Microsoft.Diagnostics.Runtime

The maximum amount of memory (virtual address space) used by data readers to cache memory from the dumpfile.

Whether or not to attempt to use special OS memory features such as AWE on Windows.

Represents an AppDomain in the target runtime.

Gets the runtime associated with this ClrAppDomain.

Gets address of the AppDomain.

Gets the AppDomain's ID.

Gets the name of the AppDomain, as specified when the domain was created.

Gets a list of modules loaded into this AppDomain.

Gets the config file used for the AppDomain. This may be if there was no config file loaded, or if the targeted runtime does not support enumerating that data.

Gets the base directory for this AppDomain. This may return if the targeted runtime does not support enumerating this information.

To string override.

The name of this AppDomain.

Represents an array in the target process.

Gets the address of the object.

Gets the type of the object.

Gets the count of elements in this array.

Gets element values from the array.

Determines whether this instance and another specific have the same value. Instances are considered equal when they have the same .

The to compare to this instance. if the of the parameter is the same as in this instance; otherwise.

Determines whether this instance and another specific have the same value. Instances are considered equal when they have the same .

The to compare to this instance. if the of the parameter is the same as in this instance; otherwise.

Determines whether this instance and a specified object.

The to compare to this instance. if is , and its is the same as in this instance; otherwise.

Returns the hash code for this .

An hash code for this instance.

Determines whether two specified have the same value.

First to compare. Second to compare. if ; otherwise.

Determines whether two specified have different values.

First to compare. Second to compare. if the value of is different from the value of ; otherwise.

Represents a delegate instance in the target process.

Constructs a from a . Note that obj.IsDelegate must be true.

A delegate object

Returns whether this delegate has multiple targets or not. If this method returns true then it is expected that will return and you should use instead.

The actual object represented by this ClrDelegate instance.

Returns a the single delegate target of the

If this object is not a delegate we throw

Enumerates all delegate targets of this delegate. If called on a MulitcastDelegate, this will enumerate all targets that will be called when this delegate is invoked. If called on a non-MulticastDelegate, this will enumerate the value of GetDelegateTarget.

The "target" method and object that a delegate points to.

Constructor.

The parent delgate that this target came from. The "target" of this delegate. The method this delegate will call.

The parent delegate that this target comes from.

The object that this delegate is targeted to. If is an instance method, this will point to the pointer of that object. If is a static method, this will be a pointer to a delegate.

The method that would be called when is invoked in the target process.

Exception thrown by Microsoft.Diagnostics.Runtime unless there is a more appropriate exception subclass.

Constructor.

This is a representation of the metadata element type. These values directly correspond with CLR's CorElementType.

Not one of the other types.

Void type.

ELEMENT_TYPE_BOOLEAN

ELEMENT_TYPE_CHAR

ELEMENT_TYPE_I1

ELEMENT_TYPE_U1

ELEMENT_TYPE_I2

ELEMENT_TYPE_U2

ELEMENT_TYPE_I4

ELEMENT_TYPE_U4

ELEMENT_TYPE_I8

ELEMENT_TYPE_U8

ELEMENT_TYPE_R4

ELEMENT_TYPE_R8

ELEMENT_TYPE_STRING

ELEMENT_TYPE_PTR

ELEMENT_TYPE_VALUETYPE

ELEMENT_TYPE_CLASS

ELEMENT_TYPE_VAR

ELEMENT_TYPE_ARRAY

ELEMENT_TYPE_GENERICINST

ELEMENT_TYPE_I

ELEMENT_TYPE_U

ELEMENT_TYPE_FNPTR

ELEMENT_TYPE_OBJECT

ELEMENT_TYPE_MVAR

ELEMENT_TYPE_SZARRAY

A wrapper for exception objects which help with common tasks for exception objects. Create this using . You may call that when is .

Gets the original thread this exception was thrown from. This may be if we do not know.

Returns this exception's ClrObject representation.

Gets the address of the exception object.

Gets the for this exception object.

Gets the exception message.

Gets the inner exception, if one exists, otherwise.

Gets the HRESULT associated with this exception (or S_OK if there isn't one).

Gets the StackTrace for this exception. Note that this may be empty or partial depending on the state of the exception in the process. (It may have never been thrown or we may be in the middle of constructing the stackwalk.) This returns an empty list if no stack trace is associated with this exception object.

A representation of a field in the target process.

Gets the containing this field.

Gets the name of the field.

Gets the type token of this field.

Gets the type of the field. Note this property may return on error. There is a bug in several versions of our debugging layer which causes this. You should always null-check the return value of this field.

Gets the element type of this field. Note that even when Type is , this should still tell you the element type of the field.

Gets a value indicating whether this field is a primitive (, , etc).

True if this field is a primitive (, , etc), false otherwise.

Gets a value indicating whether this field is a value type.

True if this field is a value type, false otherwise.

Gets a value indicating whether this field is an object reference.

True if this field is an object reference, false otherwise.

Gets the size of this field.

Gets a value indicating whether this field is public.

Gets a value indicating whether this field is private.

Gets a value indicating whether this field is internal.

Gets a value indicating whether this field is protected.

For instance fields, this is the offset of the field within the object. For static fields this is the offset within the block of memory allocated for the module's static fields.

Returns a string representation of this object.

A string representation of this object.

Represents a root that comes from the finalizer queue.

Returns information about generic parameters.

The metadata token of the parameter.

The index of the parameter.

The attributes of the parameter.

The name of the parameter.

Constructor.

Represents a CLR handle in the target process.

Gets the address of the handle itself. That is, *ulong == Object.

Gets the Object the handle roots.

Gets the type of handle.

If this handle is a RefCount handle, this returns the reference count. RefCount handles with a RefCount > 0 are strong.

Gets the dependent handle target if this is a dependent handle.

Gets the AppDomain the handle resides in.

Gets a value indicating whether the handle is strong (roots the object).

Gets a value indicating whether the handle pins the object (doesn't allow the GC to relocate it).

ToString override.

Types of CLR handles.

Weak, short lived handle.

Weak, long lived handle.

Strong handle.

Strong handle, prevents relocation of target object.

RefCounted handle (strong when the reference count is greater than 0).

A weak handle which may keep its "secondary" object alive if the "target" object is also alive.

A strong, pinned handle (keeps the target object from being relocated), used for async IO operations.

Strong handle used internally for book keeping.

Weak WinRT handle.

A representation of the CLR heap.

Gets the runtime associated with this heap.

Returns true if the GC heap is in a consistent state for heap enumeration. This will return false if the process was stopped in the middle of a GC, which can cause the GC heap to be unwalkable. Note, you may still attempt to walk the heap if this function returns false, but you will likely only be able to partially walk each segment.

Returns the number of logical heaps in the process.

A heap is has a list of contiguous memory regions called segments. This list is returned in order of of increasing object addresses.

Gets the representing free space on the GC heap.

Gets the representing .

Gets a value indicating whether the GC heap is in Server mode.

Gets a for the given address on this heap.

The returned object will have a if objRef does not point to a valid managed object.

Obtains the type of an object at the given address. Returns if objRef does not point to a valid managed object.

Enumerates all objects on the heap.

An enumerator for all objects on the heap.

Enumerates all roots in the process. Equivalent to the combination of: ClrRuntime.EnumerateHandles().Where(handle => handle.IsStrong) ClrRuntime.EnumerateThreads().SelectMany(thread => thread.EnumerateStackRoots()) ClrHeap.EnumerateFinalizerRoots()

Returns the GC segment which contains the given address. This only searches ClrSegment.ObjectRange.

Enumerates all finalizable objects on the heap.

Enumerates all AllocationContexts for all segments. Allocation contexts are locations on the GC heap which the GC uses to allocate new objects. These regions of memory do not contain objects. AllocationContexts are the reason that you cannot simply enumerate the heap by adding each object's size to itself to get the next object on the segment, since if the address is an allocation context you will have to skip past it to find the next valid object.

Obtains the SyncBlock data for a given object, if the object has an associated SyncBlock.

