Share via


Debugging managed code.. from a newb for managed code debugging

Debugging managed code in WinDbg has never been my idea of fun. I wasn’t forcibly exposed to it enough I guess.

 

For example, if you look at https://blogs.msdn.com/spatdsg/archive/2009/02/23/there-and-back-again-the-life-of-a-bug-and-fix.aspx   there is like a 5 step process for setting a breakpoint, instead of !bpmd. Well, the other day I dug deep into debugging some code to which I had no src or symbols, so I learned a bit – at least what I needed to in order to solve the issue :) – so this post is a bit of a bookmark or reminder for me, and maybe it will help someone else one day as well.

Load the magical debugger extensions..

 

Not sure which ones I need so I load a bunch..

 

C:\debuggers\clr10\sos.dll

 

C:\debuggers\sosex.dll

-- from https://www.stevestechspot.com/SOSEXV2NowAvailable.aspx

 

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sos.dll

 

Keepers:

!ip2md = instruction pointer to method descriptor

!savemodule = save binary from the debug

 

LOAD  failures - see https://blogs.msdn.com/b/dougste/archive/2009/02/18/failed-to-load-data-access-dll-0x80004005-or-what-is-mscordacwks-dll.aspx

 

 0:024> !Threads
Failed to find runtime DLL (clr.dll), 0x80004005
 0:000> .loadby sos mscorwks
0:000> .cordll -ve -u -l
Automatically loaded SOS Extension
WARNING: Unable to register for CLR module notifications
CLRDLL: Loaded DLL c:\windows\microsoft.net\framework64\v2.0.50727\mscordacwks.dll
CLR DLL status: Loaded DLL c:\windows\microsoft.net\framework64\v2.0.50727\mscordacwks.dll
0:000> .load c:\windows\microsoft.net\framework64\v2.0.50727\sos.dll
 NOTE: or use .loadby sos clr 
  
 0:000> !Threads
ThreadCount: 41
UnstartedThread: 0
BackgroundThread: 33
PendingThread: 0
DeadThread: 8
Hosted Runtime: no
  
  
 0:000> !Threads
ThreadCount: 41
UnstartedThread: 0
BackgroundThread: 33
PendingThread: 0
DeadThread: 8
Hosted Runtime: no
                                              PreEmptive                                                Lock
       ID OSID        ThreadOBJ     State   GC     GC Alloc Context                  Domain           Count APT Exception
XXXX    1 5394 00000000015ca840      8220 Enabled  0000000170194730:0000000170196388 00000000015bf510     0 Ukn
XXXX    2 5eac 00000000015f44b0      b220 Enabled  000000013fee6880:000000013fee87e0 00000000015bf510     0 MTA (Finalizer)
   0    3 8298 0000000001629480    80a220 Enabled  0000000000000000:0000000000000000 00000000015bf510     0 MTA (Threadpool Completion Port)
XXXX    4 549c 0000000001629f30      1220 Enabled  0000000000000000:0000000000000000 00000000015bf510     0 Ukn
  
  
 Find func or module references: 
 !Name2EE *!foo
  
 dump module
 !DumpModule -mt 000007ff001768f8 
  

Wishlist:

· Doesn't seem like I can do fancy breakpoints like:

o 0:026> bp 76df1bbb "?1;.echo THIS IS THE RET"

 

· Wish there was an easy "gu" command for managed code

· I am sure there were more I wished for but can’t recall now….

 

A few nice things:

 

Get the exception

 

0:011> !PrintException

Exception object: 0147f600

Exception type: System.DirectoryServices.DirectoryServicesCOMException

Message: There is no such object on the server.

 

InnerException: <none>

StackTrace (generated):

<none>

StackTraceString: <none>

HResult: 80072030

 

 

 

 

Dump an array:

0:011> !DumpArray 01473aa8

Name: System.Object[]

MethodTable: 7912254c

EEClass: 79122ac0

Size: 1072(0x430) bytes

Array: Rank 1, Number of elements 264, Type CLASS

Element Methodtable: 790f8a7c

[0] 0146f64c

[1] 0146f684

[2] 0146f6ac

[3] 0146f6e0

[4] 0146f714

[5] 0146f748

[6] 0146f790

[7] 0146f7c8

[8] 0146f814

[9] 0146f840

[10] 0146f870

[11] 0146f8ac

[12] 0146f8d0

[13] 0146f8f4

[14] 0146f91c

[15] 0146f950

[16] 0146f990

0:011> ! mdt 0146f64c

0146f64c (System.String: "accountNameHistory")

