How to programmatically list types in a running .NET process using MDbg?

I want to print a list of all the different types loaded into a running .NET process. My plan is to ultimately create a graphical application based on this, so I want to do this from my code, not a third-party tool. I believe that it is best to use MDbgCore to join the current process, and then use MDbgProcess.AppDomains to get CorAppDomain objects and try to shift the object model.

However, I cannot have my life stopped by another process and see any AppDomains. I used the code as follows (which I based on the code from Mike Stoll 's blog )

    [MTAThread] // MDbg is MTA threaded
    static void Main(string[] args)
    {
        MDbgEngine debugger = new MDbgEngine();

        debugger.Options.StopOnModuleLoad = true;

        // Launch the debuggee.            
        int pid = Process.GetProcessesByName("VS2010Playground")[0].Id;
        MDbgProcess proc = debugger.Attach(pid);
        if (proc.IsAlive)
        {
            proc.AsyncStop().WaitOne();

            Console.WriteLine(proc.AppDomains.Count);
            if (proc.AppDomains.Count > 0)
            {
                Console.WriteLine(proc.AppDomains[0].CorAppDomain);
            }
        }

        Console.WriteLine("Done!");
    } 

Fingerprints:

MDbgPlayground.exe
0
Done!

debugger.Options.Stop *. , . debugger.Options.Trace, MDbg TraceListeners, .

noddy debugger . Visual # 2010, . - ?

+3
3

, - ( , )...

        foreach (Process process in Process.GetProcesses())
        {
            try
            {
                Assembly test = Assembly.LoadFrom(process.MainModule.FileName);
                Console.WriteLine(test.FullName);

                foreach (Type type in test.GetTypes())
                    Console.WriteLine(type.FullName);
            }
            catch
            {
                continue;
            }
        }
0

. , :

  • Mdbg
  • AppDomain ( .NET2 .NET4, !!)

    System.AppDomain tempDomain = System.AppDomain.CreateDomain( "ReflectionOnly" );

  • MDbgProcess.Modules appdomain Assembly.ReflectionOnlyLoad(. .NET ?)

  • tempDomain
  • .Name
  • tempDomain
  • MDbgProcess.Go
0

debugger.Processs.Active proc. debugger.Go() AsyncStop. ,

[MTAThread] // MDbg is MTA threaded
static void Main(string[] args)
{
    MDbgEngine debugger = new MDbgEngine();

    debugger.Options.StopOnModuleLoad = true;

    // Launch the debuggee.            
    int pid = Process.GetProcessesByName("VS2010Playground")[0].Id;
    MDbgProcess proc = debugger.Attach(pid);
    proc.Go();
    if (proc.IsAlive)
    {
        proc.AsyncStop().WaitOne();

        Console.WriteLine(debugger.Process.Active.AppDomains.Count);
        if ((debugger.Process.Active.AppDomains.Count > 0)
        {
            Console.WriteLine((debugger.Process.Active.AppDomains[0].CorAppDomain);
        }
    }

    Console.WriteLine("Done!");
} 
0
source

Source: https://habr.com/ru/post/1743250/


All Articles