecode]\n\n.if (dwo(mscorwks!g_dacNotificationFlags) = 0) {.echo bp not set } .else {.echo bp set}\n\n[/sourcecode]\n\nIt was \u0026#8220;0\u0026#8221; when using sos and \u0026#8220;1\u0026#8221; when using sosex. Now I had to change the value to \u0026#8220;1\u0026#8221; and check if the break-point becomes active when using sos\u0026#8217;s !bpmd.  FYI I don\u0026#8217;t have private symbols and haven\u0026#8217;t seen CLR Code. Here is the code to set the value to \u0026#8220;1\u0026#8221;.\n\n[sourcecode]\n\ned mscorwks!g_dacNotificationFlags 00000001\n\n[/sourcecode]\n\nAnd not to my surprise the !bpmd seems to work for non-jitted function with the above hack. FYI we don\u0026#8217;t have to resort to this to get !bpmd to work. If the !bpmd is set after load of mscorjit/clrjit it would work as expected."},{"title":"Using sosex within windbg to understand IL and Assembly code","date":"2010-11-30T01:33:25Z","permalink":"/?p=1261/","content":"Sometimes when debugging managed code within the debugger I would like to see the C# code ,the IL translation for the managed code and the Assembly code for the IL. For example I recently learned that callvirt MSIL instruction must do the null-check before invoking method.\n\n\u003e C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication13Program.cs @ 18:\n  \n\u003e 00bc26d8 8b4dec          mov     ecx,dword ptr [ebp-14h]\n  \n\u003e 00bc26db 3909            cmp     dword ptr [ecx],ecx //NULL Check\n  \n\u003e 00bc26dd ff1508a82900    call    dword ptr ds:\\[29A808h\\] (System.String.ToLower(), mdToken: 0600031d)\n  \n\u003e 00bc26e3 8945e8          mov     dword ptr [ebp-18h],eax\n  \n\u003e 00bc26e6 8b45e8          mov     eax,dword ptr [ebp-18h]\n  \n\u003e 00bc26e9 8945ec          mov     dword ptr [ebp-14h],eax\n\nI am not an assembly code expert. The above output is from \u0026#8220;!u\u0026#8221; sos command. It doesn\u0026#8217;t show the c# code except the line number and it is missing IL translation.\n\nThe \u0026#8220;!mu\u0026#8221; from sosex does what I want. It is not yet documented because it is not yet stable as per the output of the command. Here is the output for the same call-stack using sosex\u0026#8217;s !mu.\n\n\u003e 0:000\u003e !mu\n  \n\u003e THIS COMMAND IS UNDOCUMENTED AND NOT YET STABLE.\n  \n\u003e test = test.ToLower();\n  \n\u003e IL_001a: ldloc.0  (test)\n  \n\u003e IL_001b: callvirt System.String::ToLower\n  \n\u003e 00bc26d8 8b4dec          mov     ecx,dword ptr [ebp-14h]\n  \n\u003e 00bc26db 3909            cmp     dword ptr [ecx],ecx\n  \n\u003e 00bc26dd ff1508a82900    call    dword ptr ds:[29A808h]\n  \n\u003e 00bc26e3 8945e8          mov     dword ptr [ebp-18h],eax\n  \n\u003e IL_0020: stloc.0  (test)\n  \n\u003e 00bc26e6 8b45e8          mov     eax,dword ptr [ebp-18h]\n  \n\u003e 00bc26e9 8945ec          mov     dword ptr [ebp-14h],eax\n\nThe above output has c#,IL and assembly."},{"title":"Windbg trick – Having custom name for user-defined pseudo-registers","date":"2010-11-23T01:07:53Z","permalink":"/?p=1246/","content":"There are 20 [user-defined pseudo-registers][1] (**$t0**, **$t1**, \u0026#8230;, **$t19**) in windbg/cdb . To have scripts with variable names as @$t0 and @$t1 isn\u0026#8217;t helpful for readability. The trick to avoid this is by using the \u0026#8220;aS\u0026#8221; command.\n\nHere is an example, for a loop variable I would like to use a variable name like \u0026#8220;i\u0026#8221; instead of \u0026#8220;@$t0\u0026#8221; and to use \u0026#8220;i\u0026#8221;  as a variable  here is the command\n\n\u003e aS i \u0026#8220;@$t0\u0026#8221;\n\nNow\u0026#8221;i\u0026#8221; is just an alias for \u0026#8220;@$t0\u0026#8221;.  Here is another example of using \u0026#8220;i\u0026#8221; in the comparison statement\n\n\u003e j (${i} =0) \u0026#8216;.echo is zero\u0026#8217; ; \u0026#8216;.echo is not zero\u0026#8217;\n\nThis is the command to remove the alias without evaluating it.\n\n\u003e ad ${/v:i}\n\n [1]: http://msdn.microsoft.com/en-us/library/ff553485(VS.85).aspx"},{"title":"Decoding clr20r3 .NET exception – using mono cecil","date":"2010-11-17T02:01:13Z","permalink":"/?p=1208/","content":"I have often seen Devs trying to figure out the cause of the app crash without a memory dump. The only information that is available to analyze is the Windows Error Reporting message in the event viewer which would have \u0026#8220;Event Name: CLR20r3\u0026#8221; along with [Watson bucket][1] information like this.\n\n\u003e Fault bucket , type 0\n  \n\u003e Event Name: CLR20r3\n  \n\u003e Response: Not available\n  \n\u003e Cab Id: 0\n\u003e \n\u003e Problem signature:\n  \n\u003e P1: unhandledexception.exe\n  \n\u003e P2: 1.0.0.0\n  \n\u003e P3: 4ce1e0f1\n  \n\u003e P4: LibraryCode\n  \n\u003e P5: 1.0.0.0\n  \n\u003e P6: 4ce1e0f1\n  \n\u003e P7: 7\n  \n\u003e P8: 1f\n  \n\u003e P9: System.NullReferenceException\n  \n\u003e P10:\n\nI will demonstrate the steps in identifying the code that caused the app to crash with the above information.Here is the explanation on the Watson Bucket items \n\n\u003e   1. P1: unhandledexception.exe \u0026#8211; is the Exe File Name\n\u003e   2. P2:1.0.0.0 \u0026#8211; is the Exe File assembly version number\n\u003e   3. P3:4ce1e0f1- is the Exe File Stamp\n\u003e   4. P4:LibraryCode- is the Faulting full assembly name\n\u003e   5. P5:1.0.0.0- is the Faulting assembly version\n\u003e   6. P6:4ce1e0f1- is the Faulting assembly timestamp\n\u003e   7. P7:7- is the Faulting assembly method def\n\u003e   8. P8:1f-  is Faulting method IL Offset within the faulting method\n\u003e   9. P9:System.NullReferenceException- is Exception type that was thrown\n\u003e \n\u003e \u0026nbsp;\n\nHere is the LibraryCode that is mentioned in P4 of the watson bucket\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221; highlight=\u0026#8221;42,43\u0026#8243;]\n  \nusing System;\n\nnamespace LibraryCode\n  \n{\n      \npublic class Foo\n      \n{\n          \npublic Foo()\n          \n{\n              \nConsole.WriteLine(\"Constructor\");\n          \n}\n          \npublic void Test()\n          \n{\n              \nConsole.WriteLine(\"Test\");\n          \n}\n          \npublic string Bar(string test)\n          \n{\n              \nvar x = test;\n              \nreturn x.ToUpper();\n          \n}\n          \npublic string Bar1(string test)\n          \n{\n              \nvar x = test;\n              \nreturn x.ToUpper();\n          \n}\n          \npublic string Bar2(string test)\n          \n{\n              \nvar x = test;\n              \nreturn x.ToUpper();\n          \n}\n          \npublic string Bar3(string test)\n          \n{\n              \nvar x = test;\n              \nreturn x.ToUpper();\n          \n}\n          \npublic string Bar4(string test)\n          \n{\n              \nint j = 10;\n              \nfor (int i = 0; i \u003c 10; i++)\n              \n{\n                  \nj += i;\n              \n}\n              \nvar x = test;\n              \nreturn x.ToUpper();\n          \n}\n      \n}\n  \n}\n\n[/sourcecode]\n\nAnd here is the code for the Main method calling the LibraryCode\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n    \nstatic void Main(string[] args)\n          \n{\n              \nvar f = new Foo();\n              \nvar x = Console.ReadKey();\n              \nf.Bar4(null);\n          \n}\n  \n[/sourcecode]\n\nThe most important items in the above watson bucket are 4,7 ,8 and 9. The item 4 is the assembly that was responsible for the crash which is \u0026#8220;LibraryCode\u0026#8221;. The item 7 is methoddef that threw the exception which is \u0026#8220;7\u0026#8221;. To identify the method we would have to dump the IL and here is the command to do that.\n\n[sourcecode]\n  \nildasm /tokens \"C:tempLibraryCode.dll\" /out=libcode.il\n  \n[/sourcecode]\n\nOpen the libcode.il in a text editor and look for 06000007. The methoddef starts with 06 and 7 is the hex value and when converted to decimal it is still 7 and that\u0026#8217;s how we ended with 06000007. The IL content for the corresponding method def\n\n\u003e .method /\\*06000007\\*/ public hidebysig instance string\n  \n\u003e Bar4(string test) cil managed\n  \n\u003e {\n  \n\u003e // Code size       42 (0x2a)\n\nWith this we know the method that caused the app to crash. \n\nThe next step is to identify the faulting IL code within the method. The IL offset that caused the exception to be thrown is 1f (decimal value is 31), and here is the IL Code\n\n\u003e IL_001d:  ldarg.1\n  \n\u003e IL_001e:  stloc.2\n  \n\u003e IL_001f:  ldloc.2\n  \n\u003e IL_0020:  callvirt   instance string [mscorlib/\\*23000001\\*/]System.String/\\*01000013\\*/::ToUpper() /\\* 0A000012 \\*/\n  \n\u003e IL_0025:  stloc.3\n  \n\u003e IL\\_0026:  br.s       IL\\_0028\n\nNow mapping the IL code back to C# shouldn\u0026#8217;t be hard. \n\nAnd If you are like me then you would probably want to automate things , so here is doing the same using [Mono Cecil][2]\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nAssemblyFactory.GetAssembly(@\"C:TempLibraryCode.dll\")\n\t\t  \n.MainModule.Types.Cast\u003cTypeDefinition\u003e()\n\t\t  \n.ElementAt(1)\n\t\t  \n.Methods.Cast\u003cMethodDefinition\u003e().First(md =\u003e md.MetadataToken.RID == 7)\n\t\t  \n.Body.Instructions.Cast\u003cInstruction\u003e()\n\t\t  \n.Select (i =\u003e\n\t\t\t  \nnew {Offset = i.Offset,\n\t\t\t  \nOpCode = i.OpCode.ToString() ,\n\t\t\t  \nOperand = i.Operand != null ? i.Operand.ToString() : string.Empty} )\n\t\t  \n.Dump();\n  \n[/sourcecode]\n\nNotice the above code looks for methoddef \u0026#8220;7\u0026#8221; which is the P7 item in the Watson bucket.The code could have just dumped 31st IL offset which is \u0026#8220;ldloc.2\u0026#8221; but that would not help , I like to see the entire method to figure out the cause of the exception.\n\nAnd here is the output from above code.\n\n[\u003cimg class=\"alignnone size-full wp-image-1211\" title=\"monocecil\" src=\"http://104.197.135.42/wp-content/uploads/2010/11/monocecil2.png\" alt=\"\" width=\"509\" height=\"648\" /\u003e][3]\n\nWe cannot get the call-stack for the crash with just watson buckets.\n\n [1]: http://naveensrinivasan.com/2010/04/24/exploring-unhandledexception-in-net-and-watson-buckets/\n [2]: http://www.mono-project.com/Cecil\n [3]: http://104.197.135.42/wp-content/uploads/2010/11/monocecil2.png"},{"title":"Script to !SaveAllModules in .NET 4.0 SOS within Windbg","date":"2010-11-12T19:29:06Z","permalink":"/?p=1202/","content":"The .NET 4.0 sos doesn’t have save all modules (!SaveAllModules) command. It only has !SaveModule. Recently I was debugging a .NET 4.0 process for which I had to save all the modules. Here is a script that does !SaveAllModules.\n\n[sourcecode]\n\n!for\\_each\\_module .if ($spat (\"${@#ImageName}\",\"*.exe\")) { !SaveModule ${@#Base} c:temp${@#ModuleName}.exe } .else { !SaveModule ${@#Base} c:temp${@#ModuleName}.dll }\n\n[/sourcecode]"},{"title":"Using Managed Code to debug Memory Dumps","date":"2010-11-11T22:21:02Z","permalink":"/?p=1168/","content":"I happened to notice the new [I happened to notice the new][1] and it had COM based API for dbgeng. The sample code were in VB Script. I much comfortable writing managed code compared to VB script. So I  decided to use COM based API in managed code.\n\nHere are couple of ways to solve certain problems using this\n\n  1. **Parallel GC Roots** :- Getting GC Roots from memory dump is the most time consuming because SOS is single threaded. I use PFX to do them in parallel.\n  2. **Reconstructing manged objects** :- Creating an instance of an object by reading data from the memory dump.\n\nNeed to add reference to the COM Library\n\n[\u003cimg class=\"alignnone size-full wp-image-1171\" title=\"dbghost\" src=\"http://104.197.135.42/wp-content/uploads/2010/11/dbghost2.png\" alt=\"\" width=\"700\" height=\"403\" /\u003e][2]\n\nAnd in VS2010 (.NET 4.0) by default  COM Interop types have  Embed Interop Types turned on. I couldn\u0026#8217;t compile the code with this option. I had to turn off Embed Interop types.\n\nFew extension methods for the DbgObj\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nstatic class DbgExtensions {\n   \npublic static DbgObj OpenDump(this DbgControlClass dbg, string dumpPath) {\n   \nvar path = Environment.GetEnvironmentVariable(\"\\_NT\\_SYMBOL_PATH\");\n   \nreturn dbg.OpenDump(dumpPath, path, path, null);\n   \n}\n   \npublic static void LoadSOS(this DbgObj dbg){\n   \n// By default it only loads psscor2.dll and It will not work for .NET 4.0\n   \ndbg.UnloadExtensions();\n   \n// Will load sos based on the framework version\n   \nvar sos = dbg.GetModuleByModuleName(\"clr\") == null ? \".loadby sos mscorwks\" : \".loadby sos clr\";\n   \ndbg.Execute(sos);\n   \n}\n   \npublic static IEnumerable\u003cstring\u003e DumpHeap(this DbgObj dbg, string typeorMT, bool isMT = false) {\n   \nvar parameter = isMT ? \"-MT \" : \"-type \";\n   \nreturn dbg.Execute(\"!dumpheap -short \" + parameter + typeorMT).Split(new[] { \"n\" },\n   \nStringSplitOptions.RemoveEmptyEntries);\n   \n}\n   \npublic static string GCRoot(this DbgObj dbg, string address) {\n   \nreturn dbg.Execute(\"!GcRoot\" + address);\n   \n}\n   \npublic static double ReadDouble(this DbgObj dbg, string address, string offset) {\n   \nreturn (double)Int32.Parse(\n   \ndbg.Execute(string.Format(\"dd {0}+{1} L1\", address, offset)).Replace(\"n\", \"\")\n   \n.Split(new[] { \" \" }, StringSplitOptions.RemoveEmptyEntries)\n   \n.ElementAt(1),\n   \nNumberStyles.AllowHexSpecifier);\n   \n}\n   \npublic static string ReadString(this DbgObj dbg, string address, string offset) {\n   \n// The managed string in x86 starts at 8th offset\n   \nreturn dbg.ReadUnicodeString(ReadDouble(dbg, address, offset) + 8);\n   \n}\n   \n}\n  \n[/sourcecode]\n\n### Parallel GC Roots\n\nAnybody who is debugged memory dumps for leaks understands the pain of running gcroots within a loop. AFAIK sos is single threaded.  I have had customers who had 24 way CPU\u0026#8217;s who wanted to use all the CPU\u0026#8217;s to debug memory leaks, but it wasn\u0026#8217;t possible.\n\nHere is a code that would make parallel gc roots possible\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nusing System.Collections.Generic;\n  \nusing System.Linq;\n  \nusing System.Globalization;\n  \nusing DbgHostLib;\n  \nnamespace ConsoleApplication1 {\n  \nclass Program {\n  \nstatic void Main(string[] args) {\n  \nvar dump = new DbgControlClass().OpenDump(@\"C:TestClass.dmp\").LoadSOS();\n  \nvar testInstances = dump.DumpHeap(\"Test.TestClass\");\n  \nvar roots = testInstances.AsParallel().Select(testclass =\u003e\n  \nnew DbgControlClass().OpenDump(@\"C:TestClass.dmp\").LoadSOS().GCRoot(testclass)).ToList();\n  \nConsole.Read();\n  \n}\n  \n}\n  \nstatic class DbgExtensions {\n  \npublic static DbgObj OpenDump(this DbgControlClass dbg, string dumpPath) {\n  \nvar path = Environment.GetEnvironmentVariable(\"\\_NT\\_SYMBOL_PATH\");\n  \nreturn dbg.OpenDump(dumpPath, path, path, null);\n  \n}\n  \npublic static DbgObj LoadSOS(this DbgObj dbg){\n  \n// By default it loads psscor2\n  \ndbg.UnloadExtensions();\n  \n// Will load sos based on the framework version\n  \nvar sos = dbg.GetModuleByModuleName(\"clr\") == null ? \".loadby sos mscorwks\" : \".loadby sos clr\";\n  \ndbg.Execute(sos);\n  \nreturn dbg;\n  \n}\n  \npublic static IEnumerable\u003cstring\u003e DumpHeap(this DbgObj dbg, string typeorMT, bool isMT = false) {\n  \nvar parameter = isMT ? \"-MT \" : \"-type \";\n  \nreturn dbg.Execute(\"!dumpheap -short \" + parameter + typeorMT).Split(new[] { \"n\" },\n  \nStringSplitOptions.RemoveEmptyEntries);\n  \n}\n  \npublic static string GCRoot(this DbgObj dbg, string address) {\n  \nvar s = dbg.IsClrExtensionMissing;\n  \nreturn dbg.Execute(\"!gcroot \" + address);\n  \n}\n  \npublic static double ReadDouble(this DbgObj dbg, string address, string offset) {\n  \nreturn (double)Int32.Parse(\n  \ndbg.Execute(string.Format(\"dd {0}+{1} L1\", address, offset)).Replace(\"n\", \"\")\n  \n.Split(new[] { \" \" }, StringSplitOptions.RemoveEmptyEntries)\n  \n.ElementAt(1),\n  \nNumberStyles.AllowHexSpecifier);\n  \n}\n  \npublic static string ReadString(this DbgObj dbg, string address, string offset) {\n  \n// The managed string in x86 starts at 8th offset\n  \nreturn dbg.ReadUnicodeString(ReadDouble(dbg, address, offset) + 8);\n  \n}\n  \n}\n  \n}\n  \n[/sourcecode]\n\nThe above code loads a memory dump and looks for object type \u0026#8220;Test.TestClass\u0026#8221; and gets its addresses. Then gets GCRoots in parallel using the AsParallel option.\n\n[\u003cimg class=\"alignnone size-medium wp-image-1175\" title=\"ParallelGCRoots\" src=\"http://104.197.135.42/wp-content/uploads/2010/11/parallelgcroots2.png?w=300\" alt=\"\" width=\"300\" height=\"96\" /\u003e][3]\n\n### Reconstructing manged objects\n\nUsing the same API it is pretty easy to create an actual instance of a class from a memory dump.  Here is the code for which I dumped the memory.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nnamespace Test {\n  \nclass Program {\n  \nstatic Foo[] foo= new Foo[5];\n  \nstatic void Main(string[] args) {\n  \nfor (int i = 0; i \u003c 5; i++)\n  \nfoo[i] = new Foo() { counter = i, Name = \"Name \" + i.ToString() };\n  \nConsole.WriteLine(foo);\n  \nConsole.Read();\n  \n}\n  \n}\n  \nclass Foo {\n  \npublic int counter;\n  \npublic string Name;\n  \npublic override string ToString() {\n  \nreturn string.Format(\"Counter :- {0} , Name :-  {1} \", counter, Name);\n  \n}\n  \n}\n  \n}\n  \n[/sourcecode]\n\nHere is the memory structure of Foo\n\n\u003e 0:005\u003e !do 00f1c660\n  \n\u003e Name:        Test.Foo\n  \n\u003e MethodTable: 009b38bc\n  \n\u003e EEClass:     009b14a4\n  \n\u003e Size:        16(0x10) bytes\n  \n\u003e File:        C:FoobinDebugFoo.exe\n  \n\u003e Fields:\n  \n\u003e MT                  Field          Offset                    Type  VT     Attr    Value Name\n  \n\u003e 79ba2978  4000002        8         System.Int32  1 instance        2 counter\n  \n\u003e 79b9f9ac  4000003        4        System.String  0 instance 00f1c680 Name\n\nNotice the variable \u0026#8220;Name\u0026#8221; is in the 4th offset and counter is in the 8th offset. I use these offsets to read its contents from the dump.Here is the code that recreates instances of Foo from the memory dump.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nclass Program {\n  \nstatic void Main(string[] args) {\n  \nvar dump = new DbgControlClass().OpenDump(@\"C:tempFoo.dmp\").LoadSOS();\n  \nvar foos = dump.DumpHeap(@\"Test.Foo\");\n  \nfoos.Select(s =\u003e new Foo() { counter = (int)dump.ReadDouble(s, \"0x8\"), Name = dump.ReadString(s, \"0x4\") }).\n  \nToList().ForEach(Console.WriteLine);\n  \nConsole.Read();\n  \n}\n  \n}\n  \n[/sourcecode]\n\nAnd here is the output from the above code.\n\n\u003e Counter :- 0 , Name :-  Name 0\n  \n\u003e Counter :- 1 , Name :-  Name 1\n  \n\u003e Counter :- 2 , Name :-  Name 2\n  \n\u003e Counter :- 3 , Name :-  Name 3\n  \n\u003e Counter :- 4 , Name :-  Name 4\n\nThere is lot more to explore than what I have shown above. Happy debugging  🙂\n\n [1]: http://translate.google.com/translate?hl=en\u0026sl=pt\u0026u=http://blogs.technet.com/b/carnevale/archive/2010/10/04/debugdiag-1-2-beta1.aspx\u0026ei=dwbcTOe4DIGglAfc6uWuCQ\u0026sa=X\u0026oi=translate\u0026ct=result\u0026resnum=5\u0026ved=0CDkQ7gEwBA\u0026prev=/search%3Fq%3Ddebugdiag%2B1.2%26hl%3Den%26client%3Dfirefox-a%26hs%3DNUZ%26rls%3Dorg.mozilla:en-US:official%26prmd%3Div\n [2]: http://104.197.135.42/wp-content/uploads/2010/11/dbghost2.png\n [3]: http://104.197.135.42/wp-content/uploads/2010/11/parallelgcroots2.png"},{"title":"Downloading PDC10 videos using the new async feature","date":"2010-11-03T01:56:34Z","permalink":"/?p=1156/","content":"I knew PDC10 has an OData endpoint which is \u003chttp://odata.microsoftpdc.com/ODataSchedule.svc/\u003e . The best part about  OData is querying for specific data that we are looking for. And here is my OData url for filtering twitter hashtag #languages\n\n[sourcecode]\n\nhttp://odata.microsoftpdc.com/ODataSchedule.svc/Sessions()?$filter=startswith(TwitterHashtag,\u0026#8217;%23languages\u0026#8217;)\u0026$expand=DownloadableContent\u0026$select=DownloadableContent\n\n[/sourcecode]\n\nWith the above OData feed I could get urls for low bandwidth mp4\u0026#8217;s that I can download. And here is the sample code for filtering\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nvar x =XDocument.Load(@\"c:tempsession.xml\").Descendants().AsParallel().Where(xd =\u003e xd.Name.LocalName==\"Url\"\n  \n\u0026\u0026 xd.Value.Contains(\"_Low.mp4\")).Select (xd =\u003e xd.Value);\n\n[/sourcecode]\n\nNow that I have the url\u0026#8217;s ,here is the code to download the videos using the new async feature\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nusing System.IO;\n  \nusing System.Linq;\n  \nusing System.Net;\n  \nusing System.Threading.Tasks;\n  \nusing System.Xml.Linq;\n\nnamespace Test\n  \n{\n   \nclass Foo\n   \n{\n   \nstatic void Main(string[] args)\n   \n{\n   \nDownloadAsync();\n   \nConsole.Read();\n   \n}\n   \nstatic async void DownloadAsync()\n   \n{\n   \nvar result = new WebClient().DownloadStringTaskAsync(\"http://odata.microsoftpdc.com/ODataSchedule.svc/Sessions()?$filter=startswith(TwitterHashtag,\u0026#8217;%23languages\u0026#8217;)\u0026$expand=DownloadableContent\u0026$select=DownloadableContent\");\n   \nvar downloads = XDocument.Parse(await result).Descendants().AsParallel().\n   \nWhere(xd =\u003e xd.Name.LocalName == \"Url\" \u0026\u0026 xd.Value.Contains(\"_Low.mp4\")).\n   \nSelect(xd =\u003e new WebClient().DownloadFileTaskAsync(xd.Value, Path.GetFileName(xd.Value)));\n   \nawait TaskEx.WhenAll(downloads).ContinueWith(_ =\u003e Console.WriteLine(\"Downloading Complete\"));\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]"},{"title":"Dumping .NET strings to files using Windbg","date":"2010-11-01T21:37:16Z","permalink":"/?p=1128/","content":"In this post I would demonstrate how to dump strings from a memory dump /live process to a file. Recently I had to debug a process which had few big strings where I had to analyze its contents. The !dumpobj from sos would only dump partial strings.  I had to dump few hundred XML strings that I had to analyze using some automation. And hence comes the script.