0:011> !mdt 01472644

01472644 (System.String: "securityIdentifier")

In order to get the raw IL:

IL reference

https://www.ecma-international.org/publications/standards/Ecma-335.htm

 

0:026> !name2ee FooBar.DirectoryServices.dll FooBar.DirectoryServices.Server.getDomain

Module: 01d93da4 (FooBar.DirectoryServices.dll)

Token: 0x06000412

MethodDesc: 0ec510b0

Name: FooBar.DirectoryServices.Server.getDomain()

JITTED Code Address: 02594a00

 

 

0:026> !dumpil 0ec510b0

ilAddr = 0e835350

IL_0000: ldarg.0

IL_0001: ldfld FooBar.DirectoryServices.Server::initial

IL_0006: callvirt FooBar.DirectoryServices.LDAPInitialContext::get_Domain

IL_000b: ret

 

 

 

Get the method table from the class

 

 

0:026> !name2ee FooBar.DirectoryServices.dll FooBar.DirectoryServices.LDAPInitialContext

Module: 01d93da4 (FooBar.DirectoryServices.dll)

Token: 0x0200004d

MethodTable: 01d99d54

EEClass: 0ec21610

Name: FooBar.DirectoryServices.LDAPInitialContext

 

 

0:026> !dumpmt -md 01d99d54

EEClass: 0ec21610

Module: 01d93da4

Name: FooBar.DirectoryServices.LDAPInitialContext

mdToken: 0200004d (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

BaseSize: 0x48

ComponentSize: 0x0

Number of IFaces in IFaceMap: 1

Slots in VTable: 45

--------------------------------------

MethodDesc Table

   Entry MethodDesc JIT Name

7934cdcc 79137ab8 PreJIT System.Object.ToString()

7934bba0 79137ac0 PreJIT System.Object.Equals(System.Object)

7934bb90 79137ad8 PreJIT System.Object.GetHashCode()

793424c0 79137ae0 PreJIT System.Object.Finalize()

0ec1df50 01d99c60 JIT FooBar.DirectoryServices.LDAPInitialContext.get_Path()

01d999f5 01d99928 JIT FooBar.DirectoryServices.Context.getPathEx()

01d999fd 01d99938 NONE FooBar.DirectoryServices.Context.Contains(FooBar.DirectoryServices.Context)

01d99a01 01d99940 NONE FooBar.DirectoryServices.Context.IsParentOf(FooBar.DirectoryServices.Context)

01d99a05 01d99948 NONE FooBar.DirectoryServices.Context.GetRelativeDisplayName(FooBar.DirectoryServices.Context)

<snip>

 

 

 

 

Set a managed breakpoint?

0:027> !bpmd FooBar.WebDir.dll FooBar.WebDir.SecurityLevel.Evaluate

 

 How do I set a breakpoint on the return address for a function? ( thanks Khalil ! )

                Q: For example - I want to set a break on the return of the highlighted function..

A: Do a !u (managed command for unassemble) on the red highlighted. Set a bp, as you normally would, on the instruction after the call of interest.

 

0012ebd0 671663ae System.DirectoryServices.DirectoryEntry.Bind(Boolean)

0012ec28 67166245 System.DirectoryServices.DirectoryEntry.Bind()

0012ec38 67165870 System.DirectoryServices.DirectoryEntry.get_AdsObject()

0012ec48 67168ede System.DirectoryServices.DirectorySearcher.FindAll(Boolean)

0012ec64 67168d9b System.DirectoryServices.DirectorySearcher.FindOne()

0012ec9c 044e101d FooBar.DirectoryServices.ActiveDirectoryInitialContext.IsExchangeMixed()

0012ecb8 044e099e FooBar.DirectoryServices.ActiveDirectoryInitialContext.detectServerType()

0012ece0 0498f222 FooBar.DirectoryServices.ActiveDirectoryInitialContext.Connect(System.DirectoryServices.DirectoryEntry)

0012ecfc 0498e34c FooBar.DirectoryServices.ContextManager.Connect(FooBar.DirectoryServices.Credentials, System.String, Boolean)

0012ed14 0498d669 FooBar.DirectoryServices.Server.connect(FooBar.DirectoryServices.Credentials, System.String, System.String, System.String, Boolean, Boolean)

0012ed58 0498d506 FooBar.DirectoryServices.Server.connect(FooBar.DirectoryServices.Credentials, System.String, System.String, System.String)