The object to get SyncBlock data for. The SyncBlock for the object, null if the object does not have one.

Returns a string representation of this heap, including the size and number of segments.

The string representation of this heap.

This is an implementation helper. Use ClrObject.IsComCallWrapper and ClrObject.IsRuntimeCallWrapper instead.

This is an implementation helper. Use ClrObject.Size instead.

This is an implementation helper. Use ClrObject.EnumerateReferences instead. Enumerates all objects that the given object references. This method is meant for internal use to implement ClrObject.EnumerateReferences, which you should use instead of calling this directly.

The object in question. The type of the object. Whether to consider dependant handle mappings. Whether to bounds check along the way (useful in cases where the heap may be in an inconsistent state.)

This is an implementation helper. Enumerates all objects that the given object references. This method is meant for internal use to implement ClrObject.EnumerateReferencesWithFields, which you should use instead of calling this directly.

The object in question. The type of the object. Whether to consider dependant handle mappings. Whether to bounds check along the way (useful in cases where the heap may be in an inconsistent state.)

This is an implementation helper. Enumerates all objects that the given object references. This method is meant for internal use to implement ClrObject.EnumerateReferenceAddresses which you should use instead of calling this directly.

The object in question. The type of the object. Whether to consider dependant handle mappings. Whether to bounds check along the way (useful in cases where the heap may be in an inconsistent state.)

Represents an instance field of a type. Fundamentally it represents a name and a type

Reads the value of the field as an unmanaged struct or primitive type.

An unmanaged struct or primitive type. The object to read the instance field from. Whether or not the field is interior to a struct. The value read.

Reads the value of an object field.

The object to read the instance field from. Whether or not the field is interior to a struct. The value read.

Reads a ValueType struct from the instance field.

The object to read the instance field from. Whether or not the field is interior to a struct. The value read.

Reads a string from the instance field.

The object to read the instance field from. Whether or not the field is interior to a struct. The value read.

Returns the address of the value of this field. Equivalent to GetFieldAddress(objRef, false).

The object to get the field address for. The value of the field.

Returns the address of the value of this field. Equivalent to GetFieldAddress(objRef, false).

The object to get the field address for. Whether the enclosing type of this field is a value class, and that value class is embedded in another object. The value of the field.

An interface implementation in the target process.

Gets the typename of the interface.

Gets the interface that this interface inherits from.

Display string for this interface.

Equals override.

Object to compare to. True if this interface equals another.

GetHashCode override.

A hashcode for this object.

Represents a method on a class.

Gets the first MethodDesc in EnumerateMethodDescs(). For single AppDomain programs this is the only MethodDesc. MethodDescs are unique to an Method/AppDomain pair, so when there are multiple domains there will be multiple MethodDescs for a method.

Gets the name of the method. For example, "void System.Foo.Bar(object o, int i)" would return "Bar".

Gets the full signature of the function. For example, "void System.Foo.Bar(object o, int i)" would return "System.Foo.Bar(System.Object, System.Int32)"

Gets the instruction pointer in the target process for the start of the method's assembly.

Gets the ILOffset of the given address within this method.

The absolute address of the code (not a relative offset). The IL offset of the given address.

Gets the location in memory of the IL for this method.

Gets the regions of memory that

Gets the way this method was compiled.

Gets the IL to native offset mapping.

Gets the metadata token of the current method.

Gets the enclosing type of this method.

Gets a value indicating whether this method is public.

Gets a value indicating whether this method is private.

Gets a value indicating whether this method is internal.

Gets a value indicating whether this method is protected.

Gets a value indicating whether this method is static.

Gets a value indicating whether this method is final.

Gets a value indicating whether this method is a P/Invoke.

Gets a value indicating whether this method is a special method.

Gets a value indicating whether this method is a runtime special method.

Gets a value indicating whether this method is virtual.

Gets a value indicating whether this method is abstract.

Gets a value indicating whether this method is an instance constructor.

Gets a value indicating whether this method is a static constructor.

Represents a managed module in the target process.

Gets the address of the clr!Module object.

Gets the AppDomain parent of this module.

Gets the name of the assembly that this module is defined in.

Gets an identifier to uniquely represent this assembly. This value is not used by any other function in ClrMD, but can be used to group modules by their assembly. (Do not use AssemblyName for this, as reflection and other special assemblies can share the same name, but actually be different.)

Gets the name of the module.

Gets a value indicating whether this module was created through System.Reflection.Emit (and thus has no associated file).

Gets a value indicating whether this module is an actual PEFile on disk.

Gets the base of the image loaded into memory. This may be 0 if there is not a physical file backing it.

Returns the in memory layout for PEImages.

Gets the size of the image in memory.

Gets the location of metadata for this module in the process's memory. This is useful if you need to manually create IMetaData* objects.

Gets the length of the metadata for this module.

Gets the IMetaDataImport interface for this module. Note that this API does not provide a wrapper for IMetaDataImport. You will need to wrap the API yourself if you need to use this.

Gets the debugging attributes for this module.

Enumerates the constructed methodtables in this module which correspond to typedef tokens defined by this module.

An enumeration of (ulong methodTable, uint typeDef).

Resolves the given metadata token for this module.

A typedef or typeref token. The ClrType of the resolved token, if not found or if a type for the token hasn't been constructed by the runtime.

Attempts to obtain a ClrType based on the name of the type. Note this is a "best effort" due to the way that the DAC handles types. This function will fail for Generics, and types which have never been constructed in the target process. Please be sure to null-check the return value of this function.

The name of the type. (This would be the EXACT value returned by ClrType.Name.) The requested ClrType, or if the type doesn't exist or if the runtime hasn't constructed it.

Returns a name for the assembly.

A name for the assembly.

Gets the PDB information for this module.

Represents an object in the target process.

Constructor.

The address of the object. The concrete type of the object.

Enumerates all objects that this object references.

Only returns pointers which lie on the managed heap. In very rare cases it's possible to create a crash dump where the GC was in the middle of updating data structures, or to create a crash dump of a process with heap corruption. In those cases, setting carefully=true would ensure we would not enumerate those bad references. Note that setting carefully=true will cause a small performance penalty. Setting this to true will have ClrMD check for dependent handle references. Checking dependent handles does come at a performance penalty but will give you the true reference chain as the GC sees it. An enumeration of object references.

Enumerates all objects that this object references. This method also enumerates the field (or handle) that this reference comes from.

Enumerates all objects that this object references.

Returns true if this object is a boxed struct or primitive type that

Reads a boxed primitive value.

An unmanaged struct or primitive type to read out of the object. The value read.

Gets the address of the object.

Gets the type of the object.

Returns whether this is free space on the GC heap and not a real object.

Returns whether this is a valid object. This will return null

Returns if the object value is .

Gets the size of the object.

Obtains the SyncBlock for this object. Returns null if there is no SyncBlock associated with this object.

Returns true if this object is a COM class factory.

Returns true if this object is a ComCallableWrapper.

Returns true if this object is a RuntimeCallableWrapper.

Returns the ComCallableWrapper for the given object.

The ComCallableWrapper associated with the object, if obj is not a CCW.

Returns the RuntimeCallableWrapper for the given object.

The RuntimeCallableWrapper associated with the object, if obj is not a RCW.

Gets a value indicating whether this object possibly contains GC pointers.

Gets a value indicating whether this object is an array.

returns the object as an array if the object has array type.

Converts a ClrObject into its string value.

A string object.

Returns sweetening obj to pointer move. Example: ulong address = clrObject

An object to get address of.

Tries to obtain the given object field from this ClrObject. Returns false if the field wasn't found or if the underlying type was not an object.

The name of the field to retrieve. True if the field was found and the field's type is an object. Returns false otherwise. A ClrObject of the given field.

Gets the given object reference field from this ClrObject.

The name of the field to retrieve. A ClrObject of the given field. The given field does not exist in the object. is .

Gets the value of a primitive field.

The type of the field itself. The name of the field. The value of this field.

Attempts to read the value of a primitive field. This method does no type checking on whether T matches the field's type.

The type of the field itself. The name of the field. The value of the missing field. True if we obtained this field and read its value, false otherwise.

