使用C＃远程发送命令到WinDbg

Question

In my application, WinDbg gets launched and I wondered if there was any way of sending certain commands through to WinDbg (for example sending the letter k (to show the callstack) from the C# application?

I've read around some use of user32.dll which has functions that can help with this but I am unclear of how to proceed and include it in my app.

Any help would be greatly appreciated.

Steve

Answer 1

If you want to fully control the debug engine, then you should just host it inside your C# application using the exposed COM interfaces.

You can find sample code for automating the debug engine in the WinDbg installation directory (eg C:\\Program Files (x86)\\Windows Kits\\8.1\\Debuggers\\x64\\sdk\\samples). This blog post shows how to get a stack trace using the API (in C), so you don't have to parse the output after issuing a k command.

The hardest part is just finding/creating all the IDebug* [ComImport] interfaces in C# for all the exposed objects. But once you have them, you would do something like this:

internal static class WinDbgBase
{
    // STDAPI DebugCreate(__in REFIID InterfaceId, __out PVOID* Interface);
    [DllImport("dbgeng.dll", EntryPoint = "DebugCreate", CallingConvention = CallingConvention.StdCall)]
    public static extern int DebugCreate([In] ref System.Guid InterfaceId, ref System.IntPtr Interface);
}

Guid uuidof_IDebugClient4 = new Guid("{ca83c3de-5089-4cf8-93c8-d892387f2a5e}");
IntPtr pObj = IntPtr.Zero;
int hr = WinDbgBase.DebugCreate(ref uuidof_IDebugClient4, ref pObj);
IDebugClient4 _client = (IDebugClient4)Marshal.GetTypedObjectForIUnknown(pObj, typeof(IDebugClient4));

// QueryInterface the other objects
IDebugControl4 _control = (IDebugControl4)_client;

_client.AttachProcess(0, ProcessId, DEBUG_ATTACH.DEBUG_ATTACH_DEFAULT);
_control.WaitForEvent(DEBUG_WAIT.DEBUG_WAIT_DEFAULT, Win32.INFINITE);
...

If you are dealing with managed targets, then it is even possible to load up the SOS extension, get the managed stack (as previously mentioned) and then merge it with the native stack trace so that you can show the full stack with all the native to/from managed transitions.

References - Listing of all Debugger COM objects

Answer 2

No need to send keystrokes. There's a more reliable way: see the WinDbg help for .ocommand . It works by sending commands through OutputDebugString , which is Debug.WriteLine() (Debug build) or Trace.WriteLine() (Release build) in .NET.

As you also start the debugger by yourself, you probably want to execute .ocommand immediately at startup which you can do by adding the -c command line switch:

windbg.exe -p <PID> -c ".ocommand <Magic>;g"

This approach is a quick any dirty way. @joshpoley`s answer is the cleaner way if you want a long term stable solution.

Note that for .NET the native callstack k might not be what you want. Try !clrstack or !dumpstack of the SOS extension (which you can load using .loadby sos clr or .loadby sos mscorwks depending on your .NET version).