0012ed68 044e419b FooBar.SystemConfiguration.GetAdminListDistinguishedName(System.String, System.String, System.String, System.Windows.Forms.Form)

0012ed88 044e4104 FooBar.ServerForm.cmdSelectHelpdeskDL_Click(System.Object, System.EventArgs)

 

 

 

Dump the object:

0:011> !mdt 014224ec

014224ec (System.DirectoryServices.PropertyValueCollection)

   list:0142250c (System.Collections.ArrayList)

   entry:013ffffc (System.DirectoryServices.DirectoryEntry)

   propertyName:013fe734 (System.String: "DnsHostName")

   updateType:0x3 (System.DirectoryServices.PropertyValueCollection+UpdateType)

   changeList:014225c0 (System.Collections.ArrayList+SyncArrayList)

   allowMultipleChange:true (System.Boolean)

   needNewBehavior:true (System.Boolean)

 

 

 

 

Get the CLR Stack:

0:000> !CLRStack -a

OS Thread Id: 0x3b4 (0)

ESP EIP

ESP/REG Object Name

0012eca8 76f19255 [ComPlusMethodFrameGeneric: 0012eca8] System.DirectoryServices.Interop.UnsafeNativeMethods+IAds.GetEx(System.String, System.Object ByRef)

ESP/REG Object Name

0012ecbc 6716d109 System.DirectoryServices.PropertyValueCollection.PopulateList()

    PARAMETERS:

        this = 0x01736e38

    LOCALS:

        <no data>

        <CLR reg> = 0x0012ea30

 

ESP/REG Object Name

0012ecd0 6716cbc5 System.DirectoryServices.PropertyValueCollection..ctor(System.DirectoryServices.DirectoryEntry, System.String)

    PARAMETERS:

        this = 0x01736e38

        entry = 0x017360f8

        propertyName = <no data>

    LOCALS:

        <no data>

        <no data>

 

ESP/REG Object Name

0012ecdc 013ab5f4 System.String defaultNamingContext

0012ece4 013ab5f4 System.String defaultNamingContext

0012ece8 6716bea4 System.DirectoryServices.PropertyCollection.get_Item(System.String)

    PARAMETERS:

        this = 0x01736ce8

        propertyName = <no data>

    LOCALS:

        <CLR reg> = 0x01736dfc

        <no data>

 

ESP/REG Object Name

0012ecfc 0498e2a0 FooBar.DirectoryServices.ContextManager.Connect(FooBar.DirectoryServices.Credentials, System.String, Boolean)

    PARAMETERS:

        credentials = 0x01736044

        serverName = 0x016fa234

        newConn = 0x00000001

    LOCALS:

        <no data>

        <CLR reg> = 0x017360f8

        <no data>

        <no data>

 

 

 

 

 

 

Finding the call they made..

 

 

 

04a8eba8 8bf8 mov edi,eax

04a8ebaa 8b5624 mov edx,dword ptr [esi+24h] --- some offset member

04a8ebad 8bcf mov ecx,edi --- move some object instance in place

04a8ebaf ff150053df03 call dword ptr ds:[3DF5300h] --- call some method of that class instance

 

 

0:011> r

eax=014229e8 ebx=013ffffc ecx=03df5294 edx=01421b18 esi=01421bfc edi=014229e8

eip=04a8ebad esp=03ddf34c ebp=013ffffc iopl=0 nv up ei pl nz na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206

04a8ebad 8bcf mov ecx,edi

 

 

 

0:011> p

eax=014229e8 ebx=013ffffc ecx=014229e8 edx=01421b18 esi=01421bfc edi=014229e8

eip=04a8ebaf esp=03ddf34c ebp=013ffffc iopl=0 nv up ei pl nz na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206

04a8ebaf ff150053df03 call dword ptr ds:[3DF5300h] ds:0023:03df5300=03df5329

 

 

0:011> !dumpmt -md 03df5294

EEClass: 03cbacb4

Module: 00909394

Name: FooBar.DirectoryServices.Exchange.Site

mdToken: 0200009e (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

BaseSize: 0x54

ComponentSize: 0x0

Number of IFaces in IFaceMap: 2

Slots in VTable: 20

--------------------------------------

MethodDesc Table

   Entry MethodDesc JIT Name

7934cdcc 79137ab8 PreJIT System.Object.ToString()

...