Returns true if this object is a delegate, false otherwise.

Returns this object in a view. Note it is only valid to call if the underlying object is a subclass of System.Delegate. You can check before calling , but that is not required as long as you are sure the object is a delegate or should be treated like one.

Returns this object in a view.

Gets a string field from the object. Note that the type must match exactly, as this method will not do type coercion.

The name of the field to get the value for. The maximum length of the string returned. Warning: If the DataTarget being inspected has corrupted or an inconsistent heap state, the length of a string may be incorrect, leading to OutOfMemory and other failures. The value of the given field. No field matches the given name. The target object is (that is, is ). -or- The field is not of the correct type.

Determines if this instance and another specific have the same value. Instances are considered equal when they have same .

The to compare to this instance. if the of the parameter is same as in this instance; otherwise.

Determines whether this instance and a specified object, which must also be a , have the same value.

The to compare to this instance. if is , and its is same as in this instance; otherwise.

Returns the hash code for this based on its .

An hash code for this instance.

Determines whether two specified have the same value.

First to compare. Second to compare. if ; otherwise.

Determines whether two specified have different values.

First to compare. Second to compare. if the value of is different from the value of ; otherwise.

ToString override.

The object that contained.

The offset into the containing object this address is found at. Only valid if is true.

Resolves the inner field reference for value types.

The field this object was contained in. This property may be null if this reference came from a DependentHandle or if the reference came from an array entry. Only valid to call if is true.

Returns true if this reference came from a dependent handle.

Returns true if this reference came from a field in another object.

Returns true if this reference came from an entry in an array.

Create a field reference from a dependent handle value. We do not keep track of the dependent handle it came from so we don't accept the value here.

The object referenced.

Creates a ClrFieldReference from an actual field.

The object referenced. The type of the object which points to . The offset within the source object where was located. This offset should start from where the object's data starts (IE this offset should NOT contain the MethodTable in the offset calculation.

The type of GCRoot that a ClrRoot represents.

This is not a gc root. This will not be enumerated out of ClrHeap.EnumerateRoots, but could be seen when using ClrRuntime.EnumerateHandles.

The root comes from the finalizer queue.

The root is a strong handle.

The root is a strong pinned handle.

The root is on the stack of a thread. This is usually a is a local variable (or compiler generated temporary variable).

The root is a ref counted handle.

The root is an async IO (strong) pinned handle.

The root is a SizedRef handle.

Represents a single runtime in a target process or crash dump. This serves as the primary entry point for getting diagnostic information.

Used for internal purposes.

Gets the of the current runtime.

Gets the associated with this runtime.

Returns whether you are allowed to call into the transitive closure of ClrMD objects created from this runtime on multiple threads.

Gets the list of appdomains in the process.

Gets the System AppDomain for Desktop CLR ( on .NET Core).

Gets the Shared AppDomain for Desktop CLR ( on .NET Core).

Gets all managed threads in the process. Only threads which have previously run managed code will be enumerated.

Returns a ClrMethod by its internal runtime handle (on desktop CLR this is a MethodDesc).

The method handle (MethodDesc) to look up. The ClrMethod for the given method handle, or if no method was found.

Gets the corresponding to the given MethodTable.

The ClrType.MethodTable for the requested type. A ClrType object, or if no such type exists.

Enumerates a list of GC handles currently in the process. Note that this list may be incomplete depending on the state of the process when we attempt to walk the handle table.

The list of GC handles in the process, NULL on catastrophic error.

Gets the GC heap of the process.

Attempts to get a ClrMethod for the given instruction pointer. This will return NULL if the given instruction pointer is not within any managed method.

Enumerate all managed modules in the runtime.

Flushes the DAC cache. This function MUST be called any time you expect to call the same function but expect different results. For example, after walking the heap, you need to call Flush before attempting to walk the heap again. After calling this function, you must discard ALL ClrMD objects you have cached other than DataTarget and ClrRuntime and re-request the objects and data you need. (e.g. if you want to use the ClrHeap object after calling flush, you must call ClrRuntime.GetHeap again after Flush to get a new instance.)

Gets the name of a JIT helper function.

Address of a possible JIT helper function. The name of the JIT helper function or if isn't a JIT helper function.

Cleans up all resources and releases them. You may not use this ClrRuntime or any object it transitively created after calling this method.

Called when disposing ClrRuntime.

Whether Dispose() was called or not.

A ClrSegment represents a contiguous region of memory that is devoted to the GC heap. Segments. It has a start and end and knows what heap it belongs to. Segments can optional have regions for Gen 0, 1 and 2, and Large properties.

Gets the GC heap associated with this segment. There's only one GCHeap per process, so this is only a convenience method to keep from having to pass the heap along with a segment.

The memory range of the segment on which objects are allocated. All objects in this segment fall within this range.

Gets the start address of the segment. Equivalent to ..

Gets the end address of the segment. Equivalent to ..

Equivalent to ..

Gets the processor that this heap is affinitized with. In a workstation GC, there is no processor affinity (and the return value of this property is undefined). In a server GC each segment has a logical processor in the PC associated with it. This property returns that logical processor number (starting at 0).

Gets the range of memory reserved (but not committed) for this segment.

Gets the range of memory committed for the segment (this may be larger than MemoryRange).

Gets the first object on this segment or 0 if this segment contains no objects.

Returns true if this is a segment for the Large Object Heap. False otherwise. Large objects (greater than 85,000 bytes in size), are stored in their own segments and only collected on full (gen 2) collections.

Returns true if this is a segment for the Pinned Object Heap. False otherwise.

Returns true if this segment is the ephemeral segment (meaning it contains gen0 and gen1 objects).

The memory range for Generation 0 on this segment. This will be empty if is false.

The memory range for Generation 1 on this segment. This will be empty if is false.

The memory range for Generation 2 on this segment. This will be equivalent to ObjectRange if is false.

Enumerates all objects on the segment.

Returns the object after the given object.

A valid object address that resides on this segment. The next object on this segment, or 0 if is the last object on the segment.

Returns the object before the given object. Note that this function may take a while because in the worst case scenario we have to linearly walk all the way from the beginning of the segment to the object.

An address that resides on this segment. This does not need to point directly to a good object. The previous object on this segment, or 0 if is the first object on the segment.

Returns the generation of an object in this segment.

An object in this segment. The generation of the given object if that object lies in this segment. The return value is undefined if the object does not lie in this segment.

Returns a string representation of this object.

A string representation of this object.

A frame in a managed stack trace. Note you can call ToString on an instance of this object to get the function name (or clr!Frame name) similar to SOS's !clrstack output.

The thread parent of this frame. Note that this may be null when inspecting the stack of ClrExceptions.

Gets this stack frame context.

Gets the instruction pointer of this frame.

Gets the stack pointer of this frame.

Gets the type of frame (managed or internal).

Gets the which corresponds to the current stack frame. This may be if the current frame is actually a CLR "Internal Frame" representing a marker on the stack, and that stack marker does not have a managed method associated with it.

Gets the helper method frame name if is , otherwise.

The type of frame the ClrStackFrame represents.

Indicates this stack frame is unknown

Indicates this stack frame is a standard managed method.

Indicates this stack frame is a special stack marker that the CLR leaves on the stack. Note that the may still have a associated with the marker.

ToString override.

Represents a static field in the target process.

Returns whether this static field has been initialized in a particular AppDomain or not. If a static variable has not been initialized, then its class constructor may have not been run yet. Calling any of the Read* methods on an uninitialized static will result in returning either NULL or a value of 0.

The AppDomain to see if the variable has been initialized. True if the field has been initialized (even if initialized to NULL or a default value), false if the runtime has not initialized this variable.

Gets the address of the static field's value in memory.

The address of the field's value.

Reads the value of the field as an unmanaged struct or primitive type.

An unmanaged struct or primitive type. The value read.

Reads the value of an object field.

The value read.

Reads a ValueType struct from the instance field.

The value read.

Reads a string from the instance field.

The value read.