\n\n[sourcecode]\n  \n$$ Dumps the managed strings to a file\n  \n$$ Platform x86\n  \n$$ Naveen Srinivasan http://naveensrinivasan.com\n  \n$$ Usage $$\u003ea\u003c\"c:tempdumpstringtofolder.txt\" 6544f9ac 5000 c:tempstringtest\n  \n$$ First argument is the string method table pointer\n  \n$$ Second argument is the Min size of the string that needs to be used filter\n  \n$$ the strings\n  \n$$ Third is the path of the file\n  \n.foreach ($string {!dumpheap -short -mt ${$arg1} -min ${$arg2}})\n  \n{ \n\n$$ MT Field Offset Type VT Attr Value Name\n    \n$$ 65452978 40000ed 4 System.Int32 1 instance 71117 m_stringLength\n    \n$$ 65451dc8 40000ee 8 System.Char 1 instance 3c m_firstChar\n    \n$$ 6544f9ac 40000ef 8 System.String 0 shared static Empty\n\n$$ start of string is stored in the 8th offset, which can be inferred from above\n    \n$$ Size of the string which is stored in the 4th offset\n    \nr@$t0= poi(${$string}+4)*2\n    \n.writemem ${$arg3}${$string}.txt ${$string}+8 ${$string}+8+@$t0\n  \n}\n  \n[/sourcecode]\n\nAnd to use the above script ,copy it to a file and invoke it within Windbg/cdb\n\n\u003e $$\u003ea\u003c\u0026#8220;c:tempdumpstringtofolder.txt\u0026#8221; 6544f9ac 5000 c:tempstringtest\n\nParameters to the script\n\n  1. 6544f9ac :- Is the MT to string.\n  2. 5000 :- Is the min size of the string that I want to dump\n  3. c:tempstringtest :- Is the path along with partial filename for each string item\n\nThe dumped contents would be in Unicode format and to view its contents use something like this\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nConsole.WriteLine(ASCIIEncoding.Unicode.GetString(File.ReadAllBytes(@\"c:tempstringtest03575270.txt\")));\n\n[/sourcecode]\n\nAnd here is a sample code that downloads big xml strings ,that can be used by the above script to dump its contents to a folder\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nusing System.Net;\n  \nnamespace Test\n  \n{\n      \nclass Program\n      \n{\n          \nstatic void Main(string[] args)\n          \n{\n              \nvar speakers = new WebClient().DownloadString(\"http://www.codemash.org/rest/speakers\");\n              \nvar sessions = new WebClient().DownloadString(\"http://www.codemash.org/rest/sessions\");\n              \nConsole.Read();\n          \n}\n      \n}\n  \n}\n  \n[/sourcecode]\n\n[twitter-follow screen\\_name=\u0026#8217;snaveen\u0026#8217; show\\_count=\u0026#8217;yes\u0026#8217; text_color=\u0026#8217;00ccff\u0026#8217;]\u003c/pre\u003e"},{"title":"Dumping ASP.NET Session (x86 /x64) within Windbg","date":"2010-10-27T01:18:21Z","permalink":"/?p=1071/","content":"This post is going to be about dumping ASP.NET session objects using Windbg. I had recently answered a stackoverflow question in which someone wanted to dump ASP.NET session objects for 64-bit IIS (x64). I thought why not blog about the same which might be useful to others.  The challenge is to write one script that should work in both x86/x64.  FYI there is a script from [Tess][1] that does dump out the session contents, AFAIK it will not work on x64 and my script iterates through the array using the array length instead of using “.foreach /pS 2 /ps 99” which is somewhat cleaner.\n\nHere is the script for dumping ASP.NET session objects within Windbg / CDB\n\n[sourcecode wraplines=\u0026#8221;true\u0026#8221;]\n\n$$$ Dump the ASP.NET Session objects within windbg/cdb\n  \n$$$ Platform : x86 / x64\n  \n$$$ Naveen Srinivasan http://naveensrinivasan.com\n  \n$$$ Usage: $$\u003ea\u003c\"c:Debuggersx86dumpsession.txt\" 000007fef4115c20\n  \n$$$ where 000007fef4115c20 is the MethodTable pointer System.Web.SessionState.HttpSessionState\n\nr @$t9 = @$ptrsize\n  \n$$ $t9 register contains pointer size\n  \n$$ $t8 register contains the next offset of the variable\n  \n$$ $t7 register contains array start address\n\n.if (@$ptrsize = 8 )\n  \n{\n   \n$$$ x64\n   \nr @$t8 = 10\n   \nr @$t7 = 20\n   \nr @$t6 = 10\n  \n}\n  \n.else\n  \n{\n   \n$$$ x86\n   \nr @$t8 = 6\n   \nr @$t6 = 8\n   \nr @$t7 = 10\n  \n}\n  \n.foreach ($obj {!dumpheap -mt ${$arg1} -short})\n  \n{\n   \n$$ The !dumpheap -short option has last result as \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212; and\n   \n$$ this .if is to avoid this\n   \n.if ($spat (\"${$obj}\",\"\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\"))\n   \n{}\n   \n.else\n   \n{\n   \n$$ $t5 contains refernce to the array which has key and value for the\n   \n$$ session contents\n\nr$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)\n   \n$$$ Iterating through the array elements\n   \n.for (r $t0=0; @$t0 \u003c poi(@$t5+@$t9); r$t0=@$t0+1 )\n   \n{\n   \n.if(@$t0 = 0)\n   \n{\n   \n$$ First occurence of the element in the array would be in the 20 offset for x64 and 10 offset for x86\n   \nr$t1=@$t7\n   \n}\n   \n.else\n   \n{\n   \n$$ the rest of the elements would be in the 8th offset for x64 and 4th offset for x86\n   \nr$t1= @$t7+(@$t0*@$t9)\n   \n}\n   \n$$ Check for null before trying to dump\n   \n.if (poi((@$t5-@$t9)+@$t1) = 0 )\n   \n{\n   \n.continue\n   \n}\n   \n.else\n   \n{\n   \n.echo \\***\\***\\***\\***\n   \n$$ Session Key\n   \n.printf /ow \"Session Key is :- \"; !ds poi(poi((@$t5-@$t9)+@$t1)+@$t9)\n   \n$$ Session value\n   \n.printf /ow \"Session value is :- \";!ds poi(poi((@$t5-@$t9)+@$t1)+@$t6)\n   \n}\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\nCopy the above script in to a file and invoke the script like this within Windbg\n\n\u003e $$\u003ea\u003c\u0026#8220;c:Debuggersx86dumpsession.txt\u0026#8221; 000007fef4115c20\n\nPassing the MT of `System.Web.SessionState.HttpSessionState` as the script argument.\n\nWithin the script I am using the alias `!ds` for dumping strings instead of using `!dumpobj`.\n  \nTo create the alias use this command in x64\n\n[sourcecode]\n  \nas !ds .printf \"%mu n\", 10+\n  \n[/sourcecode]\n\nand in x86\n\n[sourcecode]\n  \nas !ds .printf \"%mu n\", C+\n  \n[/sourcecode]\n\nReplace !ds with !do for dumping regular objects instead of strings.\n\nHere is the output from the above script\n\n\u003e 0:022\u003e $$\u003ea\u003c\u0026#8220;c:Debuggersx86dumpsession.txt\u0026#8221; 000007fef4115c20\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Session Key is :- Name\n  \n\u003e Session value is :- Test\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Session Key is :- Name1\n  \n\u003e Session value is :- Test1\n\nIf you are only interested in getting the session contents the above script should get you the answer you are looking for. The rest of the post is an explanation of how the script works.\n\nI am going to start by explaining one of the important statement in the script “r$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)” which gets the contents of the array that contains the session key and value.\n\nThe $obj is the loop variable that contains the object address for each Http Session object  “.foreach ($obj {!dumpheap -mt ${$arg1} -short})”\n\nIf I dump the Http session object using !do\n\n\u003e 0:022\u003e !do 000000013fe20c30\n  \n\u003e Name: System.Web.SessionState.HttpSessionState\n  \n\u003e MethodTable: 000007fef4115c20\n  \n\u003e EEClass: 000007fef3d73e00\n  \n\u003e Size: 24(0x18) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef40b59e8  4001f59        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8\u003c/strong\u003e\u003c/span\u003e \u0026#8230;IHttpSessionState  0 instance 000000013fe20bc0 _container\n\nWe can see the 8th offset contains the pointer to the \u0026#8220;_container\u0026#8221; object in x64 and in x86 it will be the 4th offset and that\u0026#8217;s the reason we use poi(${$obj}+@$t9) which should work for both x86 and x64 because the value of @$t9 is the pointer size which will be 4 in x86 and 8 in x64.\n\nThe next step is to dump the \u0026#8220;_container\u0026#8221; which is equal to poi(${$obj}+@$t9)\n\n\u003e 0:022\u003e !do poi(000000013fe20c30+8)\n  \n\u003e Name: System.Web.SessionState.HttpSessionStateContainer\n  \n\u003e MethodTable: 000007fef411e868\n  \n\u003e EEClass: 000007fef3d77348\n  \n\u003e Size: 64(0x40) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001f5a        8        System.String  0 instance 0000000000000000 _id\n  \n\u003e 000007fef4086508  4001f5b       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e10 \u0026#8230;ateItemCollection  0 instance 000000013fe20458 _sessionItems\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef4115390  4001f5c       18 \u0026#8230;ObjectsCollection  0 instance 000000013fe209d0 _staticObjects\n  \n\u003e 000007fef7b7ecf0  4001f5d       28         System.Int32  1 instance               20 _timeout\n  \n\u003e 000007fef7b76c50  4001f5e       34       System.Boolean  1 instance                1 _newSession\n  \n\u003e 000007fef411f8c8  4001f5f       2c         System.Int32  1 instance                1 _cookieMode\n  \n\u003e 000007fef411f798  4001f60       30         System.Int32  1 instance                1 _mode\n  \n\u003e 000007fef7b76c50  4001f61       35       System.Boolean  1 instance                0 _abandon\n  \n\u003e 000007fef7b76c50  4001f62       36       System.Boolean  1 instance                0 _isReadonly\n  \n\u003e 000007fef411e7b0  4001f63       20 \u0026#8230;essionStateModule  0 instance 000000013fce1bd8 _stateModule\n\nNow that we have the SessionContainer, we would have to get the contents of \u0026#8220;_sessionItems\u0026#8221; which is in the 10th offset in x64.\n\nNext step is to dump \u0026#8220;_sessionitems\u0026#8221; using !do poi(poi(000000013fe20c30+8)+10) and this is equal to poi(poi(${$obj}+@$t9)+@$t6).In the starting of the script @$t6 is set to 10 or 8 based on platform.\n\n\u003e 0:022\u003e !do poi(poi(000000013fe20c30+8)+10)\n  \n\u003e Name: System.Web.SessionState.SessionStateItemCollection\n  \n\u003e MethodTable: 000007fef4086650\n  \n\u003e EEClass: 000007fef3d2fcf0\n  \n\u003e Size: 112(0x70) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b76c50  400117b       44       System.Boolean  1 instance                0 _readOnly\n  \n\u003e 000007fef7b7e968  400117c        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8 \u0026#8230;ections.ArrayList  0 instance 000000013fe20830 _entriesArray\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b7fd88  400117d       10 \u0026#8230;IEqualityComparer  0 instance 000000013fc6b270 _keyComparer\n  \n\u003e 000007fef7b7f3d8  400117e       18 \u0026#8230;ections.Hashtable  0 instance 000000013fe20858 _entriesTable\n  \n\u003e 000007fef6f6f938  400117f       20 \u0026#8230;e+NameObjectEntry  0 instance 0000000000000000 _nullKeyEntry\n  \n\u003e 000007fef6f479b8  4001180       28 \u0026#8230;se+KeysCollection  0 instance 0000000000000000 _keys\n  \n\u003e 000007fef7b66840  4001181       30 \u0026#8230;SerializationInfo  0 instance 0000000000000000 _serializationInfo\n  \n\u003e 000007fef7b7ecf0  4001182       40         System.Int32  1 instance                3 _version\n  \n\u003e 000007fef7b77370  4001183       38        System.Object  0 instance 0000000000000000 _syncRoot\n  \n\u003e 000007fef7bbd028  4001184      a70 \u0026#8230;em.StringComparer  0   shared           static defaultComparer\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:NotInit  0000000002e0a0a0:00000000ffae8cb8 \u003c\u003c\n  \n\u003e 000007fef7b76c50  4001f67       45       System.Boolean  1 instance                1 _dirty\n  \n\u003e 000007fef4108b20  4001f68       48 \u0026#8230;n+KeyedCollection  0 instance 0000000000000000 _serializedItems\n  \n\u003e 000007fef7b7aa30  4001f69       50     System.IO.Stream  0 instance 0000000000000000 _stream\n  \n\u003e 000007fef7b7ecf0  4001f6a       60         System.Int32  1 instance                0 _iLastOffset\n  \n\u003e 000007fef7b77370  4001f6b       58        System.Object  0 instance 000000013fe20818 _serializedItemsLock\n  \n\u003e 000007fef7b7f3d8  4001f66     18e0 \u0026#8230;ections.Hashtable  0   shared           static s_immutableTypes\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:NotInit  0000000002e0a0a0:000000013fe204c8 \u003c\u003c\n\nNext field that we are interested in is \u0026#8220;_entriesArray\u0026#8221; which is in the 8th offset in x64. To dump its contents here is the command !do\n  \npoi(poi(poi(000000013fe20c30+8)+10)+8) which is equal to poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9\n\n\u003e 0:022\u003e !do poi(poi(poi(000000013fe20c30+8)+10)+8)\n  \n\u003e Name: System.Collections.ArrayList\n  \n\u003e MethodTable: 000007fef7b7e968\n  \n\u003e EEClass: 000007fef7781ee0\n  \n\u003e Size: 40(0x28) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64mscorlib2.0.0.0\\__b77a5c561934e089mscorlib.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b65870  400094c       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e 8      System.Object[]  0 instance 000000013fe3ddb8 _items\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b7ecf0  400094d       18         System.Int32  1 instance                2 _size\n  \n\u003e 000007fef7b7ecf0  400094e       1c         System.Int32  1 instance                2 _version\n  \n\u003e 000007fef7b77370  400094f       10        System.Object  0 instance 0000000000000000 _syncRoot\n  \n\u003e 000007fef7b65870  4000950      388      System.Object[]  0   shared           static emptyArray\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:00000000ffac6110 0000000002e0a0a0:00000000ffad19e0 \u003c\u003c\n\nThe next field we are interested  is \u0026#8220;\\_items\u0026#8221; which is in the 8th offset in x64. Notice \u0026#8220;\\_items\u0026#8221; is an array and cannot be dumped using !dumpobj or !do. So this command “r$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)\u0026#8221; will set the array pointer to$t5.\n\nNow that we have array containing the session items, we could have used !da to\n  \ndump the array contents with details using !da -details poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n\n\u003e 0:022\u003e !da -details poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n  \n\u003e Name: System.Object[]\n  \n\u003e MethodTable: 000007fef7b65870\n  \n\u003e EEClass: 000007fef777eb58\n  \n\u003e Size: 64(0x40) bytes\n  \n\u003e Array: Rank 1, Number of elements 4, Type CLASS\n  \n\u003e Element Methodtable: 000007fef7b77370\n  \n\u003e [0] 000000013fe3dd98\n  \n\u003e Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry\n  \n\u003e MethodTable: 000007fef6f6f938\n  \n\u003e EEClass: 000007fef6ce90b0\n  \n\u003e Size: 32(0x20) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_MSILSystem2.0.0.0\\__b77a5c561934e089System.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001185        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8        System.String  0 instance 000000013fe3dcf8 Key\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b77370  4001186       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e10        System.Object  0 instance 000000013fe3dd20 Value\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e [1] 000000013fe3ddf8\n  \n\u003e Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry\n  \n\u003e MethodTable: 000007fef6f6f938\n  \n\u003e EEClass: 000007fef6ce90b0\n  \n\u003e Size: 32(0x20) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_MSILSystem2.0.0.0\\__b77a5c561934e089System.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001185        8        System.String  0 instance 000000013fe3dd48 Key\n  \n\u003e 000007fef7b77370  4001186       10        System.Object  0 instance 000000013fe3dd70 Value\n  \n\u003e [2] null\n  \n\u003e [3] null\n\nBut notice it does not help much because we still cannot see the actual key and value. That is the reason for using a nested \u0026#8220;.for\u0026#8221; loop in the script which will iterate through the array contents. FYI @$t5 contains reference to the array.\n\nThe statement  \u0026#8220;.for (r $t0=0; @$t0 \u003c poi(@$t5+@$t9); r$t0=@$t0+1 )\u0026#8221;  is standard for loop with one thing that is special which is poi(@$t5+@$t9).  The poi(@$t5+@$t9) contains the reference to the size of the array. How do I know that? The answer is dd poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n\n\u003e 0:022\u003e dd poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n  \n\u003e 00000001\\`3fe3ddb8  f7b65870 000007fe \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e00000004\u003c/strong\u003e\u003c/span\u003e 00000000\n  \n\u003e 00000001\\`3fe3ddc8  f7b77370 000007fe 3fe3dd98 00000001\n  \n\u003e 00000001\\`3fe3ddd8  3fe3ddf8 00000001 00000000 00000000\n  \n\u003e 00000001\\`3fe3dde8  00000000 00000000 00000000 00000000\n  \n\u003e 00000001\\`3fe3ddf8  f6f6f938 000007fe 3fe3dd48 00000001\n  \n\u003e 00000001\\`3fe3de08  3fe3dd70 00000001 00000000 00000000\n  \n\u003e 00000001\\`3fe3de18  f7b77370 000007fe 00000000 00000000\n  \n\u003e 00000001\\`3fe3de28  00000000 80000000 f7b77a80 000007fe\n\nNotice the 8th offset value is 00000004 which is the size of the array and for\n  \nmore information look at the post on custom dump array [This post is going to be about dumping ASP.NET session objects using Windbg. I had recently answered a stackoverflow question in which someone wanted to dump ASP.NET session objects for 64-bit IIS (x64). I thought why not blog about the same which might be useful to others.  The challenge is to write one script that should work in both x86/x64.  FYI there is a script from [Tess][1] that does dump out the session contents, AFAIK it will not work on x64 and my script iterates through the array using the array length instead of using “.foreach /pS 2 /ps 99” which is somewhat cleaner.\n\nHere is the script for dumping ASP.NET session objects within Windbg / CDB\n\n[sourcecode wraplines=\u0026#8221;true\u0026#8221;]\n\n$$$ Dump the ASP.NET Session objects within windbg/cdb\n  \n$$$ Platform : x86 / x64\n  \n$$$ Naveen Srinivasan http://naveensrinivasan.com\n  \n$$$ Usage: $$\u003ea\u003c\"c:Debuggersx86dumpsession.txt\" 000007fef4115c20\n  \n$$$ where 000007fef4115c20 is the MethodTable pointer System.Web.SessionState.HttpSessionState\n\nr @$t9 = @$ptrsize\n  \n$$ $t9 register contains pointer size\n  \n$$ $t8 register contains the next offset of the variable\n  \n$$ $t7 register contains array start address\n\n.if (@$ptrsize = 8 )\n  \n{\n   \n$$$ x64\n   \nr @$t8 = 10\n   \nr @$t7 = 20\n   \nr @$t6 = 10\n  \n}\n  \n.else\n  \n{\n   \n$$$ x86\n   \nr @$t8 = 6\n   \nr @$t6 = 8\n   \nr @$t7 = 10\n  \n}\n  \n.foreach ($obj {!dumpheap -mt ${$arg1} -short})\n  \n{\n   \n$$ The !dumpheap -short option has last result as \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212; and\n   \n$$ this .if is to avoid this\n   \n.if ($spat (\"${$obj}\",\"\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\"))\n   \n{}\n   \n.else\n   \n{\n   \n$$ $t5 contains refernce to the array which has key and value for the\n   \n$$ session contents\n\nr$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)\n   \n$$$ Iterating through the array elements\n   \n.for (r $t0=0; @$t0 \u003c poi(@$t5+@$t9); r$t0=@$t0+1 )\n   \n{\n   \n.if(@$t0 = 0)\n   \n{\n   \n$$ First occurence of the element in the array would be in the 20 offset for x64 and 10 offset for x86\n   \nr$t1=@$t7\n   \n}\n   \n.else\n   \n{\n   \n$$ the rest of the elements would be in the 8th offset for x64 and 4th offset for x86\n   \nr$t1= @$t7+(@$t0*@$t9)\n   \n}\n   \n$$ Check for null before trying to dump\n   \n.if (poi((@$t5-@$t9)+@$t1) = 0 )\n   \n{\n   \n.continue\n   \n}\n   \n.else\n   \n{\n   \n.echo \\***\\***\\***\\***\n   \n$$ Session Key\n   \n.printf /ow \"Session Key is :- \"; !ds poi(poi((@$t5-@$t9)+@$t1)+@$t9)\n   \n$$ Session value\n   \n.printf /ow \"Session value is :- \";!ds poi(poi((@$t5-@$t9)+@$t1)+@$t6)\n   \n}\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\nCopy the above script in to a file and invoke the script like this within Windbg\n\n\u003e $$\u003ea\u003c\u0026#8220;c:Debuggersx86dumpsession.txt\u0026#8221; 000007fef4115c20\n\nPassing the MT of `System.Web.SessionState.HttpSessionState` as the script argument.\n\nWithin the script I am using the alias `!ds` for dumping strings instead of using `!dumpobj`.\n  \nTo create the alias use this command in x64\n\n[sourcecode]\n  \nas !ds .printf \"%mu n\", 10+\n  \n[/sourcecode]\n\nand in x86\n\n[sourcecode]\n  \nas !ds .printf \"%mu n\", C+\n  \n[/sourcecode]\n\nReplace !ds with !do for dumping regular objects instead of strings.\n\nHere is the output from the above script\n\n\u003e 0:022\u003e $$\u003ea\u003c\u0026#8220;c:Debuggersx86dumpsession.txt\u0026#8221; 000007fef4115c20\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Session Key is :- Name\n  \n\u003e Session value is :- Test\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Session Key is :- Name1\n  \n\u003e Session value is :- Test1\n\nIf you are only interested in getting the session contents the above script should get you the answer you are looking for. The rest of the post is an explanation of how the script works.\n\nI am going to start by explaining one of the important statement in the script “r$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)” which gets the contents of the array that contains the session key and value.\n\nThe $obj is the loop variable that contains the object address for each Http Session object  “.foreach ($obj {!dumpheap -mt ${$arg1} -short})”\n\nIf I dump the Http session object using !do\n\n\u003e 0:022\u003e !do 000000013fe20c30\n  \n\u003e Name: System.Web.SessionState.HttpSessionState\n  \n\u003e MethodTable: 000007fef4115c20\n  \n\u003e EEClass: 000007fef3d73e00\n  \n\u003e Size: 24(0x18) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef40b59e8  4001f59        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8\u003c/strong\u003e\u003c/span\u003e \u0026#8230;IHttpSessionState  0 instance 000000013fe20bc0 _container\n\nWe can see the 8th offset contains the pointer to the \u0026#8220;_container\u0026#8221; object in x64 and in x86 it will be the 4th offset and that\u0026#8217;s the reason we use poi(${$obj}+@$t9) which should work for both x86 and x64 because the value of @$t9 is the pointer size which will be 4 in x86 and 8 in x64.