03df5331 03df5268 NONE FooBar.DirectoryServices.Exchange.Site.IsGroupContainer()

03df5329   03df5258 NONE FooBar.DirectoryServices.Exchange.Site..ctor(System.String)

03df532d 03df5260 NONE FooBar.DirectoryServices.Exchange.Site..ctor(System.String, System.String)

03df5335 03df5270 NONE FooBar.DirectoryServices.Exchange.Site.isMixed()

 

 

 

 

Assembly walk back..

Here is a small portion of code we can walk through the managed stuff in

04a8ebad 8bcf mov ecx,edi

04a8ebaf ff150053df03 call dword ptr ds:[3DF5300h] -- call method as noted above. ( maybe gets some info? )

 

04a8ebb5 8d5638 lea edx,[esi+38h]

04a8ebb8 e8625b3e75 call mscorwks!JIT_Writeable_Thunks_Buf+0x11f (79e7471f) (mscorwks!JIT_Writeable_Thunks_Buf)

 

04a8ebbd 8b4e38 mov ecx,dword ptr [esi+38h]

04a8ebc0 3909 cmp dword ptr [ecx],ecx

04a8ebc2 ff150853df03 call dword ptr ds:[3DF5308h]

 

 

04a8ebc8 88464c mov byte ptr [esi+4Ch],al

04a8ebcb b94477df03 mov ecx,3DF7744h

04a8ebd0 e84734e6fb call 008f201c (JitHelp: CORINFO_HELP_NEWSFAST)

 

 

 

Moving the data back into the object instance

 

 

04a8ebb5 8d5638 lea edx,[esi+38h]

04a8ebb8 e8625b3e75 call mscorwks!JIT_Writeable_Thunks_Buf+0x11f (79e7471f) (mscorwks!JIT_Writeable_Thunks_Buf)

 

 

0:011> r

eax=014229e8 ebx=013ffffc ecx=01422ffc edx=0000508a esi=01421bfc edi=014229e8

eip=04a8ebb5 esp=03ddf34c ebp=013ffffc iopl=0 nv up ei pl nz na po nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202

04a8ebb5 8d5638 lea edx,[esi+38h]

 

0:011> !do 01421bfc

Name: FooBar.DirectoryServices.ActiveDirectoryInitialContext

MethodTable: 03df6194

EEClass: 03cbb41c

Size: 88(0x58) bytes

GC Generation: 0

 (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

Fields:

      MT Field Offset Type VT Attr Value Name

034c94cc 40001a4 4 ...es.InitialContext 0 instance 00000000 initialContext

790f9244 40001a5 8 System.String 0 instance 01254d68 distinguishedName

03df7240 40001a6 c ...veDs.IADsPathname 0 instance 01422100 adsPathName

790f9244 40001a7 10 System.String 0 instance 01422110 protocolPrefix

790fd8b4 40001a8 14 ...ections.Hashtable 0 instance 01422038 objectClassSchemas

034caad4 40001c1 18 ...vices.Credentials 0 instance 013db8f4 connectionCredentials

790f9244 40001c2 1c System.String 0 instance 012f9f74 serverName

790f9244 40001c3 20 System.String 0 instance 01422538 dnsHostName

790f9244 40001c4 24 System.String 0 instance 01421b18 defaultNamingContext

790f9244 40001c5 28 System.String 0 instance 01422680 configNamingContext

790f9244 40001c6 2c System.String 0 instance 014227d0 schemaNamingContext

03df7744 40001c7 30 ...veDirectoryDomain 0 instance 00000000 domain

03df7844 40001c8 34 ...ory.GlobalCatalog 0 instance 00000000 global

03df5294 40001c9 38 ...ces.Exchange.Site 0 instance 00000000 site

03df4a80 40001ca 3c ...ces.DirectoryItem 0 instance 00000000 config

790ffe7c 40001cb 40 System.Type 0 instance 00000000 providerType

034c30c0 40001c0 2a0 log4net.ILog 0 static 013fe5e4 debugLog

790f9244 40001cc 2a4 System.String 0 static 013fe330 TopContainerFormatter

79103c00 400025b 4c System.Boolean 1 instance 0 ntMixed

79103c00 400025c 4d System.Boolean 1 instance 0 mixed

79103c00 400025d 4e System.Boolean 1 instance 0 hasExchange

79103c00 400025e 4f System.Boolean 1 instance 0 hasExchange2003

79103c00 400025f 50 System.Boolean 1 instance 0 gcPresent

790f9244 4000260 44 System.String 0 instance 0142293c rootDomainNamingContext

790fd8b4 4000261 48 ...ections.Hashtable 0 instance 01421f70 detailedSchemaInfo

034c30c0 400025a 330 log4net.ILog 0 static 01421ef0 debugLog

 