Represents a managed thread in the target process. Note this does not wrap purely native threads in the target process (that is, threads which have never run managed code before).

Gets the runtime associated with this thread.

Gets the suspension state of the thread according to the runtime.

Gets a value indicating whether this is the finalizer thread.

Gets the address of the underlying datastructure which makes up the Thread object. This serves as a unique identifier.

Returns true if the thread is alive in the process, false if this thread was recently terminated.

Gets the OS thread id for the thread.

Gets the managed thread ID (this is equivalent to in the target process).

Gets the AppDomain the thread is running in.

Gets the number of managed locks (Monitors) the thread has currently entered but not left. This will be highly inconsistent unless the process is stopped.

Gets the base of the stack for this thread, or 0 if the value could not be obtained.

Gets the limit of the stack for this thread, or 0 if the value could not be obtained.

Enumerates the GC references (objects) on the stack. The returned IClrRoot may either be an or a .

An enumeration of GC references on the stack as the GC sees them.

Enumerates a stack trace for a given thread. Note this method may loop infinitely in the case of stack corruption or other stack unwind issues which can happen in practice. When enumerating frames out of this method you should be careful to either set a maximum loop count, or to ensure the stack unwind is making progress by ensuring that ClrStackFrame.StackPointer is making progress (though it is expected that sometimes two frames may return the same StackPointer in some corner cases).

An enumeration of stack frames.

Gets the exception currently on the thread. Note that this field may be . Also note that this is basically the "last thrown exception", and may be stale...meaning the thread could be done processing the exception but a crash dump was taken before the current exception was cleared off the field.

Gets a value indicating whether an abort was requested for this thread (such as , or ).

Gets a value indicating whether this thread was aborted.

Gets a value indicating whether the GC is attempting to suspend this thread.

Gets a value indicating whether the user has suspended the thread (using ).

Gets a value indicating whether the debugger has suspended the thread.

Gets a value indicating whether this thread is a background thread. (That is, if the thread does not keep the managed execution environment alive and running.)

Gets a value indicating whether this thread was created, but not started.

Gets a value indicating whether the CLR called CoInitialize for this thread.

Gets a value indicating whether this thread is in a COM single threaded apartment.

Gets a value indicating whether the thread is a COM multithreaded apartment.

A representation of a type in the target process.

Gets the associated with this type. Only valid if is .

Gets the MethodTable of this type (this is the TypeHandle if this is a type without a MethodTable).

Gets the metadata token of this type.

Gets the name of this type.

Gets a value indicating whether the type can contain references to other objects. This is used in optimizations and 'true' can always be returned safely.

Gets a value indicating whether this is a collectible type.

Gets the handle to the LoaderAllocator object for collectible types.

Gets the address of the AssemblyLoadContext object.

Gets the this type belongs to.

Gets the module this type is defined in.

Gets the of this Type. Can return on error.

Gets a value indicating whether this type is a primitive (, , etc).

True if this type is a primitive (, , etc), false otherwise.

Gets a value indicating whether this type is a value type.

True if this type is a value type, false otherwise.

Gets a value indicating whether this type is an object reference.

True if this type is an object reference, false otherwise.

Enumerates the generic parameters of this type.

Returns the list of interfaces this type implements.

Returns true if the finalization is suppressed for an object (the user program called ). The behavior of this function is undefined if the object itself is not finalizable.

Gets a value indicating whether objects of this type are finalizable.

Gets a value indicating whether this type is marked Public.

Gets a value indicating whether this type is marked Private.

Gets a value indicating whether this type is accessible only by items in its own assembly.

Gets a value indicating whether this nested type is accessible only by subtypes of its outer type.

Gets a value indicating whether this class is abstract.

Gets a value indicating whether this class is sealed.

Gets a value indicating whether this type is an interface.

Gets all possible fields in this type. It does not return dynamically typed fields. Returns an empty list if there are no fields.

Gets a list of static fields on this type. Returns an empty list if there are no fields.

Gets the list of methods this type implements.

Returns the field given by , case sensitive. Returns if no such field name exists (or on error).

If this type inherits from another type, this is that type. Can return if it does not inherit (or is unknown).

Gets a value indicating whether the type is in fact a pointer. If so, the pointer operators may be used.

Gets the type of the element referenced by the pointer.

A type is an array if you can use the array operators below, Abstractly arrays are objects that whose children are not statically known by just knowing the type.

Returns the absolute address to the given array element. You may then make a direct memory read out of the process to get the value if you want.

Returns multiple consecutive array element values.

Gets the static size of objects of this type when they are created on the CLR heap.

Gets the size of elements of this object.

Gets a value indicating whether this type is .

Gets a value indicating whether this type represents free space on the heap.

Gets a value indicating whether this type is an exception (that is, it derives from ).

Gets a value indicating whether this type is an enum.

Returns the representation of this type.

The representation of this type. is .

Gets a value indicating whether this type is shared across multiple AppDomains.

Returns a string representation of this object.

A string representation of this object.

Used to provide functionality to ClrObject.

Represents an instance of a type which inherits from .

Gets the address of the object.

Gets the type of the object.

Returns whether this ClrValueType has a valid Type. In most normal operations of ClrMD, we will have a non-null type. However if we are missing metadata, or in some generic cases we might not be able to determine the type of this value type. In those cases, Type? will be null and IsValid will return false.

Gets the given object reference field from this ClrObject.

The name of the field to retrieve. A ClrObject of the given field. The given field does not exist in the object. -or- The given field was not an object reference.

Gets the value of a primitive field. This will throw an InvalidCastException if the type parameter does not match the field's type.

The type of the field itself. The name of the field. The value of this field.

Gets a string field from the object. Note that the type must match exactly, as this method will not do type coercion.

Helper for COM Callable Wrapper objects. (CCWs are CLR objects exposed to native code as COM objects).

Gets the pointer to the IUnknown representing this CCW.

Gets the pointer to the managed object representing this CCW.

Gets the CLR handle associated with this CCW.

Gets the refcount of this CCW.

Gets the interfaces that this CCW implements.

The COM implementation details of a single CCW entry.

Gets the CLR type this represents.

Gets the interface pointer of Type.

Defines the state of the thread from the runtime's perspective.

In Cooperative mode the thread must cooperate before a GC may proceed. This means when a GC starts, the runtime will attempt to suspend the thread at a safepoint but cannot immediately stop the thread until it synchronizes.

In Preemptive mode the runtime is free to suspend the thread at any time for a GC to occur.

A delegate for reporting GCRoot progress.

The GCRoot sending the event. The total number of objects processed.

A helper class to find the GC rooting chain for a particular object.

Since GCRoot can be long running, this event will provide periodic updates to how many objects the algorithm has processed. Note that in the case where we search all objects and do not find a path, it's unlikely that the number of objects processed will ever reach the total number of objects on the heap. That's because there will be garbage objects on the heap we can't reach.

Gets the heap that's associated with this GCRoot instance.

Creates a GCRoot helper object for the given heap.

The heap the object in question is on.

Enumerates GCRoots of a given object. Similar to !gcroot. Note this function only returns paths that are fully unique.

The target object to search for GC rooting. A cancellation token to stop enumeration. An enumeration of all GC roots found for target.

Enumerates GCRoots of a given object. Similar to !gcroot.

The target object to search for GC rooting. Whether to only return fully unique paths. The number of threads this class is allowed to use to calculate the result. Setting this to 1 will cause the algorithm to run on the current thread. The roots to consider. You can pass ClrMD. A cancellation token to stop enumeration. An enumeration of all GC roots found for target.

Returns the path from the start object to the end object (or if no such path exists).

The initial object to start the search from. The object we are searching for. A cancellation token to stop searching. A path from 'source' to 'target' if one exists, if one does not.

Returns the path from the start object to the end object (or if no such path exists).

The initial object to start the search from. The object we are searching for. Whether to only enumerate fully unique paths. A cancellation token to stop enumeration. A path from 'source' to 'target' if one exists, if one does not.

Represents a path of objects from a root to an object.

Gets the location that roots the object.

Gets the path from Root to a given target object.