\n\nThe next step is to dump the \u0026#8220;_container\u0026#8221; which is equal to poi(${$obj}+@$t9)\n\n\u003e 0:022\u003e !do poi(000000013fe20c30+8)\n  \n\u003e Name: System.Web.SessionState.HttpSessionStateContainer\n  \n\u003e MethodTable: 000007fef411e868\n  \n\u003e EEClass: 000007fef3d77348\n  \n\u003e Size: 64(0x40) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001f5a        8        System.String  0 instance 0000000000000000 _id\n  \n\u003e 000007fef4086508  4001f5b       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e10 \u0026#8230;ateItemCollection  0 instance 000000013fe20458 _sessionItems\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef4115390  4001f5c       18 \u0026#8230;ObjectsCollection  0 instance 000000013fe209d0 _staticObjects\n  \n\u003e 000007fef7b7ecf0  4001f5d       28         System.Int32  1 instance               20 _timeout\n  \n\u003e 000007fef7b76c50  4001f5e       34       System.Boolean  1 instance                1 _newSession\n  \n\u003e 000007fef411f8c8  4001f5f       2c         System.Int32  1 instance                1 _cookieMode\n  \n\u003e 000007fef411f798  4001f60       30         System.Int32  1 instance                1 _mode\n  \n\u003e 000007fef7b76c50  4001f61       35       System.Boolean  1 instance                0 _abandon\n  \n\u003e 000007fef7b76c50  4001f62       36       System.Boolean  1 instance                0 _isReadonly\n  \n\u003e 000007fef411e7b0  4001f63       20 \u0026#8230;essionStateModule  0 instance 000000013fce1bd8 _stateModule\n\nNow that we have the SessionContainer, we would have to get the contents of \u0026#8220;_sessionItems\u0026#8221; which is in the 10th offset in x64.\n\nNext step is to dump \u0026#8220;_sessionitems\u0026#8221; using !do poi(poi(000000013fe20c30+8)+10) and this is equal to poi(poi(${$obj}+@$t9)+@$t6).In the starting of the script @$t6 is set to 10 or 8 based on platform.\n\n\u003e 0:022\u003e !do poi(poi(000000013fe20c30+8)+10)\n  \n\u003e Name: System.Web.SessionState.SessionStateItemCollection\n  \n\u003e MethodTable: 000007fef4086650\n  \n\u003e EEClass: 000007fef3d2fcf0\n  \n\u003e Size: 112(0x70) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64System.Web2.0.0.0\\__b03f5f7f11d50a3aSystem.Web.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b76c50  400117b       44       System.Boolean  1 instance                0 _readOnly\n  \n\u003e 000007fef7b7e968  400117c        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8 \u0026#8230;ections.ArrayList  0 instance 000000013fe20830 _entriesArray\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b7fd88  400117d       10 \u0026#8230;IEqualityComparer  0 instance 000000013fc6b270 _keyComparer\n  \n\u003e 000007fef7b7f3d8  400117e       18 \u0026#8230;ections.Hashtable  0 instance 000000013fe20858 _entriesTable\n  \n\u003e 000007fef6f6f938  400117f       20 \u0026#8230;e+NameObjectEntry  0 instance 0000000000000000 _nullKeyEntry\n  \n\u003e 000007fef6f479b8  4001180       28 \u0026#8230;se+KeysCollection  0 instance 0000000000000000 _keys\n  \n\u003e 000007fef7b66840  4001181       30 \u0026#8230;SerializationInfo  0 instance 0000000000000000 _serializationInfo\n  \n\u003e 000007fef7b7ecf0  4001182       40         System.Int32  1 instance                3 _version\n  \n\u003e 000007fef7b77370  4001183       38        System.Object  0 instance 0000000000000000 _syncRoot\n  \n\u003e 000007fef7bbd028  4001184      a70 \u0026#8230;em.StringComparer  0   shared           static defaultComparer\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:NotInit  0000000002e0a0a0:00000000ffae8cb8 \u003c\u003c\n  \n\u003e 000007fef7b76c50  4001f67       45       System.Boolean  1 instance                1 _dirty\n  \n\u003e 000007fef4108b20  4001f68       48 \u0026#8230;n+KeyedCollection  0 instance 0000000000000000 _serializedItems\n  \n\u003e 000007fef7b7aa30  4001f69       50     System.IO.Stream  0 instance 0000000000000000 _stream\n  \n\u003e 000007fef7b7ecf0  4001f6a       60         System.Int32  1 instance                0 _iLastOffset\n  \n\u003e 000007fef7b77370  4001f6b       58        System.Object  0 instance 000000013fe20818 _serializedItemsLock\n  \n\u003e 000007fef7b7f3d8  4001f66     18e0 \u0026#8230;ections.Hashtable  0   shared           static s_immutableTypes\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:NotInit  0000000002e0a0a0:000000013fe204c8 \u003c\u003c\n\nNext field that we are interested in is \u0026#8220;_entriesArray\u0026#8221; which is in the 8th offset in x64. To dump its contents here is the command !do\n  \npoi(poi(poi(000000013fe20c30+8)+10)+8) which is equal to poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9\n\n\u003e 0:022\u003e !do poi(poi(poi(000000013fe20c30+8)+10)+8)\n  \n\u003e Name: System.Collections.ArrayList\n  \n\u003e MethodTable: 000007fef7b7e968\n  \n\u003e EEClass: 000007fef7781ee0\n  \n\u003e Size: 40(0x28) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_64mscorlib2.0.0.0\\__b77a5c561934e089mscorlib.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b65870  400094c       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e 8      System.Object[]  0 instance 000000013fe3ddb8 _items\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b7ecf0  400094d       18         System.Int32  1 instance                2 _size\n  \n\u003e 000007fef7b7ecf0  400094e       1c         System.Int32  1 instance                2 _version\n  \n\u003e 000007fef7b77370  400094f       10        System.Object  0 instance 0000000000000000 _syncRoot\n  \n\u003e 000007fef7b65870  4000950      388      System.Object[]  0   shared           static emptyArray\n  \n\u003e \u003e\u003e Domain:Value  00000000010e2690:00000000ffac6110 0000000002e0a0a0:00000000ffad19e0 \u003c\u003c\n\nThe next field we are interested  is \u0026#8220;\\_items\u0026#8221; which is in the 8th offset in x64. Notice \u0026#8220;\\_items\u0026#8221; is an array and cannot be dumped using !dumpobj or !do. So this command “r$t5 = poi(poi(poi(poi(${$obj}+@$t9)+@$t6)+@$t9)+@$t9)\u0026#8221; will set the array pointer to$t5.\n\nNow that we have array containing the session items, we could have used !da to\n  \ndump the array contents with details using !da -details poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n\n\u003e 0:022\u003e !da -details poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n  \n\u003e Name: System.Object[]\n  \n\u003e MethodTable: 000007fef7b65870\n  \n\u003e EEClass: 000007fef777eb58\n  \n\u003e Size: 64(0x40) bytes\n  \n\u003e Array: Rank 1, Number of elements 4, Type CLASS\n  \n\u003e Element Methodtable: 000007fef7b77370\n  \n\u003e [0] 000000013fe3dd98\n  \n\u003e Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry\n  \n\u003e MethodTable: 000007fef6f6f938\n  \n\u003e EEClass: 000007fef6ce90b0\n  \n\u003e Size: 32(0x20) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_MSILSystem2.0.0.0\\__b77a5c561934e089System.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001185        \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e8        System.String  0 instance 000000013fe3dcf8 Key\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e 000007fef7b77370  4001186       \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e10        System.Object  0 instance 000000013fe3dd20 Value\u003c/strong\u003e\u003c/span\u003e\n  \n\u003e [1] 000000013fe3ddf8\n  \n\u003e Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry\n  \n\u003e MethodTable: 000007fef6f6f938\n  \n\u003e EEClass: 000007fef6ce90b0\n  \n\u003e Size: 32(0x20) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_MSILSystem2.0.0.0\\__b77a5c561934e089System.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef7b77a80  4001185        8        System.String  0 instance 000000013fe3dd48 Key\n  \n\u003e 000007fef7b77370  4001186       10        System.Object  0 instance 000000013fe3dd70 Value\n  \n\u003e [2] null\n  \n\u003e [3] null\n\nBut notice it does not help much because we still cannot see the actual key and value. That is the reason for using a nested \u0026#8220;.for\u0026#8221; loop in the script which will iterate through the array contents. FYI @$t5 contains reference to the array.\n\nThe statement  \u0026#8220;.for (r $t0=0; @$t0 \u003c poi(@$t5+@$t9); r$t0=@$t0+1 )\u0026#8221;  is standard for loop with one thing that is special which is poi(@$t5+@$t9).  The poi(@$t5+@$t9) contains the reference to the size of the array. How do I know that? The answer is dd poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n\n\u003e 0:022\u003e dd poi(poi(poi(poi(000000013fe20c30+8)+10)+8)+8)\n  \n\u003e 00000001\\`3fe3ddb8  f7b65870 000007fe \u003cspan style=\"color:#ff0000;\"\u003e\u003cstrong\u003e00000004\u003c/strong\u003e\u003c/span\u003e 00000000\n  \n\u003e 00000001\\`3fe3ddc8  f7b77370 000007fe 3fe3dd98 00000001\n  \n\u003e 00000001\\`3fe3ddd8  3fe3ddf8 00000001 00000000 00000000\n  \n\u003e 00000001\\`3fe3dde8  00000000 00000000 00000000 00000000\n  \n\u003e 00000001\\`3fe3ddf8  f6f6f938 000007fe 3fe3dd48 00000001\n  \n\u003e 00000001\\`3fe3de08  3fe3dd70 00000001 00000000 00000000\n  \n\u003e 00000001\\`3fe3de18  f7b77370 000007fe 00000000 00000000\n  \n\u003e 00000001\\`3fe3de28  00000000 80000000 f7b77a80 000007fe\n\nNotice the 8th offset value is 00000004 which is the size of the array and for\n  \nmore information look at the post on custom dump array][2] \n  \nThe first element in the array  would be in the 20th offset in x64 and 10th\n  \noffset in x86 and that is the reason for the \u0026#8220;.if(@$t0=0)\u0026#8221;\n\n\u003e .if(@$t0 = 0)\n  \n\u003e {\n  \n\u003e $$ First occurence of the element in the array would be in the 20 offset for x64 and 10 offset for x86\n  \n\u003e r$t1=@$t7\n  \n\u003e }\n\nSo the first time the value @$t1 would be 20. And the rest of the elements would be in the 8th offset in x64 and 4th offset inx86\n\n\u003e .else\n  \n\u003e {\n  \n\u003e $$ the rest of the elements would be in the 8th offset for x64 and 4th offset for x86\n  \n\u003e r$t1= @$t7+(@$t0*@$t9)\n  \n\u003e }\n\nSo the second time it would be 20+(1\\*8) = @$t7+(@$t0\\*@$t9) which will be 28th offset.\n\nThe next statement \u0026#8220;.if (poi((@$t5-@$t9)+@$t1) = 0 )\u0026#8221; is null check , this would avoid dumping an object which has not be initialized. This is because not all elements in the array could have been initialized.\n\nThe !ds poi(poi((@$t5-@$t9)+@$t1)+@$t9) gets the session key which is in the 8th offset (look at the previous output from dumparray) and the !ds poi(poi((@$t5-@$t9)+@$t1)+@$t6) gets the session value which is in the 10th offset.\n\nHere is my initial x64 specific script that I wrote.\n\n[sourcecode]\n  \nforeach ($obj {!dumpheap -mt ${$arg1} -short})\n  \n{\n  \n$$ The !dumpheap -short option has last result as \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212; and\n  \n$$ this .if is to avoid this\n  \n.if ($spat (\"${$obj}\",\"\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\"))\n  \n{}\n  \n.else\n  \n{\n  \n$$ $t5 contains reference to the array which has key and value for the\n  \n$$ session contents\n\nr$t5 = poi(poi(poi(poi(${$obj}+0x8)+0x10)+0x8)+0x8);\n  \nr$t1 = 0\n  \n.for (r $t0=0; @$t0 \u003c poi(@$t5+0x8); r$t0=@$t0+1 )\n  \n{\n  \n.if(@$t0 = 0)\n  \n{\n  \n$$ First occurrence of the element in the array would be in the 20 offset\n  \nr$t1=20\n  \n}\n  \n.else\n  \n{\n  \n$$ the rest of the elements would be in the 8th offset\n  \nr$t1= 20+(@$t0*8)\n  \n};\n\n$$ Check for null before trying to dump\n\n.if (poi((@$t5-0x8)+@$t1) = 0 )\n  \n{\n  \n.continue\n  \n}\n  \n.else\n  \n{\n  \n.echo \\***\\***\\***\\***;\n  \n? @$t0\n  \n$$ Session Key\n  \n.printf \"Session Key is :- \"; !ds poi(poi((@$t5-0x8)+@$t1)+0x8);\n  \n$$ Session value\n  \n.printf \"Session value is :- \";!ds poi(poi((@$t5-0x8)+@$t1)+0x10)\n  \n}\n  \n}\n  \n}\n  \n}\n  \n[/sourcecode]\n\nI had fun writing this script. Let me know if there is a better way to write this.\n\n [1]: http://blogs.msdn.com/b/tess/archive/2007/09/18/debugging-script-dumping-out-asp-net-session-contents.aspx\n [2]: http://naveensrinivasan.com/2010/06/24/custom-dumparray-windbg/"},{"title":"GC Start and Stop events in .NET using Windbg","date":"2010-09-08T01:55:27Z","permalink":"/?p=1064/","content":"I was recently showing someone the new ETW features in .NET especially the [GC Event notification][1] and I was asked if we can get this using Windbg.\n\nSo here is the sample code for the GC Collection\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nnamespace GCStartStop\n  \n{\n  \npublic partial class Form1 : Form\n  \n{\n  \npublic Form1()\n  \n{\n  \nInitializeComponent();\n  \nbutton1.Click += (s, b) =\u003e GC.Collect(2);\n  \nbutton1.Click += (s, b) =\u003e GC.Collect(1);\n  \n}\n  \n}\n  \n}\n  \n[/sourcecode]\n\nThe goal is set to a break-point only when the collection count is 2. Here is a bp script for doing this.\n\n[sourcecode]\n\nbp clr!WKS::GCHeap::SuspendEE \".if (dwo(clr!WKS::GCHeap::GcCondemnedGeneration)==2) {.echo start of gen 2;g} .else {gc}\"\n\n[/sourcecode]\n\nThe same thing can be done for clr!WKS::GCHeap::RestartEE.\n\nWhen showing this to someone I was asked what does \u0026#8220;EE\u0026#8221; acronym in \u0026#8220;SuspendedEE\u0026#8221; ?  \u0026#8220;EE\u0026#8221; is  Execution Engine.\n\n [1]: http://msdn.microsoft.com/en-us/library/ff356162.aspx"},{"title":"Get GC Information in Silverlight","date":"2010-08-11T02:32:52Z","permalink":"/?p=1050/","content":"I had earlier written a [post][1] on getting GC information on Silverlight using ETW. With that we would have to write code to parse the ETW csv file.  In this post I am going to be using [Perfmonitor][2] to do this. This tools uses the same ETW under covers, but it does all the plumbing and gives a nice report , which is much easier to read.  Here are the reports\n\n[\u003cimg class=\"alignnone size-full wp-image-1051\" title=\"GC\" src=\"http://104.197.135.42/wp-content/uploads/2010/08/gc1.jpg\" alt=\"\" width=\"700\" height=\"222\" /\u003e][3]\n\n[\u003cimg class=\"alignnone size-full wp-image-1052\" title=\"GC-1\" src=\"http://104.197.135.42/wp-content/uploads/2010/08/gc-12.jpg\" alt=\"\" width=\"700\" height=\"308\" /\u003e][4]\n\nTo demonstrate this I used the bing’s world leader search page and here is the url\n\n\u003chttp://www.bing.com/visualsearch?q=World+leaders\u0026g=world_leaders\u0026FORM=Z9GE74#\u003e\n\nSteps to get the GC information are\n\n  1. Start a cmd or powershell  as admin , this required to collect ETW tracing\n  2. Browse the above mentioned webpage using IE\n  3. Issue the command “PerfMonitor.exe /process:4180 start” where 4180 is the internet explorer’s process id\n  4. Do the necessary actions\n  5. Then issue “PerfMonitor.exe stop”\n  6. The command to get the report “PerfMonitor.exe GCTime”. This will generate a report and open it in the browser\n\nPerfmonitor is like xperf for managed code. This is non-intrusive and can collect some valuable information in production. This is an xcopy tool and does not need an install.\n\n [1]: http://naveensrinivasan.com/2010/03/21/get-gc-information-in-silverlight-using-etw/\n [2]: http://bcl.codeplex.com/wikipage?title=PerfMonitor\u0026referringTitle=Home\n [3]: http://104.197.135.42/wp-content/uploads/2010/08/gc1.jpg\n [4]: http://104.197.135.42/wp-content/uploads/2010/08/gc-12.jpg"},{"title":"Script to load sos within Windbg based on .NET Framework version","date":"2010-07-26T04:33:21Z","permalink":"/?p=1032/","content":"I often debug  .NET Framework v 2.0 / v 4.0 code within windbg. In v 2.0 the main clr dll was called \u0026#8220;mscorwks.dll\u0026#8221; and in v 4.0 it is called \u0026#8220;clr.dll\u0026#8221;.  As many of you are aware , to load sos in v 2.0 we would have to enter \u0026#8220;.loadby sos mscorwks\u0026#8221; and in v 4.0 it would be \u0026#8220;.loadby sos clr\u0026#8221; . This was a pain for me. Came up with a script to automate loading sos based on clr version\n\n[sourcecode]\n  \n!for\\_each\\_module .if(($sicmp( \"@#ModuleName\" , \"mscorwks\") = 0) ) {.loadby sos mscorwks} .elsif ($sicmp( \"@#ModuleName\" , \"clr\") = 0) {.loadby sos clr}\n  \n[/sourcecode]\n\nYou can take it up a notch by setting a break-point within clr based on the .NET Framework version\n\n[sourcecode]\n  \n!for\\_each\\_module .if(($sicmp( \"@#ModuleName\" , \"mscorwks\") = 0) ) {bp mscorwks!WKS::GCHeap::SuspendEE \".if (dwo(mscorwks!WKS::GCHeap::GcCondemnedGeneration)==2) {.echo start of gen 2}\"} .elsif ($sicmp( \"@#ModuleName\" , \"clr\") = 0) {bp clr!WKS::GCHeap::SuspendEE \".if (dwo(clr!WKS::GCHeap::GcCondemnedGeneration)==2) {.echo start of gen 2}\"}\n  \n[/sourcecode]"},{"title":"Debugging .NET – mystery between DEBUG versus RELEASE within windbg","date":"2010-07-22T02:48:17Z","permalink":"/?p=1015/","content":"I am sure most of us have debugged applications that are build with debug turned on, which is obviously much easier compared to debugging release build (optimized code). In this post I am going to share one of my experiences of debugging release build code. I will demonstrate this with a simple Console Application.\n\nHere is the code\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nnamespace ConsoleApplication\n  \n{\n  \nclass Program\n  \n{\n  \nstatic void Main(string[] args)\n  \n{\n  \nvar x = 10;\n  \nvar name = \"naveen\";\n  \nConsole.WriteLine(name);\n  \nConsole.Read();\n  \n}\n  \n}\n  \n}\n  \n[/sourcecode]\n\nI compiled it under release mode and launched it within the debugger. The goal is to have a break-point on Console.WriteLine(name). First thing was to set up a sx notification on load for mscorlib.\n\n[sourcecode]\n\nsxe ld:mscorlib\n\n[/sourcecode]\n\nAnd when the break-point hits for the above event, then issued the following command to load sosex , sos and set an bp on Console.WriteLine which is nothing fancy\n\n[sourcecode]\n\n.load sosex;.loadby sos clr;!mbm \\*System.Console.WriteLine\\* \"!mk\";g\n\n[/sourcecode]\n\nI would imagine that the break-point would hit and I would get a call-stack, but to my surprise this was the output\n\n\u003e 0:000\u003e .load sosex;.loadby sos clr;!mbm \\*System.Console.WriteLine\\* \u0026#8220;!mk\u0026#8221;;g\n  \n\u003e The breakpoint could not be resolved immediately.\n  \n\u003e Further attempts will be made as modules are loaded.\n  \n\u003e (1090.11fc): CLR notification exception \u0026#8211; code e0444143 (first chance)\n  \n\u003e Breakpoint set at System.Console.WriteLine().\n  \n\u003e Breakpoint set at System.Console.WriteLine(Boolean).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Char).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Char[]).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Char[], Int32, Int32).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.Decimal).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Double).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Single).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Int32).\n  \n\u003e Breakpoint set at System.Console.WriteLine(UInt32).\n  \n\u003e Breakpoint set at System.Console.WriteLine(Int64).\n  \n\u003e Breakpoint set at System.Console.WriteLine(UInt64).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.Object).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String, System.Object).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String, System.Object, System.Object).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String, System.Object, System.Object, System.Object).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String, System.Object, System.Object, System.Object, System.Object, \u0026#8230;).\n  \n\u003e Breakpoint set at System.Console.WriteLine(System.String, System.Object[]).\n  \n\u003e (1090.11fc): CLR notification exception \u0026#8211; code e0444143 (first chance)\n\nThat\u0026#8217;s it. And I never got an hit for the break-point. I checked to make sure there was an actual breakpoint set by issuing a \u0026#8220;bl\u0026#8221; command. I could see there were break-points for Console.WriteLine. The next step was to  disassemble the code. So got the instruction pointer from the !mk call-stack. Here is the output of !mk. FYI this is when the code is blocked on Console.Read\n\n\u003e 00:U 003def90 75d273ea KERNEL32!ReadConsoleInternal+0x15\n  \n\u003e 01:U 003def98 75d27041 KERNEL32!ReadConsoleA+0x40\n  \n\u003e 02:U 003df020 75caf489 KERNEL32!ReadFileImplementation+0x75\n  \n\u003e 03:M 003df068 65651c8b DomainNeutralILStubClass.IL\\_STUB\\_PInvoke(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte*, Int32, Int32 ByRef, IntPtr)(+0x0 IL)(+0x0 Native)\n  \n\u003e 04:M 003df0e8 65cbf7e8 System.IO.\\_\\_ConsoleStream.ReadFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, Int32, Int32 ByRef)(+0x53 IL)(+0x8c Native) [f:ddndpclrsrcBCLSystemIO\\_\\_ConsoleStream.cs, @ 16707566,0]\n  \n\u003e 05:M 003df110 65cbf6d0 System.IO.