 

04a8ebb8 e8625b3e75 call mscorwks!JIT_Writeable_Thunks_Buf+0x11f (79e7471f) (mscorwks!JIT_Writeable_Thunks_Buf)

-- > after this the FooBar.DirectoryServices.ActiveDirectoryInitialContext site is filled in

0:011> !do 01421bfc

Name: FooBar.DirectoryServices.ActiveDirectoryInitialContext

MethodTable: 03df6194

EEClass: 03cbb41c

Size: 88(0x58) bytes

GC Generation: 0

 (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

Fields:

      MT Field Offset Type VT Attr Value Name

034c94cc 40001a4 4 ...es.InitialContext 0 instance 00000000 initialContext

790f9244 40001a5 8 System.String 0 instance 01254d68 distinguishedName

03df7240 40001a6 c ...veDs.IADsPathname 0 instance 01422100 adsPathName

790f9244 40001a7 10 System.String 0 instance 01422110 protocolPrefix

790fd8b4 40001a8 14 ...ections.Hashtable 0 instance 01422038 objectClassSchemas

034caad4 40001c1 18 ...vices.Credentials 0 instance 013db8f4 connectionCredentials

790f9244 40001c2 1c System.String 0 instance 012f9f74 serverName

790f9244 40001c3 20 System.String 0 instance 01422538 dnsHostName

790f9244 40001c4 24 System.String 0 instance 01421b18 defaultNamingContext

790f9244 40001c5 28 System.String 0 instance 01422680 configNamingContext

790f9244 40001c6 2c System.String 0 instance 014227d0 schemaNamingContext

03df7744 40001c7 30 ...veDirectoryDomain 0 instance 00000000 domain

03df7844 40001c8 34 ...ory.GlobalCatalog 0 instance 00000000 global

03df5294 40001c9 38 ...ces.Exchange.Site 0 instance 014229e8 site

03df4a80 40001ca 3c ...ces.DirectoryItem 0 instance 00000000 config

790ffe7c 40001cb 40 System.Type 0 instance 00000000 providerType

034c30c0 40001c0 2a0 log4net.ILog 0 static 013fe5e4 debugLog

790f9244 40001cc 2a4 System.String 0 static 013fe330 TopContainerFormatter

79103c00 400025b 4c System.Boolean 1 instance 0 ntMixed

79103c00 400025c 4d System.Boolean 1 instance 0 mixed

79103c00 400025d 4e System.Boolean 1 instance 0 hasExchange

79103c00 400025e 4f System.Boolean 1 instance 0 hasExchange2003

79103c00 400025f 50 System.Boolean 1 instance 0 gcPresent

790f9244 4000260 44 System.String 0 instance 0142293c rootDomainNamingContext

790fd8b4 4000261 48 ...ections.Hashtable 0 instance 01421f70 detailedSchemaInfo

034c30c0 400025a 330 log4net.ILog 0 static 01421ef0 debugLog

 

 

04a8ebbd 8b4e38 mov ecx,dword ptr [esi+38h] - now move the value into ECX

04a8ebc0 3909 cmp dword ptr [ecx],ecx -- ptr [ECX] is the method table

 

 

0:011> r

eax=014229e8 ebx=013ffffc ecx=01422ffc edx=00005087 esi=01421bfc edi=014229e8

eip=04a8ebbd esp=03ddf34c ebp=013ffffc iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

04a8ebbd 8b4e38 mov ecx,dword ptr [esi+38h] ds:0023:01421c34=014229e8

 

0:011> p

eax=014229e8 ebx=013ffffc ecx=014229e8 edx=00005087 esi=01421bfc edi=014229e8

eip=04a8ebc0 esp=03ddf34c ebp=013ffffc iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

04a8ebc0 3909 cmp dword ptr [ecx],ecx ds:0023:014229e8=03df5294

 

0:011> !do 014229e8

Name: FooBar.DirectoryServices.Exchange.Site

MethodTable: 03df5294 -- check this via "!dumpmt -md 03df5294"

EEClass: 03cbacb4

Size: 84(0x54) bytes

GC Generation: 0

 

04a8ebc2 ff150853df03 call dword ptr ds:[3DF5308h] -- here we call 03df5335-> 03df5270

 

 

0:011> !dumpmt -md 03df5294

EEClass: 03cbacb4

Module: 00909394

 