Returns the addresses and sizes of the hot and cold regions of a method.

Gets the start address of the method's hot region.

Gets the size of the hot region.

Gets the start address of the method's cold region.

Gets the size of the cold region.

Represents an addressable entity (class or struct) with associated type. Allows locating field values by known names.

Gets the address of this entity.

Gets the type associated with this entity.

Gets the value of a primitive field (i.e. , ) or an unmanaged struct.

The primitive type of the field. The name of the field to read value from. The value of the field. Thrown when field was not found by name.

Gets the value from the entity field. Note that the type must match exactly, as this method will not do type coercion.

The name of the field to get the value for. The value of the given field. Thrown when field was not found by name. Thrown when found field has other type than . The maximum length of the string returned. Warning: If the DataTarget being inspected has corrupted or an inconsistent heap state, the length of a string may be incorrect, leading to OutOfMemory and other failures.

Gets the struct field value from the entity field.

The name of the field to get the value for. The value of the given field. Thrown when field was not found by name, or found field is not of struct type.

Gets the value of reference field.

The name of the field to read value from. A found field points on. Thrown when field was not found by name, or found field is not of reference type.

Gets the address in memory of the root. Typically dereferencing this address will give you the associated Object, but not always.

Gets the object the root points to.

Gets the kind of root this is.

Gets a value indicating whether Address may point to the interior of an object (i.e. not the start of an object). If Address happens to point to the start of the object, IClrRoot.Object will be filled as normal, otherwise IClrRoot.Object.IsNull will be . In order to properly account for interior objects, you must read the value out of Address then find the object which contains it.

Gets a value indicating whether the object is pinned in place by this root and will not be relocated by the GC.

An implementation of

Locates a PE Image archived under the given properties.

The file name or path of the binary to locate. The build timestamp the binary is indexed under. The image size the binary is indexed under. Whether or not to validate the properties of the binary after download. A full path on disk (local) of where the binary was copied to or if it was not found.

Locates a PE Image potentially archived under an ELF or Mach-O binary's properties.

The file name or path of the binary to locate. The file or keyword that this binary is archived under. The buildId or UUID of the binary specified by . The platform of the binary specified by . Whether or not to validate the properties of the binary after download. A full path on disk (local) of where the binary was copied to or if it was not found.

Locates an Elf binary.

The file name or path of the binary to locate. The file or keyword that this binary is archived under, if its archived under its own properties. The buildId of the Elf image to locate or the buildId of the image specified by . Whether or not to validate that the given file matches the build id. A full path on disk (local) of where the binary was copied to or if it was not found.

The file name or path of the binary to locate. The file or keyword that this binary is archived under, if its archived under its own properties. The UUID of the image or of the image specified by . Whether or not to validate that the given file matches the uuid. A full path on disk (local) of where the binary was copied to or if it was not found.

Returns information about the IL for a method.

Gets the address in memory of where the IL for a particular method is located.

Gets the length (in bytes) of the IL method body.

Gets the flags associated with the IL code.

Gets the local variable signature token for this IL method.

A method's mapping from IL to native offsets.

The IL offset for this entry.

The native start offset of this IL entry.

The native end offset of this IL entry.

To string.

A visual display of the map entry.

Reserved.

Represents a single resource node in a resource tree.

The Children of this resource node.

The name of this entry (may be null).

The size of the data carried by this resource node.

Reads the data out of this resource node.

The buffer to read the data into. The offset into the data to read. The number of bytes read into buffer.

Reads the data out of this resource node into T.

An unmanaged struct to read the data into. The offset into the data to read. The data read, or if we failed to read this data.

Returns the first child resource node that matches , or null if one doesn't exist.

The name of the child node. The matching resource node, or null if it doesn't exist.

Represents a range of memory in the target process.

Creates a memory range from an address and its length.

The start address. The length of the range.

Constructor.

The start of the memory range. The end of the memory range.

The inclusive start address of the memory range.

The exclusive end address of the memory range.

The length of the memory range in bytes.

Returns whether the memory range contains the given address.

The address to check. True if the memory range contains the given address.

Returns whether this memory range and contains any addresses which overlap.

The other memory range to compare this to. True if memory ranges overlap at all.

Returns whether this memory range contains all of .

The other memory range to compare this to. True if this memory range completely encloses .

Returns the range of memory in interval form, ie [start,end). Since End is not inclusive, we use ')' to denote that the range does not include that address.

CompareTo implementation for a single address.

The way a method was JIT'ed.

Method is not yet JITed and no NGEN image exists.

Method was JITed.

Method was NGEN'ed (pre-JITed).

Provides information about loaded modules in a .

Attempts to create a object from a data reader and a base address. This function returns if an image was not found at that address or if we could not determine the format of that image.

The data reader to create this module from. The base address of this module. The name of the module. A constructed ModuleInfo, or null.

Returns the kind of module this is.

Gets the base address of the this image.

Retrieves the FileName of this loaded module. May be empty if it is unknown.

The size of this image (may be different from ).

Gets the specific file size of the image used to index it on the symbol server.

Gets the timestamp of the image used to index it on the symbol server.

The version of this module.

Gets the Linux BuildId or Mach-O UUID of this module.

Gets the PDB associated with this module.

Gets a value indicating whether the module is managed.

The root of the resource tree for this module if one exists, null otherwise.

The kind of module a represents.

Default value, should not be returned.

This module is not one of the other well defined types but isn't a part of this enum.

A Windows PortableExecutable file.

An Elf image (usually Linux).

An OS X Mach-O image.

This class is a HashSet of ulong for object addresses.

The ClrHeap this is an object set over.

The collection of segments and associated objects.

Gets or sets the count of objects in this set.

Constructor.

A ClrHeap to add objects from.

Returns true if this set contains the given object, false otherwise. The behavior of this function is undefined if obj lies outside the GC heap.

The object to check. True if this set contains the given object, false otherwise.

Adds the given object to the set. Returns true if the object was added to the set, returns false if the object was already in the set.

The object to add to the set. True if the object was added to the set, returns false if the object was already in the set.

Removes the given object from the set. Returns true if the object was removed, returns false if the object was not in the set.

The object to remove from the set. True if the object was removed, returns false if the object was not in the set.

Empties the set.

Calculates the offset of an object within a segment.

The object. The segment. The index into seg.Objects.

Gets the segment for the given object.

The object in question. The resulting segment. True if obj lies within a gc segment, false otherwise.

A segment of memory in the heap.

The objects in the memory range.

The start address of the segment.

The end address of the segment.

Information about a specific PDB instance obtained from a PE image.

Gets the Guid of the PDB.

Gets the PDB revision.

Gets the path to the PDB.

Creates an instance of the PdbInfo class with the corresponding properties initialized.

GetHashCode implementation.

Override for Equals. Returns true if the guid, age, and file names equal. Note that this compares only the.

True if the objects match, false otherwise.

To string implementation.

Printing friendly version.

Helper for Runtime Callable Wrapper objects. (RCWs are COM objects which are exposed to the runtime as managed objects.)

Gets the pointer to the IUnknown representing this CCW.

Gets the external VTable associated with this RCW. (It's useful to resolve the VTable as a symbol which will tell you what the underlying native type is...if you have the symbols for it loaded).

Gets the RefCount of the RCW.

Gets the managed object associated with this of RCW.

Gets a value indicating whether the RCW is disconnected from the underlying COM type.

Gets the thread which created this RCW.

Gets the internal WinRT object associated with this RCW (if one exists).

Gets the list of interfaces this RCW implements.

Do not cache the value at all. This will result in drastically lower memory usage at the cost of performance.

Strings will be cached by the objects which hold them. This will make repeated requests to get the same value MUCH faster, but at the cost of holding on to extra memory.

Strings will be cached by the objects which hold them and they will also be interned, ensuring that the same string value will not be kept alive by multiple objects. The danger here is that interned strings are never freed until the AppDomain they live in is unloaded (or never for .NET Core). Field names will benefit from interning if you read a lot of fields for a lot of types. It's unlikely that method names or type names will benefit from interning unless the same types are loaded into multiple AppDomains in the target process.