\\_\\_ConsoleStream.Read(Byte[], Int32, Int32)(+0x5d IL)(+0x9c Native) [f:ddndpclrsrcBCLSystemIO\\_\\_ConsoleStream.cs, @ 131,13]\n  \n\u003e 06:M 003df138 65608bfb System.IO.StreamReader.ReadBuffer()(+0xa0 IL)(+0x3b Native) [f:ddndpclrsrcBCLSystemIOStreamReader.cs, @ 488,21]\n  \n\u003e 07:M 003df154 65bcacc3 System.IO.StreamReader.Read()(+0x1b IL)(+0x23 Native) [f:ddndpclrsrcBCLSystemIOStreamReader.cs, @ 302,17]\n  \n\u003e 08:M 003df160 65cc5e9d System.IO.TextReader+SyncTextReader.Read()(+0x0 IL)(+0x19 Native) [f:ddndpclrsrcBCLSystemIOTextReader.cs, @ 244,17]\n  \n\u003e 09:M 003df170 \u003cspan style=\"background-color:#ffff00;\"\u003e0066009a\u003c/span\u003e \\*** WARNING: Unable to verify checksum for ConsoleApplication.exe\n  \n\u003e ConsoleApplication.Program.Main(System.String[])(+0x0 IL)(+0x2a Native) [c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs, @ 10,13]\n  \n\u003e 0a:U 003df17c 661621db clr!CallDescrWorker+0x33\n\nNext disassemble Main Method using the ip which is 0066009a\n\n[sourcecode]\n\n!u 0066009a\n\n[/sourcecode]\n\nHere is the output\n\n\u003e 0:000\u003e !u 0066009a\n  \n\u003e Normal JIT generated code\n  \n\u003e ConsoleApplication.Program.Main(System.String[])\n  \n\u003e Begin 00660070, size 2d\n  \n\u003e c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs @ 10:\n  \n\u003e 00660070 55 push ebp\n  \n\u003e 00660071 8bec mov ebp,esp\n  \n\u003e 00660073 56 push esi\n  \n\u003e 00660074 8b3530206b03 mov esi,dword ptr ds:\\[36B2030h\\] (\u0026#8220;naveen\u0026#8221;)\n  \n\u003e c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs @ 11:\n  \n\u003e 0066007a e85170f864 call mscorlib_ni+0x2570d0 (655e70d0) (\u003cspan style=\"background-color:#ffff00;\"\u003eSystem.Console.get_Out()\u003c/span\u003e, mdToken: 060008cd)\n  \n\u003e 0066007f 8bc8 mov ecx,eax\n  \n\u003e 00660081 8bd6 mov edx,esi\n  \n\u003e 00660083 8b01 mov eax,dword ptr [ecx]\n  \n\u003e 00660085 8b403c mov eax,dword ptr [eax+3Ch]\n  \n\u003e 00660088 ff5010 call dword ptr [eax+10h]\n  \n\u003e 0066008b e8f0a55565 call mscorlib\\_ni+0x82a680 (65bba680) (System.Console.get\\_In(), mdToken: 060008cc)\n  \n\u003e 00660090 8bc8 mov ecx,eax\n  \n\u003e 00660092 8b01 mov eax,dword ptr [ecx]\n  \n\u003e 00660094 8b402c mov eax,dword ptr [eax+2Ch]\n  \n\u003e 00660097 ff500c call dword ptr [eax+0Ch]\n  \n\u003e c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs @ 13:\n  \n\u003e \u003e\u003e\u003e 0066009a 5e pop esi\n  \n\u003e 0066009b 5d pop ebp\n  \n\u003e 0066009c c3 ret\n\nAnd I see System.Console.get_Out instead of System.Console.WriteLine which I was totally surprised. This was  the reason the break-point never hit. Next I wanted check the IL which was compiled , what we see above is jitted x86 mixed with IL. Here is the command to check the compiled IL. First I had to get the methodesc from the ip using !ip2md\n\n[sourcecode]\n\n!ip2md 0066009a\n\n[/sourcecode]\n\n\u003e 0:000\u003e !ip2md 0066009a\n  \n\u003e MethodDesc: \u003cspan style=\"background-color:#ffff00;\"\u003e002237f0\u003c/span\u003e\n  \n\u003e Method Name: ConsoleApplication.Program.Main(System.String[])\n  \n\u003e Class: 002213f8\n  \n\u003e MethodTable: 00223804\n  \n\u003e mdToken: 06000001\n  \n\u003e Module: 00222e9c\n  \n\u003e IsJitted: yes\n  \n\u003e CodeAddr: 00660070\n  \n\u003e Transparency: Critical\n  \n\u003e Source file: c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs @ 13\n\nHere is from the methoddesc to IL\n\n[sourcecode]\n\n!dumpil 002237f0\n\n[/sourcecode]\n\n\u003e 0:000\u003e !dumpil 002237f0\n  \n\u003e ilAddr = 012a2050\n  \n\u003e IL_0000: ldstr \u0026#8220;naveen\u0026#8221;\n  \n\u003e IL_0005: stloc.0\n  \n\u003e IL_0006: ldloc.0\n  \n\u003e IL_0007: call System.Console::WriteLine\n  \n\u003e IL_000c: call System.Console::Read\n  \n\u003e IL_0011: pop\n  \n\u003e IL_0012: ret\n\nWhich looks very similar to my C# code. So looks like CLR optimized the code ,converted the Console.WriteLine to Console.get_Out. To validate it restarted the app with this as the command for break-point\n\n[sourcecode]\n  \n.load sosex;.loadby sos clr;!mbm \\*System.Console.get_Out\\* \"!mk\";g\n  \n[/sourcecode]\n\nAnd here is the output\n\n\u003e 00:M 0032ed58 655e70d1 \u003cspan style=\"background-color:#ffff00;\"\u003eSystem.Console.get_Out()\u003c/span\u003e(+0x0 IL)(+0x1 Native) [f:ddndpclrsrcBCLSystemConsole.cs, @ 193,17]\n  \n\u003e 01:M 0032ed60 003a007f \\*** WARNING: Unable to verify checksum for ConsoleApplication.exe\n  \n\u003e ConsoleApplication.Program.Main(System.String[])(+0x6 IL)(+0xf Native) [c:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication11Program.cs, @ 11,13]\n  \n\u003e 02:U 0032ed6c 661621db clr!CallDescrWorker+0x33\n\nNow that I have solved this I wanted to check the same on the debug build (optimized -) . To validate if it was Console.get_Out or Console.WriteLine. So when mscorlib loaded here was my command to check this\n\n[sourcecode]\n  \n.load sosex;.loadby sos clr;!mbm \\*Program.Main\\* \"!u @eip\";g\n  \n[/sourcecode]\n\nIn the above command I am setting a break-point on Main method and when the break-point hits \u0026#8220;!u @eip\u0026#8221; will disassemble the ip, the @eip register will have the address of the current function. Here is the output from !u @eip\n\n\u003e \\*** WARNING: Unable to verify checksum for ConsoleApplication11.exe\n\u003e \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 11:\n  \n\u003e 01f10070 55 push ebp\n  \n\u003e 01f10071 8bec mov ebp,esp\n  \n\u003e 01f10073 83ec0c sub esp,0Ch\n  \n\u003e 01f10076 894dfc mov dword ptr [ebp-4],ecx\n  \n\u003e 01f10079 833d3c31360000 cmp dword ptr ds:[36313Ch],0\n  \n\u003e 01f10080 7405 je 01f10087\n  \n\u003e 01f10082 e8c85a5064 call clr!JIT_DbgIsJustMyCode (66415b4f)\n  \n\u003e 01f10087 33d2 xor edx,edx\n  \n\u003e 01f10089 8955f4 mov dword ptr [ebp-0Ch],edx\n  \n\u003e 01f1008c 33d2 xor edx,edx\n  \n\u003e 01f1008e 8955f8 mov dword ptr [ebp-8],edx\n  \n\u003e \u003e\u003e\u003e 01f10091 90 nop\n  \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 12:\n  \n\u003e 01f10092 c745f80a000000 mov dword ptr [ebp-8],0Ah\n  \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 13:\n  \n\u003e 01f10099 8b0530200f03 mov eax,dword ptr ds:\\[30F2030h\\] (\u0026#8220;naveen\u0026#8221;)\n  \n\u003e 01f1009f 8945f4 mov dword ptr [ebp-0Ch],eax\n  \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 14:\n  \n\u003e 01f100a2 8b4df4 mov ecx,dword ptr [ebp-0Ch]\n  \n\u003e \\*** WARNING: Unable to verify checksum for C:WindowsassemblyNativeImages\\_v4.0.30319\\_32mscorlib246f1a5abb686b9dcdf22d3505b08ceamscorlib.ni.dll\n  \n\u003e 01f100a5 e802706d63 call mscorlib_ni+0x2570ac (655e70ac) (\u003cspan style=\"background-color:#ffff00;\"\u003eSystem.Console.WriteLine(System.String) \u003c/span\u003e, mdToken: 06000919)\n  \n\u003e 01f100aa 90 nop\n  \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 15:\n  \n\u003e 01f100ab e8b4c1ca63 call mscorlib_ni+0x82c264 (65bbc264) (System.Console.Read(), mdToken: 0600090a)\n  \n\u003e 01f100b0 90 nop\n  \n\u003e c:usersnaveendocumentsvisual studio 2010ProjectsConsoleApplication11Program.cs @ 17:\n  \n\u003e 01f100b1 90 nop\n  \n\u003e 01f100b2 8be5 mov esp,ebp\n  \n\u003e 01f100b4 5d pop ebp\n  \n\u003e 01f100b5 c3 ret\n  \n\u003e eax=003637f0 ebx=00000000 ecx=020fbc7c edx=00000000 esi=004bb2d0 edi=0016f400\n  \n\u003e eip=01f10091 esp=0016f3c8 ebp=0016f3d4 iopl=0 nv up ei pl zr na pe nc\n  \n\u003e cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246\n  \n\u003e 01f10091 90 nop\n\nNotice in the above code it is Console.WriteLine and not Console.get_Out.\n\nHere is one of gotchas of debugging optimized code."},{"title":"Using F# to Automate Reading–The Morning Brew","date":"2010-07-16T04:27:24Z","permalink":"/?p=997/","content":"I guess most of the .NET Devs read [The Morning Brew][1], if not you should.  It is a morning newspaper for the dev, so I end up reading it first thing when I go to work. I like to  try and automate most of the stuff . So I thought why not write a script that reads the Morning Brew feed, filter the excluded content that I am not interested in and open the urls before I come in. The reason behind using F# is I don’t have to compile the code. I could use it with FSI.exe. Incase if the extraction logic changes and I don’t have to recompile , it is just fixing the script. The best part of writing in F# is I avoid all the ceremony. Here is the F# code, it is nothing fancy. And this code can easily be modified for other link collection sites.\n\n[sourcecode]\n\n#r @\"C:WindowsMicrosoft.NETFrameworkv4.0.30319System.ServiceModel.dll\"\n  \n#r @\"C:WindowsMicrosoft.NETFrameworkv4.0.30319System.Xml.Linq.dll\"\n\nopen System.IO\n  \nopen System.ServiceModel.Syndication\n  \nopen System.Web\n  \nopen System.Xml\n  \nopen System.Xml.Linq\n  \nopen System.Diagnostics\n\nlet formatter = new Rss20FeedFormatter()\n  \nlet sw = new StringWriter();\n  \n// Excluded Keywords\n  \nlet exists (item:string) = File.ReadAllLines @\"c:Usersnaveenexclude.txt\" |\u003e\n                               \nSeq.exists(fun e -\u003e item.ToLower().Contains(e.ToLower()))\n\nformatter.ReadFrom(XmlReader.Create \"http://feeds.feedburner.com/ReflectivePerspective\")\n  \nformatter.Feed.Items |\u003e Seq.nth 0 |\u003e fun i -\u003e i.SaveAsRss20(new XmlTextWriter(sw))\n\nlet data = HttpUtility.HtmlDecode(sw.ToString())\n  \nXDocument.Parse(data).Descendants(XName.Get(\"li\")) |\u003e\n             \nSeq.filter(fun i -\u003e not (exists i.Value)) |\u003e\n             \nSeq.map(fun i -\u003e i.Descendants(XName.Get(\"a\"))) |\u003e\n             \nSeq.iter(fun x -\u003e x |\u003e Seq.iter(fun y -\u003e\n              \ntry\n                 \nSystem.Diagnostics.Process.Start (y.Attribute(XName.Get(\"href\")).Value) |\u003e ignore\n             \nwith\n             \n|ex -\u003e printfn \"Error : %s\" ex.Message))\n  \n[/sourcecode]\n\nMy excluded file at the moment contains javascript and jquery. I am not much into these. Here is the command line\n\n[sourcecode]\n  \n\"C:Program Files (x86)Microsoft F#v4.0Fsi.exe\" \u0026#8211;quiet \u0026#8211;exec \"C:Usersnaveenmorningbrew.fsx\"\n  \n[/sourcecode]\n\n[\u003cimg class=\"alignnone size-full wp-image-1011\" title=\"TheMorningBrew\" src=\"http://104.197.135.42/wp-content/uploads/2010/07/themorningbrew2.jpg\" alt=\"\" width=\"700\" height=\"418\" /\u003e][2]\n\n [1]: http://blog.cwa.me.uk/\n [2]: http://104.197.135.42/wp-content/uploads/2010/07/themorningbrew2.jpg"},{"title":"Combining Stack Overflow RSS, OData and API to query","date":"2010-07-14T03:18:05Z","permalink":"/?p=978/","content":"In my opinion [Stack Overflow][1] has a ton of knowledge to learn new tricks. And there are some really smart people in the SO community. I try and learn new things when I find time.\n\nI subscribe to RSS feeds for new questions on a particular topic. Example, here is one for F# from Stack Overflow \u003chttp://stackoverflow.com/feeds/tag/f%23\u003e. The advantage of the RSS feed is I get to see new questions, but the drawback is I would have to navigate to the site to look for answers. AFAIK the [stacky][2] (stack overflow API) does not provide a mechanism for querying new questions based on a tag.\n\nIt was easy for me to combine both of them to solve my problem. With RSS feed I could discover new questions and with the stacky I could get answers . And I use Linqpad as a scratchpad so it was easy to write-up something quick.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nvoid Main()\n  \n{\n   \nvar reader = XmlReader.Create(\"http://stackoverflow.com/feeds/tag/f%23\");\n   \nvar feed = SyndicationFeed.Load\u003cSyndicationFeed\u003e(reader);\n   \nvar length = \"http://stackoverflow.com/questions/\".Length;\n\nvar client = new StackyClient(\"1.0\", File.ReadAllText(@\"c:tempso.txt\"),HostSite.StackOverflow,new UrlClient(), new JsonProtocol());\n\nvar feedItems = from item in feed.Items\n                   \nlet nextOccurence = item.Id.ToString().IndexOf(\"/\",length)\n                   \nlet getId = new Func\u003cint\u003e(() =\u003e Convert.ToInt32( item.Id.Substring(length,nextOccurence \u0026#8211; length)))\n                   \nselect new {Id = getId(), Title = item.Title.Text, Body = item.Summary.Text.StripHTML()};\n\nvar answers = client.GetQuestionAnswers(feedItems.Select (y =\u003e y.Id),new AnswerOptions() { IncludeBody = true});\n\n// The latest F# feed questions and answers\n   \nvar qa = from question in feedItems\n            \njoin answer in answers on question.Id equals answer.QuestionId\n            \nwhere answer.Accepted == true\n            \nselect new { Title = question.Title, Question = question.Body.StripHTML(), Answer = answer.Body.StripHTML()};\n   \nqa.Dump();\n  \n}\n  \npublic static class Extensions\n  \n{\n        \npublic static string StripHTML(this string s)\n        \n{\n           \nreturn Regex.Replace(s, @\"\u003c(.|n)*?\u003e\", string.Empty);\n        \n}\n  \n}\n\n[/sourcecode]\n\n[\u003cimg class=\"alignnone size-full wp-image-981\" title=\"SO\" src=\"http://104.197.135.42/wp-content/uploads/2010/07/so1.jpg\" alt=\"\" width=\"700\" height=\"418\" /\u003e][3]\n\nAnd if you have been following F# and functional programming then you would probably know [Tomas][4]. I would also like to read what he has been answering. Again stacky does not provide an API to query user by name. This is where the SO [OData][5] comes in handy and LinqPad handles OData very well. Here is the code to get Tomas user id via OData and query for questions and answers which he has answered using stacky .\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nvar tomas = Users.Where(u =\u003e u.DisplayName.StartsWith(\"Tomas Pet\")).First().Id;\n  \nvar tomasQA = from ans in  client.GetUsersAnswers(tomas,new AnswerOptions() { IncludeBody = true })\n                \nselect new { Title = ans.Title, Question = client.GetQuestion(ans.QuestionId,true,false).Body.StripHTML(),\n                \nAnswer = ans.Body.StripHTML()};\n  \ntomasQA.Dump();\n  \n[/sourcecode]\n\n [1]: http://stackoverflow.com/\n [2]: http://stacky.codeplex.com/\n [3]: http://104.197.135.42/wp-content/uploads/2010/07/so1.jpg\n [4]: http://tomasp.net/\n [5]: https://odata.sqlazurelabs.com/OData.svc/v0.1/rp1uiewita/StackOverflow"},{"title":"Load the same Assembly from GAC and private bin path in .NET","date":"2010-07-12T21:31:40Z","permalink":"/?p=966/","content":"This post is all about exploring the CLR loader to load an assembly from GAC and from private bin path. This is not possible because, if an assembly is loaded from GAC and if the code uses Assembly.LoadFrom to load the same assembly, then the loader would return the assembly that has already been loaded from the GAC.\n\nHere is the ClassLibrary2 code\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n\nnamespace ClassLibrary2\n  \n{\n   \npublic class Class1\n   \n{\n   \npublic string Bar()\n   \n{\n   \nreturn \"bar\";\n   \n}\n\n}\n  \n}\n\n[/sourcecode]\n\nHere is the Winforms application to load the Class Library Code\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nusing System.Reflection;\n  \nusing System.Windows.Forms;\n  \nusing ClassLibrary2;\n  \nnamespace WindowsFormsApplication4\n  \n{\n   \npublic partial class Form1 : Form\n   \n{\n   \npublic Form1()\n   \n{\n   \nInitializeComponent();\n   \nvar c = new Class1();\n   \nConsole.WriteLine(c.Bar());\n   \n}\n\nprivate void button1_Click(object sender, EventArgs e)\n   \n{\n   \nvar  ad = AppDomain.CreateDomain(\"Test\");\n   \nad.AssemblyResolve += ((a1,e1) =\u003e Assembly.LoadFile(@\"C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9ClassLibrary2binDebugClassLibrary2.dll\"));\n   \nvar a = ad.Load(\"ClassLibrary\");\n   \nvar c1 = a.CreateInstance(\"ClassLibrary2.Class1\") as Class1;\n   \nc1.Bar();\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\nIf you notice the code creates an instance of the “Class1” in the Form1 constructor, this will essentially load the ClassLibrary2 in to memory. FYI the ClassLibrary2 is GACed when the application launches. Here is the fusglovwr output , which shows the assembly being loaded from GAC.\n\n\u003e LOG: This bind starts in default load context.\n\u003e \n\u003e LOG: Using application configuration file: C:UsersnaveenDocumentsVisual Studio 2010ProjectsWindowsFormsApplication4binDebugWindowsFormsApplication4.exe.Config\n\u003e \n\u003e LOG: Using host configuration file:\n\u003e \n\u003e LOG: Using machine configuration file from C:WindowsMicrosoft.NETFrameworkv4.0.30319configmachine.config.\n\u003e \n\u003e LOG: Post-policy reference: ClassLibrary2, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a0a06f4596f3e16\n\u003e \n\u003e LOG: Found assembly by looking in the GAC.\n\u003e \n\u003e LOG: Binding succeeds. Returns assembly from C:WindowsMicrosoft.NetassemblyGAC\\_MSILClassLibrary2v4.0\\_1.0.0.0__3a0a06f4596f3e16ClassLibrary2.dll.\n\u003e \n\u003e LOG: Assembly is loaded in default load context.\n\nAfter verifying fuslogvwr output , I uninstall the assembly from gac using gacutil /u (without closing the app). After which I click the button1 ,which will call the Assembly.LoadFrom to load the same assembly from private bin path. And here fuslogvwr output of loading the assembly using the load from, notice GAC lookup was unsuccessful.\n\n\u003e LOG: This bind starts in default load context.\n\u003e \n\u003e LOG: Using application configuration file: C:UsersnaveenDocumentsVisual Studio 2010ProjectsWindowsFormsApplication4binDebugWindowsFormsApplication4.exe.Config\n\u003e \n\u003e LOG: Using host configuration file:\n\u003e \n\u003e LOG: Using machine configuration file from C:WindowsMicrosoft.NETFrameworkv4.0.30319configmachine.config.\n\u003e \n\u003e LOG: Post-policy reference: ClassLibrary2, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a0a06f4596f3e16\n\u003e \n\u003e LOG: GAC Lookup was unsuccessful.\n\u003e \n\u003e LOG: Attempting download of new URL file:///C:/Users/naveen/Documents/Visual Studio 2010/Projects/WindowsFormsApplication4/bin/Debug/ClassLibrary2.DLL.\n\u003e \n\u003e LOG: Assembly download was successful. Attempting setup of file: C:UsersnaveenDocumentsVisual Studio 2010ProjectsWindowsFormsApplication4binDebugClassLibrary2.dll\n\u003e \n\u003e LOG: Entering run-from-source setup phase.\n\u003e \n\u003e LOG: Assembly Name is: ClassLibrary2, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a0a06f4596f3e16\n\u003e \n\u003e LOG: Binding succeeds. Returns assembly from C:UsersnaveenDocumentsVisual Studio 2010ProjectsWindowsFormsApplication4binDebugClassLibrary2.dll.\n\u003e \n\u003e LOG: Assembly is loaded in default load context.\n\nAnd here is the !dumpdomain output from windbg for this process\n\n\u003e Assembly:           003ce1e0 [C:WindowsMicrosoft.NetassemblyGAC\\_MSILClassLibrary2v4.0\\_1.0.0.0__3a0a06f4596f3e16ClassLibrary2.dll]\n  \n\u003e ClassLoader:        003ee5b8\n  \n\u003e SecurityDescriptor: 003d2838\n  \n\u003e Module Name\n  \n\u003e 00306b28            C:WindowsMicrosoft.NetassemblyGAC\\_MSILClassLibrary2v4.0\\_1.0.0.0__3a0a06f4596f3e16ClassLibrary2.dll\n\u003e \n\u003e Assembly:           003ceae0 [C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9ClassLibrary2binDebugClassLibrary2.dll]\n  \n\u003e ClassLoader:        0044f418\n  \n\u003e SecurityDescriptor: 00445ea8\n  \n\u003e Module Name\n  \n\u003e 011ee6b4            C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9ClassLibrary2binDebugClassLibrary2.dll\n\nNotice the first assembly is loaded from the GAC and the second one is loaded from the bin path.\n\nThis is not something that I would ever do. This was merely an exercise to bypass the loader.\n\nFYI when the assembly is uninstalled from GAC, the gacutil.exe creates a temp copy and stores the assembly in the temp directory because it is being used by a process. And the temp copy of the assembly is deleted when the process ends. Here is the screen shot of Procmon creating an temp copy of the GACed assembly which I uninstalled.\n\n[\u003cimg class=\"alignnone size-full wp-image-967\" title=\"gacutil\" src=\"http://104.197.135.42/wp-content/uploads/2010/07/gacutil1.jpg\" alt=\"\" width=\"700\" height=\"418\" /\u003e][1]\n\n [1]: http://104.197.135.42/wp-content/uploads/2010/07/gacutil1.jpg"},{"title":"Debugging Generic System.Nullable within Windbg","date":"2010-07-08T03:58:51Z","permalink":"/?p=947/","content":"In this post I am going to unravel the mystery of debugging the Nullable\u003cT\u003e within Windbg in .NET 3.5 and also compare it with .NET 4.0. Here is the sample code and it is compiled in .NET 3.5\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nnamespace ConsoleApplication\n  \n{\n   \nclass Program\n   \n{\n   \nInt32? test;\n   \nint i = 10;\n   \nstatic void Main(string[] args)\n   \n{\n   \nNullable\u003cT\u003e\n   \nInt32? i = 10;\n   \nObject o = 10;\n   \nvar p = new Program() { test = 20 };\n   \nConsole.Read();\n   \np.test = (Int32?) o ;\n   \nConsole.WriteLine(p.test.HasValue);\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\nAttached to the debugger on the Console.Read. FYI I always load sos and sosex extensions to debug managed code. Here is !mdt 0x0253c11c output\n\n\u003e 0:000\u003e !mdt 0x0253c11c\n  \n\u003e 0253c11c (ConsoleApplication.Program)\n  \n\u003e test:ERROR (0x80070057).\n  \n\u003e i:0xa (System.Int32)\n\nNotice that \u0026#8220;test\u0026#8221; does not have a value and has an error. Next issued !dumpobj\n\n[sourcecode]\n  \n!do 0x0253c11c\n  \n[/sourcecode]\n\n\u003e 0:000\u003e !do 0x0253c11c\n  \n\u003e Name: ConsoleApplication.Program\n  \n\u003e MethodTable: 002932f0\n  \n\u003e EEClass: 00291360\n  \n\u003e Size: 20(0x14) bytes\n  \n\u003e (C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e \u003cspan style=\"background-color:#ffff00;\"\u003e00000000\u003c/span\u003e 4000001        8                       1 instance 0280c124 test\n  \n\u003e 7776ab0c  4000002        4         System.Int32  1 instance       10 i\n\nMy fault ,I thought sos should be able to get the MethodTable of Nullable\u003cInt32\u003e for \u0026#8220;test\u0026#8221; when sosex couldn\u0026#8217;t.  To my surprise the MT output was \u003cspan style=\"background-color:#ffff00;\"\u003e00000000\u003c/span\u003e . To view the contents of the \u0026#8220;test\u0026#8221; I would have to use  the !dumpvc which requires methodtable. I know I could use the dd command. And here is the output from the dd 0280c124\n\n\u003e 0:000\u003e dd 0280c124\n  \n\u003e 0280c124  00000001 \u003cspan style=\"background-color:#ffff00;\"\u003e00000014\u003c/span\u003e 00000000 77767c70\n  \n\u003e 0280c134  00000000 00000000 00000000 00000000\n  \n\u003e 0280c144  00000000 00000000 777684dc 00000000\n  \n\u003e 0280c154  40010000 7776d7ec 00000003 00000008\n  \n\u003e 0280c164  00000100 00000000 77767cc4 00000000\n  \n\u003e 0280c174  00000000 00000000 00000000 00000001\n  \n\u003e 0280c184  0280c158 00000001 00000000 7776841c\n  \n\u003e 0280c194  00000000 00000000 00000000 00000000\n\nThe second field \u003cspan style=\"background-color:#ffff00;\"\u003e00000014\u003c/span\u003e is the actual value of test and here is the actual output\n\n\u003e 0:000\u003e ? poi(0280c124+0x4)\n  \n\u003e Evaluate expression: 20 = 00000014\n\nBut this does not solve the real issue of figuring out the methodtable to use it in !dumpvc. I could have used !mx System.Nullable* to get the MethodTable,  because I knew the type is Nullable\u003cInt\u003e ,what if I didn\u0026#8217;t know the type information.\n\nTo get the mt information I had to disassemble the code. First step is to get the !clrstack\n\n\u003e 0:000\u003e !CLRStack\n  \n\u003e OS Thread Id: 0x94c (0)\n  \n\u003e ESP       EIP\n  \n\u003e 0021f1dc 769d73ea [NDirectMethodFrameStandaloneCleanup: 0021f1dc] System.IO.__ConsoleStream.ReadFile(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte*, Int32, Int32 ByRef, IntPtr)\n  \n\u003e 0021f1f8 77c8ae67 System.IO.__ConsoleStream.ReadFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, Int32, Int32 ByRef)\n  \n\u003e 0021f224 77c8ad86 System.IO.