Dump Linked Nodes

[rodneyviana]

Dump Linked Nodes

[rodneyviana]

Give me an example of how this output would be describing the steps and I give you a solution using .while () {} or will implement a custom command. But take this quick idea (not tested):
r @$t1=24c4a3f1800; .while (@$t1 != 0) { !wfrom -obj @$t1 select _data, $todbgvar(1, _priorityNext) }
This will keep you going.
Start setting $t1 to the list head.
Make a .while condition until the next element of the list is not null.
Make a !wfrom from the object address in $t1 to display what you want and to assign $t1 with the next element in the list via $todbgvar.

Does it make sense?

Rodney

[Alois-xx]

Thanks Rodney,

that is a great tip! I have used a variation which dumps the type and the delegate method via

r @$t1=01e2d91cdd48; .while (@$t1 != 0) { !wfrom -obj @$t1 select $addr(),$typefrommt($poi(_data._method._target)), $todbgvar(1, _sequentialNext), $todbgvar(2, _data._method); .if ( @$t2 != 0 ) { .printf "Delegate: %p", @$t2; $$>a<"C:\DumpDelegate.txt" @$t2 } }

While DumpDelegate.txt contains

r $t0 = ${$arg1}
$$ Get _methodPtrAux
r $t1 = poi($t0+0x20)
$$.printf "MethodPtrAux: %p\n", $t1
.if( @$t1 != 0 )
{

	$$ Looks like a method prolog with push rsi 
	r $t5 = poi($t1)&0xffff
	$$.printf "T5: %p", $t5
	.if( (($t5 & 0xff) == 0x56) | ( ($t5 & 0xff00) == 0x5600) | ( ($t5 & 0xffff) == 0x8348) ) 
	{
		$$ In that case it might be precompiled method pointer already
		!IP2MD $t1
	}
	.else
	{
	    $$.echo Non Null _MethodPtrAux Found
		$$.printf "%p", $t1
		$$ 8 Bytes there is the Method descriptor located (in some cases)
		r $t2 = poi($t1+8)
		
		!DumpMD $t2
	}
}
.else
{
	$$ Get _methodPtr of delegate into $t1
	r $t1 = poi($t0+0x18)

	.if( (poi($t1)&0xff) == 0xE9 )
	{
	 .echo Indirect jump
	 r $t6 = (poi($t1)&0xffffffffff)>>8
	 r $t2 = $t1+$t6+5
	 $$ .printf "Final Address: T1: %p T6: %p T2: %p", $t1, $t6, $t2
	 !IP2MD $t2
	}
	.else
	{
	  $$ It might be a direct method address or a pointer to a JIT structure
	  r $t2 = poi($t1+8)
	  .if( ($t2 & 0x00ff0000000000)  == 0x7f0000000000 )
	  {
		$$ .echo not yet JITed code
		!DumpMD $t2
	  }
	  .else
	  {
		   $$.printf "t0: %p, t1: %p", $t0, $t1
		  !IP2MD $t1
	  }
	}
}

That works to some extent but when the script is invoked the for loop stops at the first invocation.

calculated: 000001E2D91CDD48
calculated: System.Windows.Threading.DispatcherTimer
calculated: 0n1
calculated: 0n1

1 Object(s) listed
Delegate: 000001e2d91cdb00MethodDesc:   00007ffbf6f197e0
Method Name:  System.Windows.Threading.DispatcherTimer.FireTick(System.Object)
Class:        00007ffbf6f0a7b0
MethodTable:  00007ffbf6ed3f38
mdToken:      000000000600108d
Module:       00007ffbf6eb1000
IsJitted:     yes
CodeAddr:     00007ffbf702aed0
Transparency: Transparent
calculated: 00007FFBF702AED0
calculated: 
calculated: 0n1
calculated: 0n1

1 Object(s) listed

The output is pretty close what I would like. A generic command to dump the method pointed to a delegate would be highly welcome. Unfortunately netext has no !IP2MD or something similar? For debugging purposes the target type and method name would be most interesting to see if the delegate points to something interesting.
Has Windbg limitations with loop constructs and script invocations? I have got for null pointers script errors but enclosing it in .catch {} did also not help.
Your extension is pure gold. I will present to a larger audience next week some cool trick with NetExt.
e..g Dump not completed tasks
!wfrom -nospace -nofield -implement System.Threading.Tasks.Task where ( (m_stateFlags & 0x1000000==0) && (m_stateFlags & 0x400000==0) ) select $rpad($typefrommt($poi(m_action._target)),50),$addr()," Action: ", m_action," Scheduler: ", m_taskScheduler, " TaskID: ",$rpad(m_taskId,4)," ",$rpad( $if(m_stateFlags & 0x200000!=0,"Faulted",$if(m_stateFlags & 0x400000!=0,"Canceled",$if(m_stateFlags & 0x1000000!=0,"RanToCompletion",$if(m_stateFlags & 0x800000!=0,"WaitingForChildrenToComplete",$if(m_stateFlags & 0x20000!=0 ,"Running",$if(m_stateFlags & 0x10000!=0,"WaitingToRun",$if(m_stateFlags & 0x2000000 ,"WaitingForActivation","Created"))))))),15)," ",$rpad($typefrommt($poi($addr())),60)

Or dump tasks with non null action

!wfrom -nospace -nofield -implement System.Threading.Tasks.Task where (m_action!=0) select $rpad($typefrommt($poi(m_action._target)),50),$addr()," Action: ", m_action," Scheduler: ", m_taskScheduler, " TaskID: ",$rpad(m_taskId,4)," ",$rpad( $if(m_stateFlags & 0x200000!=0,"Faulted",$if(m_stateFlags & 0x400000!=0,"Canceled",$if(m_stateFlags & 0x1000000!=0,"RanToCompletion",$if(m_stateFlags & 0x800000!=0,"WaitingForChildrenToComplete",$if(m_stateFlags & 0x20000!=0 ,"Running",$if(m_stateFlags & 0x10000!=0,"WaitingToRun",$if(m_stateFlags & 0x2000000 ,"WaitingForActivation","Created"))))))),15)," ",$rpad($typefrommt($poi($addr())),60)

Such queries are immensely helpful.

[rodneyviana]

Replying from my phone, so not had a chance to go deep.
You may get the method from MD using $methodfrommd()
If you need to use IP2MD you can use $dbgrun()
You may also consider creating JavaScript functions in WinDbg (better yet in WinDbgNext):
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-example-scripts

[rodneyviana]

Closing as it seems to be settled