Name: FooBar.DirectoryServices.Exchange.Site

mdToken: 0200009e (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

BaseSize: 0x54

ComponentSize: 0x0

Number of IFaces in IFaceMap: 2

 

Slots in VTable: 20

 

--------------------------------------

MethodDesc Table

   Entry MethodDesc JIT Name

7934cdcc 79137ab8 PreJIT System.Object.ToString()

7934bba0 79137ac0 PreJIT System.Object.Equals(System.Object)

7934bb90 79137ad8 PreJIT System.Object.GetHashCode()

793424c0 79137ae0 PreJIT System.Object.Finalize()

03df44e5 03df43e0 NONE FooBar.DirectoryServices.Item.GetDisplayName()

...

03df5331 03df5268 NONE FooBar.DirectoryServices.Exchange.Site.IsGroupContainer()

04a8ed00 03df5258 JIT FooBar.DirectoryServices.Exchange.Site..ctor(System.String)

03df532d 03df5260 NONE FooBar.DirectoryServices.Exchange.Site..ctor(System.String, System.String)

03df5335 03df5270 NONE FooBar.DirectoryServices.Exchange.Site.isMixed()

<snip>

04a8ebc8 88464c mov byte ptr [esi+4Ch],al

04a8ebcb b94477df03 mov ecx,3DF7744h

04a8ebd0 e84734e6fb call 008f201c (JitHelp: CORINFO_HELP_NEWSFAST)

 

0:011> p

eax=00000000 ebx=013ffffc ecx=01454b94 edx=00000000 esi=01421bfc edi=014229e8

eip=04a8ebc8 esp=03ddf34c ebp=013ffffc iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

04a8ebc8 88464c mov byte ptr [esi+4Ch],al ds:0023:01421c48=00 -- sets ntMixed == false

 

 

 

0:011> !do 01421bfc

Name: FooBar.DirectoryServices.ActiveDirectoryInitialContext

MethodTable: 03df6194

EEClass: 03cbb41c

Size: 88(0x58) bytes

GC Generation: 0

 (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

Fields:

      MT Field Offset Type VT Attr Value Name

034c94cc 40001a4 4 ...es.InitialContext 0 instance 00000000 initialContext

790f9244 40001a5 8 System.String 0 instance 01254d68 distinguishedName

...

790f9244 40001cc 2a4 System.String 0 static 013fe330 TopContainerFormatter

79103c00 400025b 4c System.Boolean 1 instance 0 ntMixed

79103c00 400025c 4d System.Boolean 1 instance 0 mixed

79103c00 400025d 4e System.Boolean 1 instance 0 hasExchange

 

 

0:011> p

eax=00000000 ebx=013ffffc ecx=01454b94 edx=00000000 esi=01421bfc edi=014229e8

eip=04a8ebcb esp=03ddf34c ebp=013ffffc iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

04a8ebcb b94477df03 mov ecx,3DF7744h

 

 

0:011> !do 01421bfc

Name: FooBar.DirectoryServices.ActiveDirectoryInitialContext

MethodTable: 03df6194

EEClass: 03cbb41c

Size: 88(0x58) bytes

GC Generation: 0

 (C:\WINDOWS\assembly\GAC_MSIL\FooBar.DirectoryServices\2.0.105.0__8cd3e6ab09a4c7bf\FooBar.DirectoryServices.dll)

Fields:

      MT Field Offset Type VT Attr Value Name

034c94cc 40001a4 4 ...es.InitialContext 0 instance 00000000 initialContext

790f9244 40001a5 8 System.String 0 instance 01254d68 distinguishedName

...

790f9244 40001c5 28 System.String 0 instance 00000000 configNamingContext

790f9244 40001c6 2c System.String 0 instance 00000000 schemaNamingContext

03df7744 40001c7 30 ...veDirectoryDomain 0 instance 00000000 domain

03df7844 40001c8 34 ...ory.GlobalCatalog 0 instance 00000000 global

03df5294 40001c9 38 ...ces.Exchange.Site 0 instance 00000000 site

 

0:011>

eax=00000000 ebx=013ffffc ecx=03df7744 edx=00000000 esi=01421bfc edi=014229e8

eip=04a8ebd0 esp=03ddf34c ebp=013ffffc iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

04a8ebd0 e84734e6fb call 008f201c

 

04a8e381 e8963ce6fb call 008f201c (JitHelp: CORINFO_HELP_NEWSFAST) --- can’t recall what this was - looks like it allocates an object?