__ConsoleStream.Read(Byte[], Int32, Int32)\n  \n\u003e 0021f244 776f9fbb System.IO.StreamReader.ReadBuffer()\n  \n\u003e 0021f258 77c677fc System.IO.StreamReader.Read()\n  \n\u003e 0021f264 77c8dd81 System.IO.TextReader+SyncTextReader.Read()\n  \n\u003e 0021f270 77bd328b System.Console.Read()\n  \n\u003e 0021f278 \u003cspan style=\"background-color:#ffff00;\"\u003e00320115\u003c/span\u003e ConsoleApplication.Program.Main(System.String[])\n  \n\u003e 0021f4d0 59781b6c [GCFrame: 0021f4d0]\n\nThe next is to !u 00320115 and here is the partial ouput\n\n\u003e 00320116 8b45d8          mov     eax,dword ptr [ebp-28h]\n  \n\u003e 00320119 3a4008          cmp     al,byte ptr [eax+8]\n  \n\u003e 0032011c 8d4008          lea     eax,[eax+8]\n  \n\u003e 0032011f 8945c8          mov     dword ptr [ebp-38h],eax\n  \n\u003e 00320122 ff75dc          push    dword ptr [ebp-24h]\n  \n\u003e 00320125 8b4dc8          mov     ecx,dword ptr [ebp-38h]\n  \n\u003e 00320128 bae8397777      mov     edx,offset mscorlib_ni+0x2739e8 (\u003cspan style=\"background-color:#ffff00;\"\u003e777739e8\u003c/span\u003e) (MT: System.Nullable\\`1[[System.Int32, mscorlib]])\n  \n\u003e 0032012d e8d6a74c59      call    mscorwks!JIT\\_Unbox\\_Nullable (597ea908)\n\nNotice the Method table \u003cspan style=\"background-color:#ffff00;\"\u003e777739e8\u003c/span\u003e for System.Nullable\\`1[[System.Int32, mscorlib]] and here is the output from !dumpmt -md 777739e8\n\n\u003e 0:000\u003e !dumpmt -md 777739e8\n  \n\u003e EEClass: 7752e7c8\n  \n\u003e Module: 77501000\n  \n\u003e Name: System.Nullable\\`1[[System.Int32, mscorlib]]\n  \n\u003e mdToken: 0200026d  (C:WindowsassemblyGAC\\_32mscorlib2.0.0.0\\__b77a5c561934e089mscorlib.dll)\n  \n\u003e BaseSize: 0x10\n  \n\u003e ComponentSize: 0x0\n  \n\u003e Number of IFaces in IFaceMap: 0\n  \n\u003e Slots in VTable: 14\n  \n\u003e \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8211;\n  \n\u003e MethodDesc Table\n  \n\u003e Entry MethodDesc      JIT Name\n  \n\u003e 77697028   775eace0     NONE System.Nullable\\`1[[System.Int32, mscorlib]].ToString()\n  \n\u003e 77697020   775eacc0     NONE System.Nullable\\`1[[System.Int32, mscorlib]].Equals(System.Object)\n  \n\u003e 77697018   775eacd0     NONE System.Nullable\\`1[[System.Int32, mscorlib]].GetHashCode()\n  \n\u003e 777374c0   775412a4   PreJIT System.Object.Finalize()\n  \n\u003e 77d010a0   775eac98   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]]..ctor(Int32)\n  \n\u003e 77d01100   775eaca0   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].get_HasValue()\n  \n\u003e 77d01120   775eaca8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].get_Value()\n  \n\u003e 77d01030   775eacb0   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].GetValueOrDefault()\n  \n\u003e 77d01140   775eacb8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].GetValueOrDefault(Int32)\n  \n\u003e 77d0100c   775eacf0   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].op_Implicit(Int32)\n  \n\u003e 77d00fe8   775eacf8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].op_Explicit(System.Nullable\\`1\u003cInt32\u003e)\n  \n\u003e 77d01040   775eacc8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].Equals(System.Object)\n  \n\u003e 77d01078   775eacd8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].GetHashCode()\n  \n\u003e 77d010c0   775eace8   PreJIT System.Nullable\\`1[[System.Int32, mscorlib]].ToString()\n\nNow that I have confirmed the mt and here is the output from !dumpvc 777739e8 0280c124\n\n\u003e 0:000\u003e !dumpvc 777739e8 0280c124\n  \n\u003e Name: System.Nullable\\`1[[System.Int32, mscorlib]]\n  \n\u003e MethodTable 777739e8\n  \n\u003e EEClass: 7752e7c8\n  \n\u003e Size: 16(0x10) bytes\n  \n\u003e (C:WindowsassemblyGAC\\_32mscorlib2.0.0.0\\__b77a5c561934e089mscorlib.dll)\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 7776eadc  40009a8        0       System.Boolean  1 instance        1 hasValue\n  \n\u003e 7776ab0c  40009a9        4         System.Int32  1 instance       20 value\n\nI decided to test this in .NET 4.0 and here is the output of !mdt for the Program object\n\n\u003e 0:000\u003e !mdt 0x0236bc44\n  \n\u003e 0236bc44 (ConsoleApplication.Program)\n  \n\u003e test:(System.Nullable\\`1[[System.Int32, mscorlib]]) VALTYPE (MT=6229f60c, ADDR=0236bc50)\n  \n\u003e i:0xa (System.Int32)\n\nNotice the \u0026#8220;test\u0026#8221; which is Nullable\u003cInt32\u003e is now recognized by sosex and it also provides the method table."},{"title":"Recursive !dumpmt – Windbg","date":"2010-07-06T01:04:53Z","permalink":"/?p=928/","content":"In this post I will be demonstrating how we could use CLR internal data-structures to recursively get the methodtable’s of an object and its base classes. The idea behind this is to understand the CLR data structure.\n\nHere is the sample code\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nnamespace ConsoleApplication\n  \n{\n   \nclass Program : B\n   \n{\n   \nstring test = \"cw\";\n   \nstatic void Main(string[] args)\n   \n{\n   \nvar p = new Program();\n   \nConsole.Read();\n   \n}\n   \n}\n   \nclass B : A\n   \n{\n   \npublic void TestB()\n   \n{\n   \n}\n   \n}\n   \nclass A\n   \n{\n   \npublic void TestA()\n   \n{\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\nThe “Program” object address  is \u003cspan style=\"background-color:#ffff00;\"\u003e0x0254bc38 \u003c/span\u003e and here  is the output of !dumpobj\n\n\u003e 0:000\u003e !do 0x0254bc38\n  \n\u003e Name:        ConsoleApplication.Program\n  \n\u003e MethodTable: \u003cspan style=\"background-color:#ffff00;\"\u003e001c3904\u003c/span\u003e\n  \n\u003e EEClass:     001c1508\n  \n\u003e Size:        12(0xc) bytes\n  \n\u003e File:        C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 6335f9ac  4000001        4        System.String  0 instance 0254bc44 test\n\nThe method table pointer for the Program class is \u003cspan style=\"background-color:#ffff00;\"\u003e001c3904 \u003c/span\u003e . Let\u0026#8217;s dump the raw memory instead of using !dumpobj\n\n[sourcecode]\n  \ndd 0x0254bc38\n  \n[/sourcecode]\n\n\u003e 0:000\u003e dd 0x0254bc38\n  \n\u003e 0254bc38  \u003cspan style=\"background-color:#ffff00;\"\u003e001c3904\u003c/span\u003e 0254bc44 80000000 6335f9ac\n  \n\u003e 0254bc48  00000002 00770063 00000000 00000000\n  \n\u003e 0254bc58  63367490 00000000 00000000 00000000\n  \n\u003e 0254bc68  00000000 00000000 00000000 6335f5e8\n  \n\u003e 0254bc78  00000000 40010000 63366034 00000003\n  \n\u003e 0254bc88  00000008 00000100 00000000 63366f40\n  \n\u003e 0254bc98  00000000 00000000 00000000 00000000\n  \n\u003e 0254bca8  00000001 0254bc80 00000001 00000000\n\nNow that we can see the MethodTable pointer is the first field we can get the Methods by using\n\n[sourcecode]\n\n!dumpmt -md poi(0x0254bc38)\n\n[/sourcecode]\n\n\u003e 0:000\u003e !dumpmt -md poi(0x0254bc38)\n  \n\u003e EEClass:      001c1508\n  \n\u003e Module:       001c2e9c\n  \n\u003e Name:         ConsoleApplication.Program\n  \n\u003e mdToken:      02000004\n  \n\u003e File:         C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e BaseSize:        0xc\n  \n\u003e ComponentSize:   0x0\n  \n\u003e Slots in VTable: 6\n  \n\u003e Number of IFaces in IFaceMap: 0\n  \n\u003e \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8211;\n  \n\u003e MethodDesc Table\n  \n\u003e Entry MethodDesc      JIT Name\n  \n\u003e 6326a7e0   63044934   PreJIT System.Object.ToString()\n  \n\u003e 6326e2e0   6304493c   PreJIT System.Object.Equals(System.Object)\n  \n\u003e 6326e1f0   6304495c   PreJIT System.Object.GetHashCode()\n  \n\u003e 632f1600   63044970   PreJIT System.Object.Finalize()\n  \n\u003e 002200d0   001c38f0      JIT ConsoleApplication.Program..ctor()\n  \n\u003e 00220070   001c38e4      JIT ConsoleApplication.Program.Main(System.String[])\n\nSo next time when we have an object we don\u0026#8217;t have to go look for method table pointer address.\n\nThe goal is to get every method of class  Program, B, A and System.Object automatically. To get this, lets dump the raw memory of the method table\n\n[sourcecode]\n  \ndd poi(0x0254bc38)\n  \n[/sourcecode]\n\n\u003e 0:000\u003e dd poi(0x0254bc38)\n  \n\u003e 001c3904  00080000 0000000c 00050011 00000004\n  \n\u003e 001c3914  \u003cspan style=\"background-color:#ffff00;\"\u003e001c3890 \u003c/span\u003e 001c2e9c 001c3934 001c1508\n  \n\u003e 001c3924  00000000 00000000 001c3854 002200d0\n  \n\u003e 001c3934  00000080 00000000 00000000 00000000\n  \n\u003e 001c3944  00000000 00000000 00000000 00000000\n  \n\u003e 001c3954  00000000 00000000 00000000 00000000\n  \n\u003e 001c3964  00000000 00000000 00000000 00000000\n  \n\u003e 001c3974  00000000 00000000 00000000 00000000\n\nThe 10th offset contains the address of its base class method table pointer, So in the above output it is  \u003cspan style=\"background-color:#ffff00;\"\u003e001c3890 \u003c/span\u003e.\n\nNow that we know it is the 10th offset, here is the script to get every method table for a class and its parents. FYI if the 10th offset is 00000000 then it means it is the super class which is System.Object.\n\n[sourcecode]\n  \nr$t0 =poi(0x0254bc38);.while(@$t0) {!dumpmt -md @$t0;.echo \\***\\***\\***\\***\\*****;r$t0=poi(@$t0+10)}\n  \n[/sourcecode]\n\nAnd here is the explanation for the above script\n\n  1. r$t0 =poi(0x0254bc38) \u0026#8211; Using a pseudo register $t0 to assign the value of mt of the 0x0254bc38\n  2. The .while loop will terminate when the value is 0. The  \u0026#8220;!dumpmt -md @$t0\u0026#8221; will dump the Method Table of the $t0 and the  \u0026#8220;r$t0=poi(@$t0+10)\u0026#8221; will reset $t0 its parent object method table.\n\nHere is the partial output from the above script with method tables from Program and B\n\n\u003e 0:000\u003e r$t0 =poi(0x0254bc38);.while(@$t0) {!dumpmt -md @$t0;.echo \\***\\***\\***\\***\\*****;r$t0=poi(@$t0+10)}\n  \n\u003e EEClass:      001c1508\n  \n\u003e Module:       001c2e9c\n  \n\u003e Name:         ConsoleApplication.Program\n  \n\u003e mdToken:      02000004\n  \n\u003e File:         C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e BaseSize:        0xc\n  \n\u003e ComponentSize:   0x0\n  \n\u003e Slots in VTable: 6\n  \n\u003e Number of IFaces in IFaceMap: 0\n  \n\u003e \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8211;\n  \n\u003e MethodDesc Table\n  \n\u003e Entry MethodDesc      JIT Name\n  \n\u003e 6326a7e0   63044934   PreJIT System.Object.ToString()\n  \n\u003e 6326e2e0   6304493c   PreJIT System.Object.Equals(System.Object)\n  \n\u003e 6326e1f0   6304495c   PreJIT System.Object.GetHashCode()\n  \n\u003e 632f1600   63044970   PreJIT System.Object.Finalize()\n  \n\u003e 002200d0   001c38f0      JIT ConsoleApplication.Program..ctor()\n  \n\u003e 00220070   001c38e4      JIT ConsoleApplication.Program.Main(System.String[])\n  \n\u003e \\***\\***\\***\\***\\*****\n  \n\u003e EEClass:      001c149c\n  \n\u003e Module:       001c2e9c\n  \n\u003e Name:         ConsoleApplication.B\n  \n\u003e mdToken:      02000003\n  \n\u003e File:         C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e BaseSize:        0xc\n  \n\u003e ComponentSize:   0x0\n  \n\u003e Slots in VTable: 6\n  \n\u003e Number of IFaces in IFaceMap: 0\n  \n\u003e \u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8212;\u0026#8211;\n  \n\u003e MethodDesc Table\n  \n\u003e Entry MethodDesc      JIT Name\n  \n\u003e 6326a7e0   63044934   PreJIT System.Object.ToString()\n  \n\u003e 6326e2e0   6304493c   PreJIT System.Object.Equals(System.Object)\n  \n\u003e 6326e1f0   6304495c   PreJIT System.Object.GetHashCode()\n  \n\u003e 632f1600   63044970   PreJIT System.Object.Finalize()\n  \n\u003e 00220120   001c3888      JIT ConsoleApplication.B..ctor()\n  \n\u003e 001cc02d   001c387c     NONE ConsoleApplication.B.TestB()\n  \n\u003e \\***\\***\\***\\***\\*****"},{"title":"dumpstring – windbg","date":"2010-06-30T01:55:42Z","permalink":"/?p=913/","content":"Viewing strings inside the debugger has never been pretty, especially if you are using sos extension.  Here is a sample !dumpobj on a string\n\n\u003e 0:000\u003e !do 00000000025f2280\n  \n\u003e Name:        System.String\n  \n\u003e MethodTable: 000007fef6e26960\n  \n\u003e EEClass:     000007fef69aeec8\n  \n\u003e Size:        32(0x20) bytes\n  \n\u003e String:     \u003cspan style=\"background-color:#ffff00;\"\u003eFoo\u003c/span\u003e\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr            Value Name\n  \n\u003e 000007fef6e2c848  40000ed        8         System.Int32  1 instance                3 m_stringLength\n  \n\u003e 000007fef6e2b388  40000ee        c          System.Char  1 instance               46 m_firstChar\n  \n\u003e 000007fef6e26960  40000ef       10        System.String  0   shared           static Empty\n  \n\u003e \u003e\u003e Domain:Value  00000000002ae900:00000000025e1420 \u003c\u003c\n\nSome of the devs like to use the du command\n\n[sourcecode]\n  \ndu 00000000025f2280+c\n  \n[/sourcecode]\n\n\u003e 0:000\u003e du 00000000025f2280+c\n\u003e \n\u003e 00000000\\`025f228c  \u003cspan style=\"background-color:#ffff00;\"\u003e\u0026#8220;Foo\u0026#8221;\u003c/span\u003e\n\nMy choice is to use the .printf command and here is my alias for printing string\n\n[sourcecode]\n  \nas !ds .printf \"%mu n\", c+\n  \n[/sourcecode]\n\n\u003e 0:000\u003e !ds 00000000025f2280\n\u003e \n\u003e \u003cspan style=\"background-color:#ffff00;\"\u003eFoo\u003c/span\u003e\n\nI prefer .printf over du because I am not interested in looking at the memory address often especially dumping strings within a script."},{"title":"Custom DumpArray – Windbg","date":"2010-06-25T00:59:42Z","permalink":"/?p=885/","content":"The [The][1] has !dumparray for getting contents of the array. But it cannot be used for scripting or automation. Here is an example\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nnamespace ConsoleApplication\n  \n{\n   \nclass Program\n  \n{\n   \nTest[] arr = new[] { new Test() { ID = 1, Name = \"Foo\" }, new Test() { ID = 2, Name = \"Bar\" } };\n   \nstatic void Main(string[] args)\n   \n{\n   \nvar p = new Program();\n   \nConsole.WriteLine(p.arr);\n   \nConsole.Read();\n   \n}\n   \n}\n   \nclass Test\n   \n{\n   \npublic int ID;\n   \npublic string Name;\n   \n}\n  \n}\n  \n[/sourcecode]\n\nAnd here is the output of the **\u003cspan style=\"color:#993366;\"\u003earr\u003c/span\u003e** variable within the debugger\n\n\u003e 0:000\u003e !da -details 021fbc6c\n  \n\u003e Name:        ConsoleApplication.Test[]\n  \n\u003e MethodTable: 64b56c28\n  \n\u003e EEClass:     648d9698\n  \n\u003e Size:        24(0x18) bytes\n  \n\u003e Array:       Rank 1, Number of elements 2, Type CLASS\n  \n\u003e Element Methodtable: 001938b0\n  \n\u003e [0] 021fbc84\n  \n\u003e Name:        ConsoleApplication.**\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e**\n  \n\u003e MethodTable: 001938b0\n  \n\u003e EEClass:     00191488\n  \n\u003e Size:        16(0x10) bytes\n  \n\u003e File:        C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  4000002        8             System.Int32      1     instance            1     ID\n  \n\u003e 64b9f9ac  4000003        4            System.String      0     instance     021fbc44     **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e**\n  \n\u003e [1] 021fbc94\n  \n\u003e Name:        ConsoleApplication.**\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e**\n  \n\u003e MethodTable: 001938b0\n  \n\u003e EEClass:     00191488\n  \n\u003e Size:        16(0x10) bytes\n  \n\u003e File:        C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  4000002        8             System.Int32      1     instance            2     ID\n  \n\u003e 64b9f9ac  4000003        4            System.String      0     instance     021fbc58     **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e**\n\nFrom the output  we cannot see the values of the  **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e** variable within the **\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e** class. To get the value we would have manually issue a !dumpobj on each one of these. In this post I will demonstrate how to automate this. In doing so we will also explore the array internals from raw memory perspective.\n\nTo start of lets dump the raw memory of the array. The  array address is \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc6c\u003c/strong\u003e\u003c/span\u003e\n\n[sourcecode]\n  \ndd 021fbc6c\n  \n[/sourcecode]\n\n\u003e 0:000\u003e dd **\u003cspan style=\"color:#0000ff;\"\u003e021fbc6c \u003c/span\u003e**\n  \n\u003e 021fbc6c  \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e64b56c28 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e00000002 \u003c/strong\u003e\u003c/span\u003e**\u003cspan style=\"color:#0000ff;\"\u003e001938b0 \u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cem\u003e021fbc84\u003c/em\u003e\u003c/span\u003e**\n  \n\u003e 021fbc7c  \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e\u003cem\u003e021fbc94 \u003c/em\u003e\u003c/strong\u003e\u003c/span\u003e00000000 001938b0 021fbc44\n  \n\u003e 021fbc8c  00000001 00000000 001938b0 021fbc58\n  \n\u003e 021fbc9c  00000002 00000000 64ba7490 00000000\n  \n\u003e 021fbcac  00000000 00000000 00000000 00000000\n  \n\u003e 021fbcbc  00000000 64b9f5e8 00000000 40010000\n  \n\u003e 021fbccc  64ba6034 00000007 00000004 00000100\n  \n\u003e 021fbcdc  00000000 64ba6f40 00000000 00000000\n\nFields\n\n  1. \u003cspan style=\"color:#00ff00;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e64b56c28\u003c/strong\u003e \u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Array\u0026#8217;s Method table pointer \u003c/span\u003e\u003c/span\u003e\n  2. \u003cspan style=\"color:#ff9900;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e00000002 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Array\u0026#8217;s length ( this will be used later)\u003c/span\u003e\u003c/span\u003e\n  3. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e001938b0 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211;\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003eArray contents method table pointer ( Test class)\u003c/span\u003e\u003c/span\u003e\n  4. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#000080;\"\u003e \u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc84\u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000080;\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#000080;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc94 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Contents of the array( 2 instances of the Test class)\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\n\nI would be using  $t0, $t1   [User-Defined Pseudo-Registers][2] within my script  as local variables to maintain state. Think of them as predefined variables that we can use. Here is the script to get just the **\u003cspan style=\"color:#993366;\"\u003eName \u003c/span\u003e**from the array\n\n[sourcecode]\n  \n.for (r $t0=0; @$t0 \u003c poi(021fbc6c+0x4); r$t0=@$t0+1 ) { r$t1 = 0; .if(@$t0 = 0) { r$t1=10} .else { r$t1= 10+ @$t0\\*4};.echo \\*\\***\\***\\*****;!do poi(poi((021fbc6c-0x4)+@$t1)+0x4) }\n  \n[/sourcecode]\n\nHere is the explanation for the above script\n\n  1. The [The [The][1] has !dumparray for getting contents of the array. But it cannot be used for scripting or automation. Here is an example\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nnamespace ConsoleApplication\n  \n{\n   \nclass Program\n  \n{\n   \nTest[] arr = new[] { new Test() { ID = 1, Name = \"Foo\" }, new Test() { ID = 2, Name = \"Bar\" } };\n   \nstatic void Main(string[] args)\n   \n{\n   \nvar p = new Program();\n   \nConsole.WriteLine(p.arr);\n   \nConsole.Read();\n   \n}\n   \n}\n   \nclass Test\n   \n{\n   \npublic int ID;\n   \npublic string Name;\n   \n}\n  \n}\n  \n[/sourcecode]\n\nAnd here is the output of the **\u003cspan style=\"color:#993366;\"\u003earr\u003c/span\u003e** variable within the debugger\n\n\u003e 0:000\u003e !da -details 021fbc6c\n  \n\u003e Name:        ConsoleApplication.Test[]\n  \n\u003e MethodTable: 64b56c28\n  \n\u003e EEClass:     648d9698\n  \n\u003e Size:        24(0x18) bytes\n  \n\u003e Array:       Rank 1, Number of elements 2, Type CLASS\n  \n\u003e Element Methodtable: 001938b0\n  \n\u003e [0] 021fbc84\n  \n\u003e Name:        ConsoleApplication.**\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e**\n  \n\u003e MethodTable: 001938b0\n  \n\u003e EEClass:     00191488\n  \n\u003e Size:        16(0x10) bytes\n  \n\u003e File:        C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  4000002        8             System.Int32      1     instance            1     ID\n  \n\u003e 64b9f9ac  4000003        4            System.String      0     instance     021fbc44     **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e**\n  \n\u003e [1] 021fbc94\n  \n\u003e Name:        ConsoleApplication.**\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e**\n  \n\u003e MethodTable: 001938b0\n  \n\u003e EEClass:     00191488\n  \n\u003e Size:        16(0x10) bytes\n  \n\u003e File:        C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication9binDebugConsoleApplication.exe\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  4000002        8             System.Int32      1     instance            2     ID\n  \n\u003e 64b9f9ac  4000003        4            System.String      0     instance     021fbc58     **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e**\n\nFrom the output  we cannot see the values of the  **\u003cspan style=\"color:#993366;\"\u003eName\u003c/span\u003e** variable within the **\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e** class. To get the value we would have manually issue a !dumpobj on each one of these. In this post I will demonstrate how to automate this. In doing so we will also explore the array internals from raw memory perspective.\n\nTo start of lets dump the raw memory of the array. The  array address is \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc6c\u003c/strong\u003e\u003c/span\u003e\n\n[sourcecode]\n  \ndd 021fbc6c\n  \n[/sourcecode]\n\n\u003e 0:000\u003e dd **\u003cspan style=\"color:#0000ff;\"\u003e021fbc6c \u003c/span\u003e**\n  \n\u003e 021fbc6c  \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e64b56c28 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e00000002 \u003c/strong\u003e\u003c/span\u003e**\u003cspan style=\"color:#0000ff;\"\u003e001938b0 \u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cem\u003e021fbc84\u003c/em\u003e\u003c/span\u003e**\n  \n\u003e 021fbc7c  \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e\u003cem\u003e021fbc94 \u003c/em\u003e\u003c/strong\u003e\u003c/span\u003e00000000 001938b0 021fbc44\n  \n\u003e 021fbc8c  00000001 00000000 001938b0 021fbc58\n  \n\u003e 021fbc9c  00000002 00000000 64ba7490 00000000\n  \n\u003e 021fbcac  00000000 00000000 00000000 00000000\n  \n\u003e 021fbcbc  00000000 64b9f5e8 00000000 40010000\n  \n\u003e 021fbccc  64ba6034 00000007 00000004 00000100\n  \n\u003e 021fbcdc  00000000 64ba6f40 00000000 00000000\n\nFields\n\n  1. \u003cspan style=\"color:#00ff00;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e64b56c28\u003c/strong\u003e \u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Array\u0026#8217;s Method table pointer \u003c/span\u003e\u003c/span\u003e\n  2. \u003cspan style=\"color:#ff9900;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e00000002 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Array\u0026#8217;s length ( this will be used later)\u003c/span\u003e\u003c/span\u003e\n  3. