windbg随笔


.cls
~ ----------------------------------查看当前程序的所有线程
~0s --------------------------------切换到我们需要调试的原托管线程中
!Threads ---------------------------命令可以查看进程内所有的托管线程,仅仅是托管线程
!dumpheap -stat --------------------统计堆的信息
!dumpheap -type System.String ------查看string类型在堆中的信息.为什是string,是因为在!dumpheap -stat的结果中,发现string占用最内存最多
!gcroot 02029348 -------------------查看内存很高的堆地址, 02029348 是!dumpheap结果中有对string操作的堆最大的Adress
!help gcroot -----------------------查看gcroot的帮助
!dso  查看栈局部变量
!do poi(指针)
!do -nofields 地址   打印字符串


0:000>!name2ee System_Windows_Forms_ni System.Windows.Forms.Application+MarshalingControl..ctor

Module: 7a981000 (System.Windows.Forms.dll)
Token: 0x060017d8
MethodDesc: 7a99cbcc
Name: System.Windows.Forms.Application+MarshalingControl..ctor()
JITTED Code Address: 7ab46fc0

7ab46fc0 is the address we want to place a breakpoint on. This breakpoint should be hit the first time a Control is created on a thread. It will dump the managed callstack to the output window and then continue on with normal execution.

0:000> bp 7ab46fc0 ".echo MarshalingControl creation detected. Callstack follows.;!clrstack;.echo ==============================;gc"

posted @ 2020-03-28 11:42  马肯尼煤牙巴骨  阅读(86)  评论(0编辑  收藏  举报