The binary under which the files is archived.

The binary is archived under its own properties.

The binary is archived under coreclr's properties.

A representation of CLR's CLRDATA_ADDRESS, which is a signed 64bit integer. Unfortunately this can cause issues when inspecting 32bit processes, since if the highest bit is set the value will be sign-extended. This struct is meant to

Gets raw value of this address. May be sign-extended if inspecting a 32bit process.

Creates an instance of ClrDataAddress.

Returns the value of this address and un-sign extends the value if appropriate.

The address to convert.

Returns the value of this address and un-sign extends the value if appropriate.

The value of this address and un-sign extends the value if appropriate.

This is an undocumented, untested, and unsupported interface. Do not use.

An interface for reading data out of the target process.

The name of the target. This should be a meaningful moniker such as the pid of the target process or the path to the dump being read. This is primarily used when debugging to see what DataTarget is inspecting.

Gets a value indicating whether this data reader is safe to use in parallel from multiple threads.

The platform that the target process was running on.

Gets the architecture of the target.

The architecture of the target.

Gets the process ID of the DataTarget.

Enumerates modules in the target process.

An enumerable of the modules in the target process.

Gets the thread context for the given thread.

The OS thread ID to read the context from. The requested context flags, or 0 for default flags. A span to write the context to.

Informs the data reader that the user has requested all data be flushed.

Provides auxillary information about a coredump or Windows minidump. This interface is not used by the ClrMD library itself, but is here to provide extra information and functionality to some tools consuming ClrMD. You do not need to implement this interface when implementing IDataReader unless you are handing it to a tool which requires it. This inteface must always be requested and not assumed to be there: IDataReader reader = ...; if (reader is IDumpInfoProvider dumpInfoProvider) ...

Returns whether the dump is a mini or triage dump (that is, full heap information was explicitly NOT placed into the dump).

Gets the size of a pointer in the target process.

The pointer size of the target process.

Read memory out of the target process.

The address of memory to read. The buffer to write to. The number of bytes read into the buffer.

Read an unmanaged value from the given address.

The type to read. This may be a struct or primitive type as long as it does not managed pointers. The address to read from. The value that was read. True if the memory was present, false otherwise.

Read an unmanaged value from the given address. Returns default(T) if the data was not readable.

The type to read. This may be a struct or primitive type as long as it does not managed pointers. The address to read from. The value at addr, or default(T) if not present in the data target.

Reads a pointer at the given address.

The address to read from. A pointer sized value that was read. True if the value was read, false if the value could not be read.

Read a pointer out of the target process.

The pointer at the give address, or 0 if that pointer doesn't exist in the data target.

This interface is implemented by all ClrMD provided implementations of . This interface is not used by the ClrMD library itself, but is here to maintain functionality for previous uses of these functions in ClrMD 1.1's . This inteface must always be requested and not assumed to be there: IDataReader reader = ...; if (reader is IThreadReader threadReader) ...

Enumerates the thread ids of all live threads in the target process.

Obtains the Windows specific Thread Execution Block.

ARM-specific thread context.

Float in X86-specific windows thread context.

Gets or sets optional name override

Gets register type and flags

X86-specific windows thread context.

Returns the "flavor" of CLR this module represents.

This is the full version of CLR included with windows.

For .NET Core

Represents information about a single CLR in a process.

Gets the version number of this runtime.

Returns whether this CLR was built as a single file executable.

Gets the type of CLR this module represents.

A list of debugging libraries associated associated with this .Net runtime. This can contain both the dac (used by ClrMD) and the DBI (not used by ClrMD).

Gets module information about the ClrInstance.

The timestamp under which this CLR is is archived (0 if this module is indexed under a BuildId instead). Note that this may be a different value from ModuleInfo.IndexTimeStamp. In a single-file scenario, the ModuleInfo will be the info of the program's main executable and not CLR's properties.

The filesize under which this CLR is is archived (0 if this module is indexed under a BuildId instead). Note that this may be a different value from ModuleInfo.IndexFileSize. In a single-file scenario, the ModuleInfo will be the info of the program's main executable and not CLR's properties.

The BuildId under which this CLR is archived. BuildId.IsEmptyOrDefault will be true if this runtime is archived under file/timesize instead.

To string.

A version string for this CLR.

Creates a runtime from the given DAC file on disk.

A full path to the matching DAC dll for this process. Whether or not to ignore mismatches between.

A user-defined data reader. Note that this class will be kept alive by until is called.

The data reader that ClrMD will use to read data from the target.

An optional set of cache options. Returning null from this property will use ClrMD's default cache options.

An optional file locator. Returning null from this property will use ClrMD's file binary locator, which uses either (if non null) or the _NT_SYMBOL_PATH (if is null) environment variable to search for missing binaries.

If is null, this path will be used as the symbol path for the default binary locator. This property has no effect if is non-null.

Constructor.

A non-null IDataReader.

Dispose method. Called when is called.

Dispose implementation. The default implementation will call Dispose() on DataReader if it implements IDisposable.

A crash dump or live process to read out of.

Gets the data reader for this instance.

The caching options for ClrMD. This controls what kinds of memory we cache and what values have to be recalculated on every call.

Gets or sets instance to manage the symbol path(s).

Creates a DataTarget from the given reader.

The custom data target to use.

Gets the list of CLR versions loaded into the process.

Enumerates information about the loaded modules in the process (both managed and unmanaged).

Gets a set of helper functions that are consistently implemented across all platforms.

Loads a dump stream. Currently supported formats are ELF coredump and Windows Minidump formats.

The name of this DataTarget, might be used in exceptions. The stream that should be used. The caching options to use. (Only used for FileStreams) True whenever the given stream should be leaved open when the DataTarget is disposed. A for the given dump.

Loads a dump file. Currently supported formats are ELF coredump and Windows Minidump formats.

The path to the dump file. The caching options to use. A for the given dump file.

Attaches to a running process. Note that if is set to false the user of ClrMD is still responsible for suspending the process itself. ClrMD does NOT support inspecting a running process and will produce undefined behavior when attempting to do so.

The ID of the process to attach to. Whether or not to suspend the process. A instance.

Creates a snapshot of a running process and attaches to it. This method will pause a running process

The ID of the process to attach to. A instance. The process specified by is not running. The current platform is not Windows.

Creates a DataTarget from an IDebugClient interface. This allows callers to interop with the DbgEng debugger (cdb.exe, windbg.exe, dbgeng.dll).

An IDebugClient interface. A instance.

This class provides information about CLR debugging artifacts.

The kind of debugging library this is.

Gets the platform specific filename of the debugging library. This may be a full path on disk if we find that this machine has the file locally.

Gets the architecture of this debugging library.

Returns what properties that this dac library is archived under.

Gets the specific file size of the image used to index it on the symbol server.

Gets the timestamp of the image used to index it on the symbol server.

The BuildId that this library is indexed under (or IsEmptyOrDefault otherwise).

The platform that this library was designed to run on.

Gets the field value from with respect to field nature (either reference, or value type).

The entity to read field value from. The name of the field to get value. if entity has no type. Thrown when field with matching name was not found.

A public extension methods to support searching an IMemoryReader for a given span.

Searches memory from startAddress to endAddress, looking for the memory specified by `searchFor`. Note that this is NOT meant to be used to search the entire address space. This method will attempt to read all memory from startAddress to endAddress, so providing very large ranges of memory will make this take a long time.

The memory reader to search through. The address to start searching memory. The length of memory to search. The memory to search for. The address of the value if found, 0 if not found.

Create an "empty" ClrAppDomain when we cannot request app domain details.

The containing runtime. Helpers for querying data The address of the AppDomain

This represents a ClrType for which we cannot get information from the dac. In theory we shouldn't need this type, but in practice there are fields which do not report a type. This allows us to provide a non-null, semi meaningful type even though it's not as accurate or specific as we wish it would be.

Gets the corresponding to the given MethodTable.

The ClrType.MethodTable for the requested type. A ClrType object, or if no such type exists.