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e001938b0 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211;\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003eArray contents method table pointer ( Test class)\u003c/span\u003e\u003c/span\u003e\n  4. \u003cspan style=\"color:#ff0000;\"\u003e\u003cspan style=\"color:#000080;\"\u003e \u003c/span\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc84\u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000080;\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#000080;\"\u003e\u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc94 \u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8211; Contents of the array( 2 instances of the Test class)\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\n\nI would be using  $t0, $t1   [User-Defined Pseudo-Registers][2] within my script  as local variables to maintain state. Think of them as predefined variables that we can use. Here is the script to get just the **\u003cspan style=\"color:#993366;\"\u003eName \u003c/span\u003e**from the array\n\n[sourcecode]\n  \n.for (r $t0=0; @$t0 \u003c poi(021fbc6c+0x4); r$t0=@$t0+1 ) { r$t1 = 0; .if(@$t0 = 0) { r$t1=10} .else { r$t1= 10+ @$t0\\*4};.echo \\*\\***\\***\\*****;!do poi(poi((021fbc6c-0x4)+@$t1)+0x4) }\n  \n[/sourcecode]\n\nHere is the explanation for the above script\n\n  1. The][3] loop is used to iterate through the contents of the array :  \u0026#8220;.for (r $t0=0; @$t0 \u003c poi(021fbc6c+0x4); r$t0=@$t0+1 ) \u0026#8221; \n      * The loop variable is $t0, which is initialized to zero  \u0026#8220;r $t0=0;\u0026#8221;,\n      * Next is the loop condition check @$to \u003c poi(021fbc6c+0x4) , the poi(021fbc6c+0x4) is the pointer deference to array length which is \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e00000002\u003cbr /\u003e \u003c/strong\u003e\u003c/span\u003e\n      * \u003cspan style=\"color:#0000ff;\"\u003e\u003cspan style=\"color:#000000;\"\u003eAnd the last statement is the increment command of the loop variable \u003c/span\u003e\u003c/span\u003er$t0=@$t0+1\n      * Tip :- I am using \u0026#8220;@\u0026#8221; before the \u0026#8220;$\u0026#8221; for increased speed within the debugger when accessing registers.\n  2. The next statement is \u0026#8220;r$t1 = 0\u0026#8221; is initializing another pseudo register to zero\n  3. After which the command \u0026#8220;if(@$t0 = 0) { r$t1=10} .else { r$t1= 10+ @$t0\\*4}\u0026#8221; resets the value of $t1 register either \u0026#8220;10\u0026#8221; or $t0 \\* 4, where $to is loop variable. I do this because the first instance of the **\u003cspan style=\"color:#993366;\"\u003eTest\u003c/span\u003e** class within the array is in the 10th offset and the rest of them would be on the next 4th offset. So for example the first time loop ,$t1 would be 10 , the second time  $t1 would 14 (10 + 1*4).\n  4. The \u0026#8220;.echo \\***\\***\\***\\***\u0026#8221; is just for line separation\n  5. The last command is the one which does most of the work \n      * The command poi((021fbc6c-0x4)+@$t1) would return the pointer of the each element in the array which is instance of Test class . The first time it would be poi((021fbc6c-0x4)+10) which would point \u003cspan style=\"color:#0000ff;\"\u003e\u003cstrong\u003e021fbc84\u003cem\u003e \u003c/em\u003e\u003c/strong\u003e\u003cspan style=\"color:#000000;\"\u003eand the next time it would be \u003c/span\u003e\u003c/span\u003epoi((021fbc6c-0x4)+14) which would be **\u003cspan style=\"color:#0000ff;\"\u003e021fbc94\u003c/span\u003e**\n      * \u003cspan style=\"color:#0000ff;\"\u003e\u003cspan style=\"color:#000000;\"\u003eThe outermost \u0026#8220;poi 0x4\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003e\u0026#8221; is to get pointer of the member variable \u003cstrong\u003e\u003cspan style=\"color:#993366;\"\u003eName \u003c/span\u003e\u003c/strong\u003e\u003c/span\u003e\u003cspan style=\"color:#000000;\"\u003eand dump its content using !do\u003c/span\u003e\u003c/span\u003e\n\nAnd here is the output from the script\n\n\u003e 0:000\u003e .for (r $t0=0; @$t0 \u003c poi(021fbc6c   +0x4); r$t0=@$t0+1 ) { r$t1 = 0; .if(@$t0 = 0) { r$t1=10} .else { r$t1= 10+ @$t0\\*4};.echo \\*\\***\\***\\*****;  !do poi(poi((021fbc6c-0x4)+@$t1)+0x4) }\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Name:        System.String\n  \n\u003e MethodTable: 64b9f9ac\n  \n\u003e EEClass:     648d8bb0\n  \n\u003e Size:        20(0x14) bytes\n  \n\u003e File:        C:WindowsMicrosoft.NetassemblyGAC\\_32mscorlibv4.0\\_4.0.0.0__b77a5c561934e089mscorlib.dll\n  \n\u003e String:      **\u003cspan style=\"color:#993300;\"\u003eFoo\u003c/span\u003e**\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  40000ed        4         System.Int32  1 instance        3 m_stringLength\n  \n\u003e 64ba1dc8  40000ee        8          System.Char  1 instance       46 m_firstChar\n  \n\u003e 64b9f9ac  40000ef        8        System.String  0   shared   static Empty\n  \n\u003e \u003e\u003e Domain:Value  00745c28:021f1228 \u003c\u003c\n  \n\u003e \\***\\***\\***\\***\n  \n\u003e Name:        System.String\n  \n\u003e MethodTable: 64b9f9ac\n  \n\u003e EEClass:     648d8bb0\n  \n\u003e Size:        20(0x14) bytes\n  \n\u003e File:        C:WindowsMicrosoft.NetassemblyGAC\\_32mscorlibv4.0\\_4.0.0.0__b77a5c561934e089mscorlib.dll\n  \n\u003e String:      **\u003cspan style=\"color:#993300;\"\u003eBar\u003c/span\u003e**\n  \n\u003e Fields:\n  \n\u003e MT    Field   Offset                 Type VT     Attr    Value Name\n  \n\u003e 64ba2978  40000ed        4         System.Int32  1 instance        3 m_stringLength\n  \n\u003e 64ba1dc8  40000ee        8          System.Char  1 instance       42 m_firstChar\n  \n\u003e 64b9f9ac  40000ef        8        System.String  0   shared   static Empty\n  \n\u003e \u003e\u003e Domain:Value  00745c28:021f1228 \u003c\u003c\n\n [1]: http://msdn.microsoft.com/en-us/library/bb190764.aspx\n [2]: http://msdn.microsoft.com/en-us/library/ff553485(VS.85).aspx\n [3]: http://msdn.microsoft.com/en-us/library/ff563115(VS.85).aspx"},{"title":"Do I have Managed or Native memory leak?","date":"2010-06-22T22:38:52Z","permalink":"/?p=868/","content":"I noticed someone who couldn’t figure out the cause of memory leak in  managed application within the debugger. This person had basic debugging skills and was comfortable with sos.  FYI the leak wasn’t in the managed code, but in the native code. The managed code was using native code via PInvoke.\n\nHere is how I figured out the cause. Every time I have to debug a memory leak in managed code ,the first command I run is !vmstat. The !vmstat is available in psscor2.dll for .net 3.5 and for .net 4.0 it is available in sos. This command provides summary of VM. The output is similar to the [VMMap][1] tool and here is the output from the command.\n\n[\u003cimg class=\"alignnone size-full wp-image-869\" title=\"vmstat\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/vmstat1.jpg\" alt=\"\" width=\"450\" height=\"266\" /\u003e][2]\n\nNow that I know there is a memory leak, I always start of with running these commands\n\n[sourcecode]\n\n.shell -ci \"!EEHeap -loader\" findstr  \"LoaderHeap\"\n\n.shell -ci \"!EEHeap -gc\" findstr /B \"Total Size\"\n\n!heapstat  \u0026#8211; iu\n\n[/sourcecode]\n\nAnd here is the output from the above commands\n\n\u003e 0:004\u003e .shell -ci \u0026#8220;!EEHeap -loader\u0026#8221; findstr  \u0026#8220;LoaderHeap\u0026#8221;\n  \n\u003e Total LoaderHeap size: 0x10000(65,536)bytes\n  \n\u003e .shell: Process exited\n  \n\u003e 0:004\u003e .shell -ci \u0026#8220;!EEHeap -gc\u0026#8221; findstr /B \u0026#8220;Total Size\u0026#8221;\n  \n\u003e Total Size   0x3df74(253,812)\n  \n\u003e .shell: Process exited\n  \n\u003e 0:004\u003e !heapstat -iu\n  \n\u003e Heap     Gen0         Gen1         Gen2         LOH\n  \n\u003e Heap0    8204         182020       54820        8768\n\u003e \n\u003e Free space:                                                 Percentage\n  \n\u003e Heap0    12           149212       36           48          SOH: 60% LOH:  0%\n\u003e \n\u003e Unrooted objects:                                           Percentage\n  \n\u003e Heap0    1188         0            0            0           SOH:  0% LOH:  0%\n  \n\u003e 0:004\u003e\n\nAnd from the output I know there isn’t a managed memory leak. The total heap size is only 253,812 bytes and my loader heap is 65,536 bytes, so it has to be native code.  Now I can focus my efforts on the native code debugging.\n\n [1]: http://technet.microsoft.com/en-us/sysinternals/dd535533.aspx\n [2]: http://104.197.135.42/wp-content/uploads/2010/06/vmstat1.jpg"},{"title":"Customizing Witty Twitter Client Part 1- using C# as Compiler Service","date":"2010-06-20T03:28:46Z","permalink":"/?p=840/","content":"This is going to be a multipart blog post where I am going to be demonstrating how I have customized [This is going to be a multipart blog post where I am going to be demonstrating how I have customized][1] twitter client for my need. I chose Witty because it is the only OSS .NET twitter client I know of.\n\nOne of the reasons for customizing is primarily using C# as compiler service to extend it for my needs dynamically. For example I follow this twitter list \u003chttp://twitter.com/shanselman/programmers\u003e , it’s a cool list that Scott maintains, thanks to him. But there is one person in this list who keeps tweeting about weight loss, which I am least interested and I didn’t have control over it but to ignore, until now. And it is always fun to write  software for your daily needs, which for me saves time.  Thanks to Mono for C# as compiler service. FYI I have shown a simple usage of Mono Csharp compiler service in this [post][2].\n\nHere are things that I could get done by just spending few hours of my weekend time\n\nHere is my the default witty\n\n[\u003cimg class=\"alignnone size-full wp-image-841\" title=\"InitialWitty\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/initialwitty2.jpg\" alt=\"\" width=\"450\" height=\"484\" /\u003e][3]\n\nFilter the list by user name  which I am not interested in\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nnew Func\u003cTweet, bool\u003e(t =\u003e !t.User.Name.Contains(\"CNN\"));\n\n[/sourcecode]\n\nHere is the same without CNN\n\n[\u003cimg class=\"alignnone size-full wp-image-842\" title=\"Witty-FilteredByName\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/witty-filteredbyname2.jpg\" alt=\"\" width=\"450\" height=\"436\" /\u003e][4]\n\nFYI the filter C# code is in the Filter Text box\n\nThe next filter criteria is to look for tweets that have hashtag as fsharp and also at least have one link\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nnew Func\u003cTweet, bool\u003e(t =\u003e t.HashTags.DefaultIfEmpty().Contains(\"#fsharp\") \u0026\u0026 t.Urls.DefaultIfEmpty().Count() \u003e 0);\n\n[/sourcecode]\n\nAnd here is the filtered list\n\n[\u003cimg class=\"alignnone size-full wp-image-843\" title=\"Witty-FilteredByFSharp\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/witty-filteredbyfsharp2.png\" alt=\"\" width=\"450\" height=\"436\" /\u003e][5]\n\nBe even crazier look for tweets that have hashtag as fsharp and at least one link and then open the link automatically\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nnew Func\u003cTweet, bool\u003e(t =\u003e {\n   \nif (t.HashTags.DefaultIfEmpty().Contains(\"#fsharp\") \u0026\u0026 t.Urls.DefaultIfEmpty().Count() \u003e 0)\n   \nSystem.Diagnostics.Process.Start(t.Urls.First().ToString());\n   \nreturn t.HashTags.DefaultIfEmpty().Contains(\"#fsharp\") \u0026\u0026 t.Urls.DefaultIfEmpty().Count() \u003e 0; });\n  \n[/sourcecode]\n\n[\u003cimg class=\"alignnone size-full wp-image-844\" title=\"Witty-BrowserOpenLink\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/witty-browseropenlink2.png\" alt=\"\" width=\"450\" height=\"268\" /\u003e][6]\n\nThe browser with the link opened automatically.\n\nIt\u0026#8217;s a hack and I shouldn\u0026#8217;t be doing the above, but it does the job.\n\nThere is so much more possibilities. I could easily provide a save feature for these search scripts and reuse the same.  At the end of the series I will post the entire code in GitHub. But if you want to try it before that here are the simple changes I started doing to the code.\n\nExtension Method for Compilation\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nstatic class Extensions\n   \n{\n   \npublic static object Compile(this string code)\n   \n{\n   \nreturn Mono.CSharp.Evaluator.Evaluate(code);\n   \n}\n   \npublic static void Run(this string code)\n   \n{\n   \nMono.CSharp.Evaluator.Run(code);\n   \n}\n   \n}\n  \n[/sourcecode]\n\nThe filter code\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\npublic bool TweetFilter(object item)\n   \n{\n   \nTweet tweet = item as Tweet;\n\n// this will prevent the fade animation from starting when the tweet is filtered\n   \ntweet.IsNew = false;\n   \ntry\n   \n{\n   \nFunc\u003cTweet, bool\u003e compare = (Func\u003cTweet, bool\u003e)FilterTextBox.Text.Compile();\n   \nreturn compare.Invoke(tweet);\n   \n}\n   \ncatch(Exception ex)\n   \n{\n   \nConsole.WriteLine(ex);\n\n}\n   \nreturn true;\n   \n}\n  \n[/sourcecode]\n\nThe hashtags and Links weren’t part of the tweet class , but they were part of the UI class. So I had to bring them to the tweet class and populate them.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \npublic IEnumerable\u003cUri\u003e Urls\n   \n{\n   \nget\n   \n{\n   \nreturn links;\n   \n}\n   \nset\n   \n{\n   \nlinks.Clear();\n   \nlinks.AddRange(value);\n   \n}\n   \n}\n   \npublic IEnumerable\u003cstring\u003e HashTags\n   \n{\n   \nget\n   \n{\n   \nreturn hashTags;\n   \n}\n   \nset\n   \n{\n   \nhashTags.Clear();\n   \nhashTags.AddRange(value);\n   \n}\n   \n}\n\n[/sourcecode]\n\nAnd here is the code to populate the above properties\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nprivate IEnumerable\u003cUri\u003e GetLinks(string text)\n   \n{\n   \nstring[] words = Regex.Split(text, @\"([ (){}[]])\");\n   \nreturn (from word in words\n   \nlet isUrl = new Func\u003cstring, bool\u003e(s =\u003e UrlShorteningService.IsUrl(s))\n   \nwhere isUrl(word)\n   \nselect new Uri(word) ).ToList();\n   \n}\n   \nprivate IEnumerable\u003cstring\u003e GetHashTags(string text)\n   \n{\n   \nstring[] words = Regex.Split(text, @\"([ (){}[]])\");\n   \nreturn (from word in words\n   \nlet ishash = new Func\u003cstring, bool\u003e(s =\u003e s.StartsWith(\"#\"))\n   \nwhere ishash(word)\n   \nselect word).ToList();\n   \n}\n  \n[/sourcecode]\n\nI know for the above 2 functions I could have written a High-Order Function\n\n [1]: http://code.google.com/p/wittytwitter/\n [2]: http://naveensrinivasan.com/2010/05/11/using-c-compiler-as-a-service-in-f-poshconsole-powershell/\n [3]: http://104.197.135.42/wp-content/uploads/2010/06/initialwitty2.jpg\n [4]: http://104.197.135.42/wp-content/uploads/2010/06/witty-filteredbyname2.jpg\n [5]: http://104.197.135.42/wp-content/uploads/2010/06/witty-filteredbyfsharp2.png\n [6]: http://104.197.135.42/wp-content/uploads/2010/06/witty-browseropenlink2.png"},{"title":"Using Tuple as Dictionary / Map key","date":"2010-06-19T12:37:53Z","permalink":"/?p=829/","content":"I  recently had to create a dictionary which needed a multipart key like \u003cstring,int\u003e . To do this I would have to create a custom class  override equals and gethashcode. That’s when someone told I could use Tuple, but weren’t sure it was possible.  Here was the quick sample to try it in F#\n\n[sourcecode]\n  \nlet x = [(\"naveen\",1),1;(\"naveen\",1),2] |\u003e Map.ofList\n  \n[/sourcecode]\n\nas expected only one item in the Map\n\n\u003e val x : Map\u003c(string * int),int\u003e = map [((\u0026#8220;naveen\u0026#8221;, 1), 2)]\n\nAnd the same in C#\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n   \nConsole.WriteLine(Tuple.Create(\"Naveen\",1).Equals( Tuple.Create(\"Naveen\",1)));\n  \n[/sourcecode]\n\nThe next step was to actually disassemble Tuple in reflector\n\n[\u003cimg class=\"alignnone size-full wp-image-830\" title=\"Tuple\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/tuple2.jpg\" alt=\"\" width=\"450\" height=\"268\" /\u003e][1]\n\nThe code implements IStructuralComparable.CompareTo and does the comparison for each item. This is one of the reasons why generics is cool.\n\n [1]: http://104.197.135.42/wp-content/uploads/2010/06/tuple2.jpg"},{"title":"Using Tech-Ed OData to download videos","date":"2010-06-15T12:20:32Z","permalink":"/?p=2071/","content":"I wanted to watch the Teched 2010 videos, but the problem I had was going to the site manually to download files for offline viewing.  And I was also interested only in Dev sessions which were level 300 / 400. Thanks to OData for teched \u003chttp://odata.msteched.com/sessions.svc/\u003e ,I  could write 3 statements in linqpad and had them all downloaded using [wget][1]\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nFile.Delete(@\"C:tempdownload.txt\");\n\nSessions\n  \n.Where (s =\u003e (s.Level.StartsWith(\"400\") ||  s.Level.StartsWith(\"300\") ) \u0026\u0026 s.Code.StartsWith(\"DEV\"))\n  \n.Take(10)\n  \n.ToList()\n  \n.Select (s =\u003e @\"http://ecn.channel9.msdn.com/o9/te/NorthAmerica/2010/mp4/\" + s.Code + \".mp4\" )\n  \n.Run(s =\u003e File.AppendAllText(@\"C:tempdownload.txt\",s + Environment.NewLine));\n\nUtil.Cmd(@\"wget.exe -b -i c:Tempdownload.txt\",true);\n  \n[/sourcecode]\u003c/pre\u003e \n\nForgot to mention for the Run extension method is from Reactive Extensions\n\n [1]: http://gnuwin32.sourceforge.net/packages/wget.htm"},{"title":"Debugging base class method with conditional break point in .NET using Windbg","date":"2010-06-15T04:40:17Z","permalink":"/?p=803/","content":"In this post I am going to be demonstrating how to have a conditional break-point on the base class method where it has been used by multiple derived classes. A classic example is Winform UI.\n\nThe Control base class has got methods like set\\_Enabled , set\\_Visible which could be consumed by multiple derived controls. The goal is to debug only the control instance that we are interested in. Here is the sample code.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nusing System.Windows.Forms;\n  \nnamespace WindowsFormsApplication1\n  \n{\n  \npublic partial class Form1 : Form\n  \n{\n   \npublic Form1()\n   \n{\n   \nInitializeComponent();\n   \nbutton3.Click += (s, b) =\u003e button1.Enabled = button1.Enabled ? false : true;\n   \nbutton4.Click += (s, b) =\u003e button2.Enabled = button2.Enabled ? false : true;\n   \n}\n   \n}\n  \n}\n  \n[/sourcecode]\n\n[\u003cimg style=\"display:inline;border-width:0;\" title=\"image\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/image_thumb2.png\" border=\"0\" alt=\"image\" width=\"244\" height=\"244\" /\u003e][1]\n\nThis app that has four buttons. On the click of button3 it toggles button1’s enabled property and the button 4 does the same for button2. The goal is to break only when button1\u0026#8217;s enabled property is set.\n\nLaunched the app and attached it to windbg and loaded sosex, issued the command\n\n[sourcecode]\n  \n!mbm *Control.set_Enabled\n  \n[/sourcecode]\n\nto set a break-point on enabled method. FYI set_Enabled is not available in the button class because it is derived from the base class. The goal is to break only when the button1’s enabled property is changed. With the above command it will break every time and here is the output when the break-point hits\n\n\u003e rax=000007fede335c40 rbx=0000000000060b28 rcx=000000000242ed18\n  \n\u003e rdx=0000000000000000 rsi=0000000000000000 rdi=000000000242ed18\n  \n\u003e rip=000007fede335c4d rsp=000000000015dde0 rbp=000000000015df80\n  \n\u003e r8=0000000002464500  r9=0000000000000000 r10=000007fffff10018\n  \n\u003e r11=000000000015dd20 r12=00000000002f5980 r13=000000000015dea8\n  \n\u003e r14=000000000015e380 r15=0000000000100000\n  \n\u003e iopl=0         nv up ei pl nz na pe nc\n  \n\u003e cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202\n  \n\u003e System\\_Windows\\_Forms_ni+0x2b5c4d:\n  \n\u003e 000007fe\\`de335c4d 488bcf          mov     rcx,rdi\n\nThe rcx register contains the reference of the instance of the class ,  example button1 / button2. And here is the command to get the offset of the button text\n\n[sourcecode]\n  \n.shell -ci \"!do @rcx\" findstr /E text\n  \n[/sourcecode]\n\nand the output of the command is\n\n\u003e 0:000\u003e .shell -ci\u0026#8221;!do @ecx\u0026#8221; findstr /E text\n  \n\u003e 000007fef6db6960  40001c2       40        System.String  0 instance 000000000242ec50 text\n  \n\u003e 000007fef6db5ab8  400016d      280        System.Object  0   static 0000000002403d80 EventBindingContext\n  \n\u003e .shell: Process exited\n\nThe reason behind getting the button text offset is to use the text as the property for conditional break-point. The text member is available in the 40 offset of the button class. Now that we have the offset of the text property lets try and reset the break-point with a condition. To do this  get the address of the break-point using the bl command and the output is\n\n\u003e 0:000\u003e bl\n  \n\u003e 0 e 000007fe\\`de335c4d     0001 (0001)  0:\\**** System\\_Windows\\_Forms_ni+0x2b5c4d\n\nThe address of the set_Enabled function is 000007fe\\`de335c4d.   Here is the conditional break-point for button1\n\n[sourcecode]\n  \nbp 000007fe\\`de335c4d \"as /mu ${/v:name} (poi(@rcx+40)+c);.block{ .if (0== $scmp( \"${name}\", \"button1\") ) { .echo \u0026#8216;in button1\u0026#8217;;gc } .else { gc}}\"\n  \n[/sourcecode]\n\nThe “as /mu ${/v:name} (poi(@rcx+40)+c)” will set the value of text property  to the variable “name”. The .block command is used to evaluate the variable  “name” and the rest is a simple .if .else command. Every time the button1 is clicked it would output  “in button1” and continue. Now we have managed to break-in only on the button1 click.\n\n [1]: http://104.197.135.42/wp-content/uploads/2010/06/image2.png"},{"title":"Piracy in .NET Code – Part 3 – Even when the code is obfuscated","date":"2010-06-12T00:37:46Z","permalink":"/?p=769/","content":"Continuing with my [series][1] on Piracy, in this post I am going to be  exploring how someone with little advanced knowledge in CLR / Windows can bypass important function calls like  license validation.\n\nMost of the developers assume just because the code is obfuscated nobody can bypass the licensing logic. I am going to be demonstrating how to bypass certain function call,this is very similar to “Set Next Statement \u0026#8221; in VS. I am not going to be discussing on how to fix this problem.\n\nHere is a sample code.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n  \nusing System;\n  \nnamespace Conosole\n  \n{   class Program\n   \n{\n   \nstatic void Main(string[] args)\n   \n{\n   \nConsole.WriteLine(\"Test\");\n   \nConsole.Read();\n   \n}\n   \n}\n   \n}\n  \n[/sourcecode]\n\nThe code has only two instructions. First one writes to console and the next to reads from the console. I would want to bypass the call to that WriteLine function.\n\nLoaded the assembly within windbg and then issued the command\n\n[sourcecode]\n  \nsxe ld: clrjit\n  \n[/sourcecode]\n\nWhen the break-point hits ,issued the command to set a break-point on the Main Method\n\n[sourcecode]\n  \n.loadby sos clr;.load sosex;!mbm *Program.Main;g\n  \n[/sourcecode]\n\nThen when the break-point hits for the Main method , issued the following command to disassemble the Main method.\n\n[sourcecode]\n  \n!u ($ip)\n  \n[/sourcecode]\n\n\u003e 0:000\u003e !u ($ip)\n  \n\u003e Normal JIT generated code\n  \n\u003e Conosole.Program.Main(System.String[])\n  \n\u003e Begin 00230070, size 2d\n\u003e \n\u003e C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication6Program.cs @ 6:\n  \n\u003e 00230070 55              push    ebp\n  \n\u003e 00230071 8bec            mov     ebp,esp\n  \n\u003e 00230073 50              push    eax\n  \n\u003e 00230074 894dfc          mov     dword ptr [ebp-4],ecx\n  \n\u003e 00230077 833d3c31180000  cmp     dword ptr ds:[18313Ch],0\n  \n\u003e 0023007e 7405            je      00230085\n  \n\u003e 00230080 e8ca5a6962      call    clr!JIT_DbgIsJustMyCode (628c5b4f)\n  \n\u003e \u003e\u003e\u003e 00230085 90              nop\n\u003e \n\u003e C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication6Program.cs @ 7:\n  \n\u003e 00230086 8b0d30204a03    mov     ecx,dword ptr ds:\\[34A2030h\\] (\u0026#8220;Test\u0026#8221;)\n  \n\u003e 0023008c e81b707a61      call    mscorlib_ni+0x2570ac (619d70ac) (System.Console.WriteLine(System.String), mdToken: 06000919)\n  \n\u003e 00230091 90              nop\n\u003e \n\u003e C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication6Program.cs @ 8:\n  \n\u003e 00230092 e8cdc1d761      call    mscorlib_ni+0x82c264 (61fac264) (System.Console.Read(), mdToken: 0600090a)\n  \n\u003e 00230097 90              nop\n\u003e \n\u003e C:UsersnaveenDocumentsVisual Studio 2010ProjectsConsoleApplication6Program.cs @ 9:\n  \n\u003e 00230098 90              nop\n  \n\u003e 00230099 8be5            mov     esp,ebp\n  \n\u003e 0023009b 5d              pop     ebp\n  \n\u003e 0023009c c3              ret\n  \n\u003e 0:000\u003e bp 0023008c\n  \n\u003e 0:000\u003e g\n\nBecause I have private symbols the line information is shown. So the function I want to bypass is “0023008c e81b707a61      call    mscorlib_ni+0x2570ac (619d70ac) (System.Console.WriteLine(System.String), mdToken: 06000919)” and the ip for this is 0023008c , so went ahead and set a break-point on the address\n\n[sourcecode]\n  \nbp 0023008c\n  \n[/sourcecode]\n\nWhen the break-point hits on 0023008c, I move pointer to the next instruction that I am interested in ,which is “00230092 e8cdc1d761      call    mscorlib_ni+0x82c264 (61fac264) (System.Console.Read(), mdToken: 0600090a)” to avoid the function being invoked and here is the command\n\n[sourcecode]\n  \nr eip=00230092\n  \n[/sourcecode]\n\n\u003e 0:000\u003e g\n  \n\u003e Breakpoint 1 hit\n  \n\u003e eax=001837f0 ebx=00000000 ecx=024abb50 edx=0041efd0 esi=008196c0 edi=0041ef20\n  \n\u003e eip=0023008c esp=0041eef0 ebp=0041eef4 iopl=0         nv up ei pl zr na pe nc\n  \n\u003e cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246\n  \n\u003e 0023008c e81b707a61      call    mscorlib_ni+0x2570ac (619d70ac)\n  \n\u003e 0:000\u003e r eip=00230092\n\nNow we have managed to bypass the call to Console.WriteLine and here is my output .\n\n[\u003cimg class=\"alignnone size-full wp-image-776\" title=\"Console\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/console1.jpg\" alt=\"\" width=\"450\" height=\"227\" /\u003e][2]\n\nSo the key takeaway is to understand the working  of the platform closer to the metal, which can help us write better and secure code.\n\n [1]: http://naveensrinivasan.com/category/security/\n [2]: http://104.197.135.42/wp-content/uploads/2010/06/console1.jpg"},{"title":"Using Windows Error Reporting (WER) API in managed code to generate memory dump","date":"2010-06-10T03:01:09Z","permalink":"/?p=750/","content":"The WER is a pretty cool technology from Microsoft for collecting memory dumps on process crash/ hang. This can be extended to generate on demand when the application needs to. The usual reason for getting a memory dump could be based on certain conditions, for example, the customer feels the application is slow and would want to send the information to WinQual (WER server). If the application happens to be installed on hundreds / thousands of boxes then its not going to be possible to get from individual customers, the best bet is WER. To do this here is an [API][1]. But this is unmanaged API and I didn’t see one for managed code. FYI this would work only on Vista + systems, it will not work on XP.\n\nHere is the basic PInvoke for creating dump and submitting a report. I am also using it along with the watsonbuckets that I had [blogged][2] about.\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\ninternal enum WER_CONSENT\n   \n{\n   \nWerConsentAlwaysPrompt = 4,\n   \nWerConsentApproved = 2,\n   \nWerConsentDenied = 3,\n   \nWerConsentMax = 5,\n   \nWerConsentNotAsked = 1\n   \n}\n   \ninternal enum WER\\_DUMP\\_TYPE\n   \n{\n   \nWerDumpTypeHeapDump = 3,\n   \nWerDumpTypeMax = 4,\n   \nWerDumpTypeMicroDump = 1,\n   \nWerDumpTypeMiniDump = 2\n   \n}\n   \ninternal enum WER\\_REPORT\\_TYPE\n   \n{\n   \nWerReportNonCritical,\n   \nWerReportCritical,\n   \nWerReportApplicationCrash,\n   \nWerReportApplicationHange,\n   \nWerReportKernel,\n   \nWerReportInvalid\n   \n}\n\ninternal static class Unmanaged\n   \n{\n   \n[DllImport(\"wer.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n   \ninternal static extern int WerReportAddDump(IntPtr hReportHandle,\n   \nIntPtr hProcess, IntPtr hThread, WER\\_DUMP\\_TYPE dumpType, IntPtr pExceptionParam, IntPtr pDumpCustomOptions, int dwFlags);\n   \n[DllImport(\"wer.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n   \ninternal static extern int WerReportCreate(string pwzEventType,\n   \nWER\\_REPORT\\_TYPE repType, IntPtr pReportInformation, ref IntPtr phReportHandle);\n   \n[DllImport(\"wer.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n   \ninternal static extern int WerReportSetParameter(IntPtr hReportHandle, int dwparamID, string pwzName, string pwzValue);\n   \n[DllImport(\"wer.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n   \ninternal static extern int WerReportSubmit(IntPtr hReportHandle, WER_CONSENT consent, int dwFlags, ref IntPtr pSubmitResult);\n   \n}\n\n[/sourcecode]\n\nI have shown only few functions in the wer api, there are few more.  Here is the total implementation\n\n[sourcecode language=\u0026#8221;csharp\u0026#8221;]\n\nusing System;\n  \nusing System.Windows.Forms;\n  \nusing System.Runtime.InteropServices;\n  \nnamespace WER\n  \n{\n   \npublic partial class Form1 : Form\n   \n{\n   \nstatic bool Failed(int result)\n   \n{\n   \nreturn (result \u003c 0);\n   \n}\n   \npublic Form1()\n   \n{\n   \nInitializeComponent();\n   \nbutton1.Click += (s, b) =\u003e\n   \n{\n   \ntry\n   \n{\n   \nthrow new NullReferenceException(\"Test\");\n   \n}\n   \ncatch (Exception ex)\n   \n{\n\nvar bucket = GetWatsonBuckets();\n   \nvar zero = IntPtr.Zero;\n\nif ((!Failed(Unmanaged.WerReportCreate(\"CrashingApp\",\n   \nWER\\_REPORT\\_TYPE.WerReportCritical, IntPtr.Zero, ref zero)) \u0026\u0026\n   \n(zero != IntPtr.Zero)) \u0026\u0026 ((((!Failed(Unmanaged.WerReportSetParameter(zero, 0, \"AppName\", bucket.param0))\n   \n\u0026\u0026 !Failed(Unmanaged.WerReportSetParameter(zero, 1, \"AppVer\", bucket.param1))) \u0026\u0026\n   \n(!Failed(Unmanaged.WerReportSetParameter(zero, 2, \"AppStamp\", bucket.param2)) \u0026\u0026\n   \n!Failed(Unmanaged.WerReportSetParameter(zero, 3, \"AsmAndModName\", bucket.param3)))) \u0026\u0026\n   \n((!Failed(Unmanaged.WerReportSetParameter(zero, 4, \"AsmVer\", bucket.param4)) \u0026\u0026\n   \n!Failed(Unmanaged.WerReportSetParameter(zero, 5, \"ModStamp\", bucket.param5))) \u0026\u0026\n   \n(!Failed(Unmanaged.WerReportSetParameter(zero, 6, \"MethodDef\", bucket.param6)) \u0026\u0026\n   \n!Failed(Unmanaged.WerReportSetParameter(zero, 7, \"Offset\", bucket.param7))))) \u0026\u0026\n   \n!Failed(Unmanaged.WerReportSetParameter(zero, 8, \"ExceptionType\", bucket.param8))))\n   \n{\n\nvar currentProcess = System.Diagnostics.Process.GetCurrentProcess().Handle;\n   \nif (!Failed(Unmanaged.WerReportAddDump(zero, currentProcess,\n   \nIntPtr.Zero, WER\\_DUMP\\_TYPE.WerDumpTypeHeapDump, IntPtr.Zero, IntPtr.Zero, 0)))\n   \n{\n   \nvar pSubmitResult = IntPtr.Zero;\n   \nUnmanaged.WerReportSubmit(zero, WER_CONSENT.WerConsentNotAsked, 4, ref pSubmitResult);\n   \n}\n   \n}\n   \n}\n   \n};\n   \n}\n   \nprivate static WatsonBuckets GetWatsonBuckets()\n   \n{\n   \nvar pParams = new WatsonBuckets();\n   \nIClrRuntimeHost host = null;\n   \nhost = Activator.CreateInstance(Type.GetTypeFromCLSID(ClrGuids.ClsIdClrRuntimeHost)) as IClrRuntimeHost;\n   \nif (host != null)\n   \n{\n   \nvar clrControl = host.GetCLRControl();\n   \nif (clrControl == null)\n   \n{\n   \nreturn pParams;\n   \n}\n   \nvar clrErrorReportingManager =\n   \nclrControl.GetCLRManager(ref ClrGuids.IClrErrorReportingManager) as IClrErrorReportingManager;\n   \nif (clrErrorReportingManager == null)\n   \n{\n   \nreturn pParams;\n   \n}\n   \nclrErrorReportingManager.GetBucketParametersForCurrentException(out pParams);\n   \n}\n   \nreturn pParams;\n   \n}\n   \n}\n   \n// BucketParameters Structure to get watson buckets back from CLR\n   \n//http://msdn.microsoft.com/en-us/library/ms404466(v=VS.100).aspx\n   \n[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]\n   \ninternal struct WatsonBuckets\n   \n{\n   \ninternal int fInited;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string pszEventTypeName;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param0;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param1;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param2;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param3;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param4;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param5;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param6;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param7;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param8;\n   \n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0xff)]\n   \ninternal string param9;\n   \n}\n   \ninternal static class ClrGuids\n   \n{\n   \ninternal static readonly Guid ClsIdClrRuntimeHost = new Guid(\"90F1A06E-7712-4762-86B5-7A5EBA6BDB02\");\n   \ninternal static Guid IClrErrorReportingManager = new Guid(\"980D2F1A-BF79-4c08-812A-BB9778928F78\");\n   \ninternal static readonly Guid IClrRuntimeHost = new Guid(\"90F1A06C-7712-4762-86B5-7A5EBA6BDB02\");\n   \n}\n   \n[Guid(\"90F1A06C-7712-4762-86B5-7A5EBA6BDB02\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]\n   \ninternal interface IClrRuntimeHost\n   \n{\n   \nvoid Start();\n   \nvoid Stop();\n   \nvoid SetHostControl(IntPtr pHostControl);\n   \nIClrControl GetCLRControl();\n   \nvoid UnloadAppDomain(int dwAppDomainId, bool fWaitUntilDone);\n   \nvoid ExecuteInAppDomain(int dwAppDomainId, IntPtr pCallback, IntPtr cookie);\n   \nint GetCurrentAppDomainId();\n\nint ExecuteApplication(string pwzAppFullName, int dwManifestPaths, string[] ppwzManifestPaths,\n   \nint dwActivationData, string[] ppwzActivationData);\n\nint ExecuteInDefaultAppDomain(string pwzAssemblyPath, string pwzTypeName, string pwzMethodName,\n   \nstring pwzArgument);\n   \n}\n   \n[Guid(\"9065597E-D1A1-4fb2-B6BA-7E1FCE230F61\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]\n   \ninternal interface IClrControl\n   \n{\n   \n[return: MarshalAs(UnmanagedType.IUnknown)]\n   \nobject GetCLRManager([In] ref Guid riid);\n\nvoid SetAppDomainManagerType(string pwzAppDomainManagerAssembly, string pwzAppDomainManagerType);\n   \n}\n   \n// IClrErrorReportingManager to get watson bukets back from CLR\n   \n//http://msdn.microsoft.com/en-us/library/ms164367(v=VS.100).aspx\n   \n[Guid(\"980D2F1A-BF79-4c08-812A-BB9778928F78\"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]\n   \ninternal interface IClrErrorReportingManager\n   \n{\n   \n[PreserveSig]\n   \nint GetBucketParametersForCurrentException(out WatsonBuckets pParams);\n   \n}\n  \n}\n  \n[/sourcecode]\n\nIn the above code ,I am using this within a windows form to create a memory dump when an exception is thrown. The GetWatson bucket and the clr hosting interface is just to get the watson bucket information from clr. This can even be extended to attach a custom log file. How cool is this. Here is the call-stack for the above exception\n\n[\u003cimg class=\"alignnone size-full wp-image-762\" title=\"wer1\" src=\"http://104.197.135.42/wp-content/uploads/2010/06/wer12.jpg\" alt=\"\" width=\"450\" height=\"268\" /\u003e][3]\n\n [1]: http://msdn.microsoft.com/en-us/library/bb513635%28VS.85%29.aspx\n [2]: http://naveensrinivasan.com/2010/04/24/exploring-unhandledexception-in-net-and-watson-buckets/\n [3]: http://104.197.135.42/wp-content/uploads/2010/06/wer12.jpg"},{"title":"Identifying High CPU in GC (.NET) because of LOH – using Windbg","date":"2010-02-15T04:57:22Z","permalink":"/?p=40/","content":"I am sure most of us are aware that one of the common reasons for High CPU usage .NET is because of, percentage time spent on GC is high. There are lot of write up about this. \u003ca href=\"http://blogs.msdn.com/tess/archive/2006/06/22/643309.aspx\" target=\"_blank\"\u003eTess\u003c/a\u003e has amazing blog post  on this specifically, which explains in detail how to identify the symptoms. But one thing that I want share was the experience I had ,where in i could identify the real call stack which was causing allocation on LOH by have a break-point on the CLR Garbage collector itself. I am going to assume that you are aware of CLR GC and LOH and basic debugging using windbg.\n\nFYI the Perfmon counter like “% Time spent in GC”, “Large Object Heap size” can identify we have an issue with allocation in LOH. But this only indicates there is a problem in High allocations that’s causing  GC to work hard and in turn causing high CPU usage . But does not point where the exact problem is .If there is a large code base and all of sudden if there is an issue like this it is hard to pinpoint where the root cause of the problem.\n\nI am going to walk through an example on a button click the code allocates objects on LOH and identify it using windbg.\n\n\u003cspan style=\"color:blue;\"\u003eusing \u003c/span\u003eSystem;\n  \n\u003cspan style=\"color:blue;\"\u003eusing\u003c/span\u003eSystem.Collections.Generic;\n  \n\u003cspan style=\"color:blue;\"\u003eusing\u003c/span\u003eSystem.Linq;\n  \n\u003cspan style=\"color:blue;\"\u003eusing\u003c/span\u003eSystem.Windows.Forms;\n\n\u003cspan style=\"color:blue;\"\u003enamespace\u003c/span\u003eWindowsFormsApplication1\n  \n{\n  \n\u003cspan style=\"color:blue;\"\u003epublic partial class\u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eForm1\u003c/span\u003e: \u003cspan style=\"color:#2b91af;\"\u003eForm\u003cbr /\u003e \u003c/span\u003e{\n  \n\u003cspan style=\"color:blue;\"\u003epublic\u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eList\u003c/span\u003e\u003c\u003cspan style=\"color:blue;\"\u003ebyte\u003c/span\u003e[]\u003e buffer = \u003cspan style=\"color:blue;\"\u003enew\u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eList\u003c/span\u003e\u003c\u003cspan style=\"color:blue;\"\u003ebyte\u003c/span\u003e[]\u003e();\n\n\u003cp style=\"padding-left:30px;\"\u003e\n  \u003cspan style=\"color:blue;\"\u003epublic\u003c/span\u003eForm1()\u003cbr /\u003e {\u003cbr /\u003e InitializeComponent();\u003cbr /\u003e }\n\u003c/p\u003e\n\n\u003cp style=\"padding-left:30px;\"\u003e\n  \u003cspan style=\"color:blue;\"\u003eprivate void\u003c/span\u003eButton1Click(\u003cspan style=\"color:blue;\"\u003eobject\u003c/span\u003esender, \u003cspan style=\"color:#2b91af;\"\u003eEventArgs \u003c/span\u003ee)\u003cbr /\u003e {\u003cbr /\u003e AllocateinLOH();\u003cbr /\u003e }\n\u003c/p\u003e\n\n\u003cp style=\"padding-left:30px;\"\u003e\n  \u003cspan style=\"color:blue;\"\u003evoid\u003c/span\u003eAllocateinLOH()\u003cbr /\u003e {\u003cbr /\u003e \u003cspan style=\"color:blue;\"\u003evar \u003c/span\u003eb = \u003cspan style=\"color:blue;\"\u003enew byte\u003c/span\u003e[85001];\u003cbr /\u003e b.ToList().ForEach(\u003cbr /\u003e (x) =\u003e x = \u003cspan style=\"color:blue;\"\u003enew byte\u003c/span\u003e());\n\u003c/p\u003e\n\n\u003cp style=\"padding-left:30px;\"\u003e\n  buffer.Add(\u003cspan style=\"color:blue;\"\u003enew byte\u003c/span\u003e[85001]);\u003cbr /\u003e }\n\u003c/p\u003e\n\n}\n  \n}\n\n[][1]In the above code AllocateinLOH will cause the heap allocations to LOH because the size is more than 85000 bytes. The next step is to launch the application and attach it to the debugger. To figure out the cause I could have got multiple memory dumps  and checked at every call stack when GC was happening . That is the harder way and we could be spending lot of time on that.\n\nTo get to solve the problem i always like to approach from the bottom of the stack. I was certain there should be a function within the CLR / GC which should be doing this and I was certain it has to be within MSCORWKS.dll. The next step was examine symbols using “x” command and here is the output\n\n\u003e 0:000\u003e x mscorwks!wks::gc_heap::*\n\u003e \n\u003e 000007fe\\`e90d1340 mscorwks!WKS::gc\\_heap::alloc\\_allocated = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e89fd380 mscorwks!WKS::gc\\_heap::limit\\_from_size = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8907e20 mscorwks!WKS::gc\\_heap::fix\\_older\\_allocation\\_area = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e90d1310 mscorwks!WKS::gc\\_heap::max\\_free\\_space\\_items = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e90cba38 mscorwks!WKS::gc\\_heap::gc\\_low = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8dae150 mscorwks!WKS::gc\\_heap::grow\\_brick\\_card\\_tables = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8a12d40 mscorwks!WKS::gc\\_heap::fix\\_generation_bounds = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8a13040 mscorwks!WKS::gc\\_heap::fix\\_large\\_allocation\\_area = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8a2c680 mscorwks!WKS::gc\\_heap::allocate\\_large_object = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e90c0478 mscorwks!WKS::gc_heap::slow = \u003cno type information\u003e\n  \n\u003e 000007fe\\`e8ed8ec0 mscorwks!WKS::gc\\_heap::c\\_promote_callback = \u003cno type information\u003e\n\nThe above results are only partial because it was not necessary to get all the methods. The command “x mscorwks!wks::gc\\_heap::\\*” causes the debugger to get all the functions that are within the mscorwks dll with class name gc\\_heap. I knew it is gc_heap because prior to this I issued the command “x mscorwks!\\*gc*”. Because we don’t have private symbols for mscorwks we cannot see the type information. But we don’t need that for our purpose. The public symbols has FPO information for us to have break-point.\n\nForm the above result the method name should be “allocate\\_large\\_object”\n\nThe next step was to put a break-point on the method\n\n\u003e bp mscorwks!wks::gc\\_heap::allocate\\_large_object \u0026#8220;!CLRStack\u0026#8221;\n\nAnd then click button and here is the callstack output\n\n\u003e 0:004\u003e g\n  \n\u003e OS Thread Id: 0xf6f4 (0)\n  \n\u003e Child-SP         RetAddr          Call Site\n  \n\u003e 000000000027e000 000007ff00190684 WindowsFormsApplication1.Form1.AllocateinLOH()\n  \n\u003e 000000000027e060 000007feeab00555 WindowsFormsApplication1.Form1.Button1Click(System.Object, System.EventArgs)\n  \n\u003e 000000000027e090 000007feeb1f5873 System.Windows.Forms.Control.OnClick(System.EventArgs)\n  \n\u003e 000000000027e0d0 000007feeb1aadf7 System.Windows.Forms.Button.OnMouseUp(System.Windows.Forms.MouseEventArgs)\n  \n\u003e 000000000027e130 000007feeb702b7d System.Windows.Forms.Control.WmMouseUp(System.Windows.Forms.Message ByRef, System.Windows.Forms.MouseButtons, Int32)\n  \n\u003e 000000000027e200 000007feeab49b5a System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 000000000027e3b0 000007feeab49954 System.Windows.Forms.ButtonBase.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 000000000027e430 000007feeab53aa6 System.Windows.Forms.Button.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 000000000027e460 000007feeab53945 System.Windows.Forms.Control+ControlNativeWindow.WndProc(System.Windows.Forms.Message ByRef)\n  \n\u003e 000000000027e4b0 000007feeab52244 System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr)\n  \n\u003e 000000000027e560 000007fee8aab07a DomainBoundILStubClass.IL_STUB(Int64, Int32, Int64, Int64)\n  \n\u003e 000000000027e810 000007feeab6e883 DomainBoundILStubClass.IL_STUB(MSG ByRef)\n  \n\u003e 000000000027e990 000007feeab6e0f8 System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.\n\u003e \n\u003e UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(Int32, Int32, Int32)\n  \n\u003e 000000000027ebe0 000007feeab6db65 System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext)\n  \n\u003e 000000000027ed30 000007ff00190171 System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext)\n  \n\u003e 000000000027ed90 000007fee8aad502 WindowsFormsApplication1.Program.Main()\n  \n\u003e mscorwks!WKS::gc\\_heap::allocate\\_large_object:\n  \n\u003e 000007fe\\`e8a2c680 4053            push    rbx\n\nBingo now at the bottom of the stack we can see the “allocate\\_large\\_object” and on the top of the stack it is the managed code that we wrote “AllocateinLOH”.  Now we have solved the reason behind the High CPU usage in GC because of LOH.