Flushes the DAC cache. This function must be called any time you expect to call the same function but expect different results. For example, after walking the heap, you need to call Flush before attempting to walk the heap again.

A base file locator, each method only builds the key under which a file is located.

Gets the name for a type.

The MethodTable to request the name of. The name for that type, note that this has already had FixGenerics called on it. True if the value should be cached, false if the value should not be cached. (This is controlled by the user's string cache settings.

A helper to implement for PEImages.

A helper class to read linux coredumps.

All coredumps are themselves ELF files. This property returns the ElfFile that represents this coredump.

Enumerates all prstatus notes contained within this coredump.

Returns the Auxv value of the given type.

A mapping of all loaded images in the process. The key is the base address that the module is loaded at.

Creates an ElfCoreFile from a file on disk.

A full path to a coredump on disk. Throws if the file is not an Elf coredump.

Creates an ElfCoreFile from a file on disk.

The Elf stream to read the coredump from. Whether to leave the given stream open after this class is disposed. Throws if the file is not an Elf coredump.

Reads memory from the given coredump's virtual address space.

An address in the target program's virtual address space. The buffer to fill. The number of bytes written into the buffer.

A helper class to read ELF files.

The ElfHeader of this file.

The list of ElfNotes for this file.

The list of ProgramHeaders for this file.

Returns the address of a module export symbol if found

symbol name (without the module name prepended) symbol offset returned true if found

The ELFDynamicSection for this file, if it exists.

Returns the build id of this ELF module (or ImmutableArray.Default if it doesn't exist).

Creates an ElfFile from a file on disk.

A full path of an elf file on disk. Throws if the file is not an Elf coredump.

Creates an ElfFile from a file on disk.

The Elf stream to read the Elf file from. Whether to leave the given stream open after this class is disposed. Throws if the file is not an Elf file.

Creates an ElfFile from a file on disk.

The Elf stream to read the Elf file from. Base position of streawm Whether to leave the given stream open after this class is disposed. Whether stream points to a ELF image mapped into an address space (such as in a live process or crash dump). Throws if the file is not an Elf file.

A representation of an ELF loaded image section.

The BaseAddress of this image

The size of this image in memory.

Open the loaded image as an ELFFile.

An ELFFile if this is a valid ELF image, null otherwise.

Returns this ELF loaded image as a stream.

Returns .

A helper class to represent an ELF note section.

The content size of the data stored within this note.

The type of note this is.

The note's name.

Reads the contents of this note file.

The position within the note to read from. The buffer to read the note into. The number of bytes read written to buffer.

Reads the contents of this note file.

The position within the note to read from. If the data could not be read. The data at the given position.

A helper class to represent ELF program headers.

The type of header this is.

The VirtualAddress of this header.

The size of this header.

The offset of this header within the file.

The size of this header within the file.

Whether this section of memory is executable.

Whether this section of memory is writable.

An abstract version of 32 and 64 bit ELF headers.

Whether this file is 64 bit or not.

Whether this file contains the magic header at the right offset or not.

The type of ELF file.

The architecture of the ELF file.

The offset of the program header.

The offset of the section header.

The size of program headers.

The count of program headers.

The size of section headers.

The count of section headers.

The section header string index.

An abstraction of the ELF PRStatus view.

The process id associated with this prstatus

The thread id of this prstatus.

Copies the registers within this prstatus into the Windows _CONTEXT structure for the specified architecture.

A span to copy the context into. This should generally be one of the predefined *Context structs, e.g. . True if the registers were copied to the context, false otherwise. Usually a return value of false means that was too small.

A data reader that targets a Linux process. The current process must have ptrace access to the target process.

The type of ELF file.

The ELF machine type

The kind of ELF note.

The type of program header.

A class that allows you to build a custom IUnknown based interface to pass as a COM object. This class is public to allow others to use this code and not duplicate it, but it is not intended for general use.

Gets the IUnknown pointer to this object.

Gets the IUnknown VTable for this object.

Constructor.

AddRef.

The new ref count.

Release.

The new RefCount.

Adds an IUnknown based interface to this COM object.

The GUID of this interface. Whether or not to validate the delegates that used to build this COM interface's methods. A VTableBuilder to construct this interface. Note that until VTableBuilder.Complete is called, the interface will not be registered.

Base class for COM related objects in ClrMD.

Release an IUnknown pointer.

A pointer to the IUnknown interface to release. The result of pUnk->Release().

Helper to convert to int for comparisons.

This makes "if (hr)" equivalent to SUCCEEDED(hr).

The basic VTable for an IUnknown interface.

Builds an individual VTable for a COM object.

Adds a method to be the next function in the VTable.

Whether to validate the delegate matches requirements. The function to add to the next slot of the VTable.

Completes the VTable, registering its GUID with the associated COMCallableIUnknown's QueryInterface method. Note that if this method is not called, then the COM interface will NOT be registered.

A pointer to the interface built. This pointer has not been AddRef'ed.

Command represents a running of a command lineNumber process. It is basically a wrapper over System.Diagnostics.Process, which hides the complexity of System.Diagnostics.Process, and knows how to capture output and otherwise makes calling commands very easy.

Gets the time the process started.

Gets a value indicating whether the process has exited.

Gets the time the processed Exited. (HasExited should be before calling)

Gets the duration of the command (HasExited should be before calling)

Gets the operating system ID for the subprocess.

Gets the process exit code for the subprocess. (HasExited should be before calling) Often this does not need to be checked because Command.Run will throw an exception if it is not zero. However it is useful if the CommandOptions.NoThrow property was set.

Gets the standard output and standard error output from the command. This is accumulated in real time so it can vary if the process is still running. This property is NOT available if the CommandOptions.OutputFile or CommandOptions.OutputStream is specified since the output is being redirected there. If a large amount of output is expected (> 1Meg), the Run.AddOutputStream(Stream) is recommended for retrieving it since the large string is never materialized at one time.

Gets that CommandOptions structure that holds all the options that affect the running of the command (like Timeout, Input ...)

Run 'commandLine' as a subprocess and waits for the command to complete. Output is captured and placed in the 'Output' property of the returned Command structure.

The command lineNumber to run as a subprocess Additional qualifiers that control how the process is run A Command structure that can be queried to determine ExitCode, Output, etc.

Launch a new command and returns the Command object that can be used to monitor the result. It does not wait for the command to complete, however you can call 'Wait' to do that, or use the 'Run' or 'RunToConsole' methods. */

The command lineNumber to run as a subprocess Additional qualifiers that control how the process is run A Command structure that can be queried to determine ExitCode, Output, etc.

Create a subprocess to run 'commandLine' with no special options. The command lineNumber to run as a subprocess

Wait for a started process to complete (HasExited will be on return)

Wait returns that 'this' pointer.

Throw a error if the command exited with a non-zero exit code printing useful diagnostic information along with the thrown message. This is useful when NoThrow is specified, and after post-processing you determine that the command really did fail, and an normal Command.Run failure was the appropriate action.

An additional message to print in the throw.

Gets the underlying process object. Generally not used.

Kill the process (and any child processes (recursively) associated with the running command). Note that it may not be able to kill everything it should if the child-parent' chain is broken by a child that creates a subprocess and then dies itself. This is reasonably uncommon, however.

Put double quotes around 'str' if necessary (handles quotes quotes).

Given a string 'commandExe' look for it on the path the way cmd.exe would. Returns if it was not found.

CommandOptions is a helper class for the Command class. It stores options that affect the behavior of the execution of ETWCommands and is passes as a parameter to the constructor of a Command. It is useful for these options be on a separate class (rather than on Command itself), because it is reasonably common to want to have a set of options passed to several commands, which is not easily possible otherwise.

Can be assigned to the Timeout Property to indicate infinite timeout.

CommanOptions holds a set of options that can be passed to the constructor to the Command Class as well as Command.Run*.

Return a copy an existing set of command options.

The copy of the command options.

Normally commands will throw if the subprocess returns a non-zero exit code. NoThrow suppresses this.

Updates the NoThrow property and returns the updated commandOptions. Updated command options

ShortHand for UseShellExecute and NoWait.

Updates the Start property and returns the updated commandOptions.

Normally commands are launched with CreateProcess. However it is also possible use the Shell Start API. This causes Command to look up the executable differently.

Updates the Start property and returns the updated commandOptions.

Indicates that you want to hide any new window created.

Updates the NoWindow property and returns the updated commandOptions.

Indicates that you want don't want to wait for the command to complete.

Updates the NoWait property and returns the updated commandOptions.

Gets or sets a value indicating whether the command must run at elevated Windows privileges (causes a new command window).

Updates the Elevate property and returns the updated commandOptions.

By default commands have a 10 minute timeout (600,000 msec), If this is inappropriate, the Timeout property can change this. Like all timeouts in .NET, it is in units of milliseconds, and you can use CommandOptions.Infinite to indicate no timeout.

Updates the Timeout property and returns the updated commandOptions. CommandOptions.Infinite can be used for infinite.

Indicates the string will be sent to Console.In for the subprocess.

Updates the Input property and returns the updated commandOptions.

Indicates the current directory the subProcess will have.

Updates the CurrentDirectory property and returns the updated commandOptions.

Indicates the standard output and error of the command should be redirected to a archiveFile rather than being stored in Memory in the 'Output' property of the command.

Updates the OutputFile property and returns the updated commandOptions.

Indicates the standard output and error of the command should be redirected to a a TextWriter rather than being stored in Memory in the 'Output' property of the command.

Updates the OutputStream property and returns the updated commandOptions.

Gets the Environment variables that will be set in the subprocess that differ from current process's environment variables. Any time a string of the form %VAR% is found in a value of a environment variable it is replaced with the value of the environment variable at the time the command is launched. This is useful for example to update the PATH environment variable eg. "%PATH%;someNewPath".

Adds the environment variable with the give value to the set of environment variables to be passed to the sub-process and returns the updated commandOptions. Any time a string of the form %VAR% is found in a value of a environment variable it is replaced with the value of the environment variable at the time the command is launched. This is useful for example to update the PATH environment variable eg. "%PATH%;someNewPath".

FileVersionInfo represents the extended version formation that is optionally placed in the PE file resource area.

Gets the version string

Gets the version of this module

Gets comments to supplement the file version

Each resource data entry describes a leaf node in the resource directory tree. It contains an offset, relative to the beginning of the resource directory of the data for the resource, a size field that gives the number of bytes of data at that offset, a CodePage that should be used when decoding code point values within the resource data. Typically for new applications the code page would be the Unicode code page.

Resource directory consists of two counts, following by a variable length array of directory entries. The first count is the number of entries at beginning of the array that have actual names associated with each entry. The entries are in ascending order, case insensitive strings. The second count is the number of entries that immediately follow the named entries. This second count identifies the number of entries that have 16-bit integer Ids as their name. These entries are also sorted in ascending order. This structure allows fast lookup by either name or number, but for any given resource entry only one form of lookup is supported, not both.

Each directory contains the 32-bit Name of the entry and an offset, relative to the beginning of the resource directory of the data associated with this directory entry. If the name of the entry is an actual text string instead of an integer Id, then the high order bit of the name field is set to one and the low order 31-bits are an offset, relative to the beginning of the resource directory of the string, which is of type IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the low-order 16-bits are the integer Id that identify this resource directory entry. If the directory entry is yet another resource directory (i.e. a subdirectory), then the high order bit of the offset field will be set to indicate this. Otherwise the high bit is clear and the offset field points to a resource data entry.

A class to read information out of PE images (dll/exe).

Constructs a PEImage class for a given PE image (dll/exe) in memory.

A Stream that contains a PE image at its 0th offset. This stream must be seekable. Whether or not to leave the stream open, if this is set to false stream will be disposed when this object is. Whether stream points to a PE image mapped into an address space (such as in a live process or crash dump).

Gets the root resource node of this PEImage.

Gets a value indicating whether the given Stream contains a valid DOS header and PE signature.

Gets a value indicating whether this image is for a 64bit processor.

Gets a value indicating whether this image is managed. (.NET image)

Gets the timestamp that this PE image is indexed under.

Gets the file size that this PE image is indexed under.

Gets a list of PDBs associated with this PE image. PE images can contain multiple PDB entries, but by convention it's usually the last entry that is the most up to date. Unless you need to enumerate all PDBs for some reason, you should use DefaultPdb instead. Undefined behavior if IsValid is .

Gets the PDB information for this module. If this image does not contain PDB info (or that information wasn't included in Stream) this returns . If multiple PDB streams are present, this method returns the last entry.

Allows you to convert between a virtual address to a stream offset for this module.

The address to translate. The position in the stream of the data, -1 if the virtual address doesn't map to any location of the PE image.

Reads data out of PE image into a native buffer.

The address to read from. The location to write the data. The number of bytes actually read from the image and written to dest.

Gets the File Version Information that is stored as a resource in the PE file. (This is what the version tab a file's property page is populated with).

Returns the address of a module export symbol if found

symbol name (without the module name prepended) symbol offset returned true if found

An entry in the resource table.

The maximum number of children nodes that ResourceEntry objects will consider. Note that if a PEImage is corrupted or if we read bad data out of the target then we may misinterpret the data we read and spend a lot of time enumerating bad resources. Setting this to int.MaxValue removes this limitation.

The maximum length ResourceEntry.Name strings we will return. Note that if a PEImage is corrupted or if we read bad data out of the target then we may misinterpret the data we read and spend a lot of time enumerating bad resources. Setting this to int.MaxValue removes this limitation.

Gets the PEImage containing this ResourceEntry.

Gets the parent resource of this ResourceEntry. Null if and only if this is the root node.

Gets resource Name. May be if this is the root node.

Gets a value indicating whether this is a leaf, and contains data.

Gets the size of data for this node.

Gets the number of children this entry contains. Note that ResourceEntry.Children is capped at MaxChildrenCount entries. This property returns the total number of entries as defined by the IMAGE_RESOURCE_DIRECTORY. That means this number may be larger than Children.Count.

Returns the given resource child by name.

The name of the child to return. The child in question, or if none are found with that name.

The data associated with this entry.

A byte array of the data, or a byte[] of length 0 if this entry contains no data.

A convenience function to get structured data out of this entry.

A struct type to convert. The offset into the data. The struct that was read out of the data section.

Gets the children resources of this ResourceEntry.

A set of helper functions that are consistently implemented across platforms.

The path to the native library to be loaded. The native library OS handle to be freed. The native library OS handle. The name of the exported symbol.

Represents heap segment cache entries backed by arrays from ArrayPool{byte}.Shared. This technology is less efficient than the but it has upsides around not requiring special privileges and mapping in a more granular fashion (4k pages vs 64k pages).

Represents heap segment cache entries backed by AWE (Address Windowing Extensions). This technology allows us to read the entirety of the heap data out of the dump (which is very fast disk access wise) up front, keep it in physical memory, but only maps those physical memory pages into our VM space as needed, allowing us to control how much memory we use and making 'mapping in' very fast(some page table entry work in Windows instead of physically reading the data off of disk). The downside is it requires the user have special privileges as well as it maps data in 64k chunks(the VirtualAlloc allocation granularity).

This class acts as the base of the two (ArrayPool and AWE) cache entry types.

The type of data the cache pages hold

Indicates the cache should operate using the ArrayPool to managed byte[] of memory from the dump heap.

Indicates the cache should operate using AWE (Address Windowing Extensions) to manage memory from the dump heap

NOTE: This option is ONLY possible if the user has the 'Lock Pages in Memory' permission, otherwise we will fall back on using

The event ID for when the cache starts paging in data.

The event ID for when the cache failed while paging in data.

The event ID for when the cache completes paging in data.

The event ID for when the cache starts paging out data.

The event ID for when the cache finishes paging out data.

Names of constants in this class make up the middle term in the event name E.g.: HeapSegmentCacheProvider/PageInData/Start.

Name of this class is important for EventSource.

Tags describing the event result

Name of this class is important for EventSource.