\n\nThe “allocate\\_large\\_object” is not documented by Microsoft as a public API and I don’t know whether the name would be same going forward from .NET framework 4.0.  This holds good until .NET framework 3.5. The idea behind this is just digging in to the framework can give us some information which has saved us valuable time and effort.\n\n [1]: http://11011.net/software/vspaste"},{"title":"Function hit count using Pseudo-Register in Windbg","date":"2010-02-13T01:41:01Z","permalink":"/?p=30/","content":"What if we want to know the number of times a function was invoked. We can have “.echo” or “.printf” on break-point of a function and count the output manually. The better way to do this is using pseudo-registers.\n\nIn my \u003ca href=\"http://naveensrinivasan.com/2010/02/10/conditional-breakpoint-in-net-using-windbg/\" target=\"_blank\"\u003eprevious\u003c/a\u003e post I had mentioned about alias inside the debugger. The debugger also provides User defined Pseudo-Registers for scripting inside the debugger. We can use them to manipulate values within our scripts. There are 20 of them from $t0,$t1.. $t19. These are pre-defined names that we cannot change.\n  \nThe syntax to assign value to the register is “r”\n\n\u003e r @$t0 = 0\n\nFYI the default value is 0.\n\n\u003e bp 000007ff0003c050  \u0026#8221;  r @$t0 =@$t0 + 1;gc \u0026#8220;\n\nThe above command will increment the $t0 register by one more, every time the break-point is hit. And gc is to go to next conditional break-point. To get the output of the register we can use the expression evaluator command “?”\n\n\u003e 0:004\u003e ? @$t0\n  \n\u003e Evaluate expression: 5 = 00000000\\`00000005\n\nThere quite a few places we can use these inside the debugger. Example we could calculate the total size of multiple instances of an object type inside the debugger. That is we could get !objsize of each instance for type DataTable and then total it, to get the total memory consumption of datatable within our process."},{"title":"Conditional Breakpoint in .NET using Windbg","date":"2010-02-11T03:50:00Z","permalink":"/?p=26/","content":"With my few years of production debugging .NET code ,one thing that has really helped me a lot is Windbg. Lot us of know that using sos, sosex and Windbg we should be able to troubleshoot most of the .NET Code. But certain tips / tricks makes us productive in those crucial moments. I am assuming that you are aware of basic usage of sos and windbg.\n\nWe know by using !bpmd command we can stick in a break-point on a method. But the issue is we would want to break in to the debugger only on a certain condition, very similar to VS.NET break-point condition.\n\nHere is the sample code that i am going to be using to set the conditional break-point. This is a simple Winforms app.\n\n\u003cpre style=\"border:1px solid #cecece;background-color:#fbfbfb;min-height:40px;width:500px;overflow:auto;padding:5px;\"\u003e\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e  1: \u003cspan style=\"color:#0000ff;\"\u003eusing\u003c/span\u003e System;\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e  2: \u003cspan style=\"color:#0000ff;\"\u003eusing\u003c/span\u003e System.Windows.Forms;\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e  3:\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e  4: \u003cspan style=\"color:#0000ff;\"\u003enamespace\u003c/span\u003e WindowsFormsApplication2\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e  5: {\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e  6:     \u003cspan style=\"color:#0000ff;\"\u003epublic\u003c/span\u003e partial \u003cspan style=\"color:#0000ff;\"\u003eclass\u003c/span\u003e Form1 : Form\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e  7:     {\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e  8:         \u003cspan style=\"color:#0000ff;\"\u003epublic\u003c/span\u003e \u003cspan style=\"color:#0000ff;\"\u003eint\u003c/span\u003e Foo;\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e  9:\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 10:         \u003cspan style=\"color:#0000ff;\"\u003epublic\u003c/span\u003e Form1()\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 11:         {\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 12:             InitializeComponent();\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 13:         }\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 14:\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 15:         \u003cspan style=\"color:#0000ff;\"\u003eprivate\u003c/span\u003e \u003cspan style=\"color:#0000ff;\"\u003evoid\u003c/span\u003e Button1Click(\u003cspan style=\"color:#0000ff;\"\u003eobject\u003c/span\u003e sender, EventArgs e)\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 16:         {\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 17:             Test(textBox1.Text);\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 18:         }\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 19:\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 20:         \u003cspan style=\"color:#0000ff;\"\u003evoid\u003c/span\u003e Test(\u003cspan style=\"color:#0000ff;\"\u003estring\u003c/span\u003e s)\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 21:         {\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 22:             Console.WriteLine(s);\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 23:         }\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 24:\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 25:     }\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#ffffff;width:100%;\"\u003e 26: }\n\u003c/pre\u003e\n\n\n\u003cpre style=\"background-color:#fbfbfb;width:100%;\"\u003e 27:\u003c/pre\u003e\n\n\n\u003cp\u003e\n  In this sample code I would like to put a conditional break-point on the Test method. After attaching the application to windbg ,look for the object Form1 in the heap.\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    0:000\u003e !dumpheap -type WindowsFormsApplication2.Form1\u003cbr /\u003e\n             Address               MT     Size\u003cbr /\u003e\n    0000000002c92548 000007ff004b7b78      480\u003cbr /\u003e\n    total 1 objects\u003cbr /\u003e\n    Statistics:\u003cbr /\u003e\n                  MT    Count    TotalSize Class Name\u003cbr /\u003e\n    000007ff004b7b78        1          480 WindowsFormsApplication2.Form1\u003cbr /\u003e\n    Total 1 objects\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  The next step was to get the address of the function Test.\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    0:000\u003e .shell  -ci \u0026#8220;!dumpmt -md  000007ff004b7b78\u0026#8221; FIND \u0026#8220;Test\u0026#8221;\u003cbr /\u003e\n    000007ff004a3508 000007ff004b7af0      JIT WindowsFormsApplication2.Form1.Test(System.String)\u003cbr /\u003e\n    .shell: Process exited\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  The reason to get address of the function is to use the native “bp” command to set the break-point. FYI the sos also uses only the built in bp command for setting the break-point. The difference is condition that we can pass to the break-point. In the above I use the .shell command to look for Test function address instead of manually looking for the Test function. The .shell command comes in very handy.\n\u003c/p\u003e\n\n\n\u003cp\u003e\n  In this exercise I would like to break into the debugger only if the argument “s” matches certain condition. I set the bp on the method test using the command “bp 000007ff004a3508”. And here is the result when the break-point hits.\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    0:000\u003e g\u003cbr /\u003e\n    Breakpoint 0 hit\u003cbr /\u003e\n    rax=0000000002d9fcd8 rbx=0000000000000000 rcx=0000000002c92548\u003cbr /\u003e\n    rdx=0000000002d9fcd8 rsi=0000000000000001 rdi=0000000000000000\u003cbr /\u003e\n    rip=000007ff004a3508 rsp=000000000028d3e8 rbp=000000000028d590\u003cbr /\u003e\n    r8=000000000028cde0  r9=000007feed0b14c0 r10=000007feff469f20\u003cbr /\u003e\n    r11=000007ff00060120 r12=00000000003a9460 r13=0000000000000202\u003cbr /\u003e\n    r14=000000001b3e23b8 r15=0000000000030672\u003cbr /\u003e\n    iopl=0         nv up ei pl nz na po nc\u003cbr /\u003e\n    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206\u003cbr /\u003e\n    000007ff`004a3508 e9f35a2c00      jmp     000007ff`00769000\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  FYI I am using a 64-bit machine and that’s the reason my pointers are much bigger than usual x86. We are interested on the argument “s”  that is passed to the method which is @rdx register “rdx=0000000002d7ed00”. To verify that we setting the break-point on the correct argument we can test it by using command\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    0:000\u003e .printf \u0026#8220;%mu\u0026#8221;,@rdx+10\u003cbr /\u003e\n    testa\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  Not many of them are aware of how to get just the string from string object , instead of the all additions from !dumpobj. The above command would get just the string . The command .printf contains “%mu” because it is null terminated unicode string and @rdx is the register which contains the argument “s”. The \u003ca href=\"mailto:“@rdx+10\"\u003e“@rdx+10\u003c/a\u003e” is the actual location of the string in memory and for the x86 it would be \u003ca href=\"mailto:“@rdx+c\"\u003e“@rdx+c\u003c/a\u003e” for the actual string. Now that we are sure the @rdx is the register we can build condition for the argument. Here it is\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    \u003cstrong\u003ebp 000007ff004a3508 \u0026#8220;.block {as /mu ${/v:cmp} @rdx+10; .if ( $spat( \u0026#8220;${cmp}\u0026#8221;, \u0026#8220;*test*\u0026#8221; )  ) { !clrstack; } .else { gc }}\u0026#8221;\u003c/strong\u003e\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  \u003c!--CRLF--\u003e\n\u003c/p\u003e\n\n\n\u003cp\u003e\n  And here is the detailed explanation of the above condition within quotes. The .block command is used for alias evaluation. Alias is like variables within windbg. The “as /mu ${v:cmp} @rdx+10” command creates an string alias by name  of cmp which contains the value of argument “s”. This condition would be evaluated only when the functions first line of code is executed so @rdx will always have the value that is passed to the function. The next\n\u003c/p\u003e\n\n\n\u003cblockquote\u003e\n  \u003cp\u003e\n    “.if ( $spat( \u0026#8220;${cmp}\u0026#8221;, \u0026#8220;*test*\u0026#8221; )  ) { !clrstack; } .else { gc }}”\n  \u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cp\u003e\n  command is real crux where the code compares the alias cmp with “*test*”. Notice i am using a built-in function called $spat which is nothing but a string pattern function. So from the above condition i am instructing the break-point to give a callstack if the argument “s” has something like “*test*” . If not the command “gc” means go to the next conditional break-point,similar  F5 in VS.NET. So, for example if the function is called 40 times and of which we are interested only once when it is  something like “*test*” ,with the existing  !bpmd we would wasted our time 39 times.\n\u003c/p\u003e\n\n\n\u003cp\u003e\n  The “” is a escape character in windbg ,i am using it because i would have to a string compare.\n\u003c/p\u003e"},{"title":"Identify and Patch .NET Code using Windbg","date":"2010-02-07T13:30:13Z","permalink":"/?p=19/","content":"\u0026#160;\n\nThe last week was really an interesting one with debugging production code. I was debugging a Winforms application which was using .NET framework 3.5 version. The real problem was with the latest release of the code, there was bug which caused certain elements on the UI not to be displayed. This is was High priority bug and very important to the business. \n\nThe code that was causing this bug was an integer variable inside a class. \n\n\u003cpre class=\"code\"\u003e\u003cspan style=\"color:blue;\"\u003eusing \u003c/span\u003eSystem;\n\u003cspan style=\"color:blue;\"\u003eusing \u003c/span\u003eSystem.Windows.Forms;\n\n\u003cspan style=\"color:blue;\"\u003enamespace \u003c/span\u003eWindowsFormsApplication2\n{\n    \u003cspan style=\"color:blue;\"\u003epublic partial class \u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eForm1 \u003c/span\u003e: \u003cspan style=\"color:#2b91af;\"\u003eForm\n    \u003c/span\u003e{\n        \u003cspan style=\"color:blue;\"\u003epublic int \u003c/span\u003eFoo;\n        \u003cspan style=\"color:blue;\"\u003epublic \u003c/span\u003eForm1()\n        {\n            InitializeComponent();\n        }\n        \u003cspan style=\"color:blue;\"\u003eprivate void \u003c/span\u003eButton1Click(\u003cspan style=\"color:blue;\"\u003eobject \u003c/span\u003esender, \u003cspan style=\"color:#2b91af;\"\u003eEventArgs \u003c/span\u003ee)\n        {\n            \u003cspan style=\"color:blue;\"\u003eif \u003c/span\u003e(Foo == \u003cspan style=\"color:brown;\"\u003e100\u003c/span\u003e) \n                \u003cspan style=\"color:blue;\"\u003ethis\u003c/span\u003e.label1.Visible = \u003cspan style=\"color:blue;\"\u003etrue\u003c/span\u003e;\n        }\n    }\n}\u003c/pre\u003e\n\n[][1][][1]\n\nThe code was something like this. If Foo was equal 100 then the label was set to be visible. \u003ca href=\"http://www.red-gate.com/products/reflector/\" target=\"_blank\"\u003eReflector\u003c/a\u003e came in handy to disassemble\u0026#160; the code.With the latest code release the\u0026#160; “\u003cspan style=\"color:blue;\"\u003eif \u003c/span\u003e(Foo == \u003cspan style=\"color:brown;\"\u003e100\u003c/span\u003e) “ condition was introduced.\n\nThe next step was to verify and validate that this condition was the reason for this bug. Though this looks very simple because i have shown a very contrived example which does not involve all the dependencies of the real world business application. \n\nFired up windbg looked up the heap for object type Form1 using dumpheap. \n\n0:004\u003e !dumpheap -type Form1\n    \n  \n\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; Address\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; MT\u0026#160;\u0026#160;\u0026#160;\u0026#160; Size\n\n**0000000002cb2548** 000007ff004b7b68\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 480\u0026#160;\u0026#160;\u0026#160;\u0026#160;   \ntotal 1 objects\n\nStatistics:\n\n\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; MT\u0026#160;\u0026#160;\u0026#160; Count\u0026#160;\u0026#160;\u0026#160; TotalSize Class Name\n\n000007ff004b7b68\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 480 WindowsFormsApplication2.Form1\n\nTotal 1 objects\n\nThe next was figure of the offset of Foo. So used the !do command on Form1 instance. **!do 0000000002cb2548** and here is the partial output of the command\u0026#160;\u0026#160;\u0026#160; \n\n000007ff00107050\u0026#160; 4001e9b\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1780\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; System.Object\u0026#160; 0\u0026#160;\u0026#160; static 0000000002cb2d48 EVENT_MAXIMIZEDBOUNDSCHANGED\n    \n  \n0000000000000000\u0026#160; 4000002\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1b8\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 0 instance 0000000000000000 components \n\n000007ff00694f40\u0026#160; 4000003\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1c0 \u0026#8230;dows.Forms.Button\u0026#160; 0 instance 0000000002cdc040 button1 \n\n000007ff006962c8\u0026#160; 4000004\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1c8 \u0026#8230;ndows.Forms.Label\u0026#160; 0 instance 0000000002cdc2f8 label1 \n\n000007ff002683d8\u0026#160; 4000005\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; **1d0\u0026#160;\u0026#160;\u0026#160;** \u0026#160;\u0026#160;\u0026#160;\u0026#160; System.Int32\u0026#160; 1 instance\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 0 Foo\n\nSo from the result i could identify that the Foo variable was on the **1d0** offset of the Form1 object. \n\nAfter couple of test case runs i dumped the object and here was the output\n\n000007ff00694f40\u0026#160; 4000003\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1c0 \u0026#8230;dows.Forms.Button\u0026#160; 0 instance 0000000002cdc040 button1\n    \n  \n000007ff006962c8\u0026#160; 4000004\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1c8 \u0026#8230;ndows.Forms.Label\u0026#160; 0 instance 0000000002cdc2f8 label1\n\n**000007ff002683d8\u0026#160; 4000005\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1d0\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; System.Int32\u0026#160; 1 instance\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 23 Foo**\n\nSo the Foo’s value was now 23. I am sure most of us are used to updating the variable’s value in VS.NET using immediate window. I did something similar to that but instead used windbg.\n\nIn Windbg numbers are hex values, so to set the value as 100 it would have to be 64. You can fire up calc to figure this out or you use the command in windbg **?64** \n\n**Evaluate expression: 100 = 00000000\\`00000064**\n\nFYI “?” expression evaluator in windbg. Now the final step of updating the Foo in memory. The command to do that is \n\n**ed 0000000002cb2548+1d0 64** \n\n“e” command is enter values in memory. “e” has many flavors like eu,ed,ea. And ed command is for updating\u0026#160; Double-word values. So ed is to update double-word value and the memory location is **0000000002cb2548+1d0** which is the Form1 memory location\u0026#160; along with Foo is offset.\u0026#160; \n\nVoila here is the output of !dumpobj after updating the memory \n\n**000007ff002683d8\u0026#160; 4000005\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 1d0\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; System.Int32\u0026#160; 1 instance\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160;\u0026#160; 100 Foo**\n\nNow we could make an emergency patch and be certain the patch would work with the fix already tested in production using the debugger. Having windbg in your toolbox is always saves a lot of time.\u0026#160;\u0026#160;\n\n [1]: http://11011.net/software/vspaste"},{"title":"Home cooked web monitoring use Rx","date":"2010-02-03T03:07:22Z","permalink":"/?p=14/","content":"One of the key things in software is to write succinct , declarative and asynchronous code. The answer to that is \u003ca href=\"http://msdn.microsoft.com/en-us/devlabs/ee794896.aspx\" target=\"_blank\"\u003eReactive Extensions for .NET\u003c/a\u003e\u0026#160;\n\nI have been digging into Rx for sometime now. Though there isn’t much of documentation I have been kind of successful in getting certain things done with it. \n\nOne of requirement that came up from our Operations was to monitor some websites and notify someone if the site was not accessible. But the added constraints to this were check for the site status only at a certain interval and report failure only if it was more than certain percentage within a certain duration.\n\nSo it was like check the site status every 5 seconds , buffer the results for a minute and in the buffered response if it had more 3\u0026#160; failures then tweet someone about it.\n\nAnd here is the code to solve the problem\n\n\u003cpre class=\"code\"\u003e(\u003cspan style=\"color:blue;\"\u003efrom \u003c/span\u003etime \u003cspan style=\"color:blue;\"\u003ein \u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eObservable\u003c/span\u003e.Interval(\u003cspan style=\"color:#2b91af;\"\u003eTimeSpan\u003c/span\u003e.FromSeconds(\u003cspan style=\"color:brown;\"\u003e5\u003c/span\u003e))\n \u003cspan style=\"color:blue;\"\u003elet \u003c/span\u003ereq = \u003cspan style=\"color:#2b91af;\"\u003eWebRequest\u003c/span\u003e.Create(\u003cspan style=\"color:#a31515;\"\u003e\"http://www.nonexisting.com\"\u003c/span\u003e)\n \u003cspan style=\"color:blue;\"\u003efrom \u003c/span\u003eres \u003cspan style=\"color:blue;\"\u003ein \u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eObservable\u003c/span\u003e.\n    FromAsyncPattern\u0026lt;\u003cspan style=\"color:#2b91af;\"\u003eWebResponse\u003c/span\u003e\u0026gt;(\n        req.BeginGetResponse, req.EndGetResponse)()\n .Materialize()\u003cspan style=\"color:blue;\"\u003eselect \u003c/span\u003eres).Buffer(\u003cspan style=\"color:blue;\"\u003enew \u003c/span\u003e\u003cspan style=\"color:#2b91af;\"\u003eTimeSpan\u003c/span\u003e(\u003cspan style=\"color:brown;\"\u003e\u003c/span\u003e, \u003cspan style=\"color:brown;\"\u003e\u003c/span\u003e, \u003cspan style=\"color:brown;\"\u003e1\u003c/span\u003e, \u003cspan style=\"color:brown;\"\u003e\u003c/span\u003e)).\n    Select(failed =\u0026gt; \n        failed.Where(\n        n =\u0026gt; n.Kind == \u003cspan style=\"color:#2b91af;\"\u003eNotificationKind\u003c/span\u003e.OnError)).\n    Where(failed =\u0026gt; failed.Count() \u0026gt; \u003cspan style=\"color:brown;\"\u003e3\u003c/span\u003e).\n    Subscribe(x =\u0026gt; Tweet(\u003cspan style=\"color:#a31515;\"\u003e\"Nonexisting.com Failed thrice\"\u003c/span\u003e));\n\u003cspan style=\"color:#2b91af;\"\u003eConsole\u003c/span\u003e.Read();\u003c/pre\u003e\u003c/p\u003e \u003c/p\u003e \n\n[][1][][1][][1][][1]\n\nThe “from time in Observable.Interval(TimeSpan.FromSeconds(5)” is for ensuring that an Observable is generated every 5 seconds to check the status of the website. In the next line the code creates a web request.\n\nUsing the FromAsyncPattern I was able to reduce all the plumbing code to handle async i/o calls for the web request.\u0026#160; The materialize is for the sequence to continue even if there is an exception. Here is an good write up on \u003ca href=\"http://bartdesmet.net/blogs/bart/archive/2009/12/29/more-linq-with-system-interactive-exploiting-the-code-data-relationship.aspx\" target=\"_blank\"\u003eMaterialize\u003c/a\u003e. And the rest is just the usual Linq where the code filters Notification type of error. \n\nThis was a fun exercise. I will continue to explore Rx and blog about it.\n\n [1]: http://11011.net/software/vspaste"},{"title":"Resharper Template for F#","date":"2010-02-01T19:06:03Z","permalink":"/?p=6/","content":"I have been hacking F# lately and I am big fan of ReSharper. So why not create a few Live Templates for the things i do daily in F#.\n\n[Download][1] R# live template for F#. I am sure there are few more things that can be part of this template. I have posted the code in MSDN Code gallery so that others can find and contribute.\n\n [1]: http://bit.ly/dvXmEH"}]