Brad Linscott, a teammate of mine since the old times of SIE, came up with a very helpful idea: find an automated way to get the key/value pairs from a Dictionary object.

 

Moreover, Brad has a recipe that teaches how to get the key/value pair from a Dictionary using a manual approach, either using the SOS extension or the commands for native debugging. You can learn from his approach, it’s neat!

 

Thus, the script below implements Brad’s approach using native commands since it requires fewer steps than using SOS.

 

Note: Soon another PowerDbg version that doesn’t use messages sent to the WinDbg window is going to be released! It means more performance and no more problems when changing the window focus when running a script. Anyway, the current approach is still faster than you getting the information from the dump.

 

Not using PowerShell yet? Don’t think you should learn it? So, think about it: John Robbins, a very well known debugging guru has been using PowerShell.

 

Manual Approach Using SOS

1. Dump out the Dictionary object:

          !do 027a2d84 ß this is going to be the argument for our script.

          Name: System.Collections.Generic.Dictionary`2[[System.String, mscorlib],[System.String, mscorlib]]

          MethodTable: 64d48208

          EEClass: 64b0acfc

          Size: 52(0x34) bytes

          GC Generation: 0

           (C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)

          Fields:

                MT   Field  Offset             Type VT     Attr    Value Name

          64d52a88 40009af       4   System.Int32[]  0 instance 027a2f80 buckets

          00000000 40009b0       8          SZARRAY  0 instance 027a2fa8 entries

 

2. Dump the array that is the 'entries' field

          !da 027a2fa8

          Name: System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[System.String, mscorlib]][]

          MethodTable: 64d42008

          EEClass: 64b071a4

          Size: 124(0x7c) bytes

          Array: Rank 1, Number of elements 7, Type VALUETYPE

          Element Methodtable: 64d41fb4

          [0] 027a2fb0

          [1] 027a2fc0

          [2] 027a2fd0

          [3] 027a2fe0

          [4] 027a2ff0

          [5] 027a3000

          [6] 027a3010

 

3. Dump the ValueClass that is each element.

          !dumpvc  64d41fb4 027a2fb0

          Name: System.Collections.Generic.Dictionary`2+Entry[[System.String, mscorlib],[System.String, mscorlib]]

          MethodTable 64d41fb4

          EEClass: 64b0ae40

          Size: 24(0x18) bytes

 (C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)

          Fields:

                MT   Field  Offset            Type VT     Attr    Value Name

          64d52b38 40009ba       8    System.Int32  1 instance 160595251 hashCode

          64d52b38 40009bb       c    System.Int32  1 instance       -1 next

          64d5055c 40009bc       0  System.__Canon  0 instance 027a2a60 key

          64d5055c 40009bd       4  System.__Canon  0 instance 027a2aa8 value

 

4. Finally, dump out each key/value pair

          !do 027a2a60

          Name: System.String

          MethodTable: 64d508ec

          EEClass: 64b0d64c

          Size: 72(0x48) bytes

          GC Generation: 0

 (C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)

          String: 1 really really long string

          Fields:

                MT   Field Offset          Type VT     Attr  Value Name

          64d52b38 4000096      4  System.Int32  1 instance     28 m_arrayLength

          64d52b38 4000097      8  System.Int32  1 instance     27 m_stringLength

          64d515cc 4000098      c   System.Char  1 instance     31 m_firstChar

          64d508ec 4000099     10 System.String  0   shared static Empty

              >> Domain:Value  00535708:027a1198 <<

          64d5151c 400009a     14 System.Char[]  0   shared static WhitespaceChars

              >> Domain:Value  00535708:027a1944 <<

 

          0:003> !do 027a2aa8

          Name: System.String

          MethodTable: 64d508ec

          EEClass: 64b0d64c

          Size: 42(0x2a) bytes

          GC Generation: 0

 (C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)

          String: Hello World1

          Fields:

                MT   Field Offset          Type VT     Attr   Value Name

          64d52b38 4000096      4  System.Int32  1 instance      13 m_arrayLength

          64d52b38 4000097      8  System.Int32  1 instance      12 m_stringLength

          64d515cc 4000098      c   System.Char  1 instance      48 m_firstChar

          64d508ec 4000099     10 System.String  0   shared  static Empty

              >> Domain:Value  00535708:027a1198 <<

          64d5151c 400009a     14 System.Char[]  0   shared  static WhitespaceChars

              >> Domain:Value  00535708:027a1944 <<

 

5. Repeat steps 3 and 4 for each element in the ‘entries’ array.

 

Manual Approach Using Native Commands

If we take the offsets from the output of the SOS commands provided above, we can use Windbg’s dump command (‘d’) to accomplish the same feat in fewer steps.

 

du poi( poi(0x027a2d84+8) +8) +c

027a2a6c  "1 really really long string"

 

du poi( poi(0x027a2d84+8) +c) +c

027a2ab4  "Hello World1"

 

Note that in order to get all the key/value pairs, you would have to do this for each element of the ‘entries’ array.  And unless you investigated the data structure first (either with SOS or by using the ‘d’ command), there’s no way to know how many elements are in that array.  For this Dictionary object, the number of elements is the 2nd DWORD after dumping out the ‘entries’ object.  For this sample, the array contains 7 elements (although the last 3 are NULL and can be discarded).

 

dd poi(0x027a2d84+8) +4 L1

027a2fac  00000007

 

Screenshots:

 

 

 

 

Source code for PowerShellScriptDumpDict.ps1:

 

 

 

########################################################################################################

# Script:      PowerDbgScriptDumpDict

#

# Parameters:  [string] <$dictInstance>

#              Address of the instance of System.Collections.Generic.Dictionary.

#

# Purpose:     Dumps all the key/values from System.Collections.Generic.Dictionary.

#

# Changes History: 04/03/09 - Changed to run with PowerDbg v5.2 and newest.

#

# Brad Linscott

# Roberto Alexis Farah

# All my functions are provided "AS IS" with no warranties, and confer no rights.

########################################################################################################

param(

      [string] $dictInstance = $(throw "Error! You must provide the address of the instance of System.Collections.Generic.Dictionary that you want to dump.")

     )

 

set-psdebug -strict

$ErrorActionPreference = "stop"

trap {"Error message: $_"}

 

# Gets the output of the "dd" command return an array with the 5 DWORDs.

# Note: It stores just 5 addresses. This function is very specific for this script.

#

# Example:

# If the issued command was:

# dd 027a2d84 L4

#

# And the consequent output:

# 027a2d84  64d48208 027a2f80 027a2fa8 027a2df4

#

# We should get an array with five elements that correspond to the addresses above. Then we use this call:

#

# $array = Get-DD-L4()

function Get-DD-L4()

{

    # Initialize array.

    $outArray = @(0, 0, 0, 0, 0)

    $i = 0   # Initialize index counter.

  

    $stringReader = [System.IO.StringReader] $global:g_commandOutput

       

    # Scan the symbols line by line.

    while(($line = $stringReader.ReadLine()) -ne $null)

    {

        if($line -match "((?<address1>(^\w+))\s+(?<address2>(\w+))\s+(?<address3>(\w+))\s+(?<address4>(\w+))\s+(?<address5>(\w+)))")

        {

            $outArray[$i++] = $matches["address1"]

            $outArray[$i++] = $matches["address2"]          

            $outArray[$i++] = $matches["address3"]

            $outArray[$i++] = $matches["address4"]                     

            $outArray[$i]   = $matches["address5"]                                 

        }  

    } 

 

    return $outArray

}

 

write-Host "Getting all keys/value pairs for object instance " -foreground Green -background Black -nonewline

write-Host $dictInstance                                       -foreground Red -background Black -nonewline

write-Host " ..."                                              -foreground Green -background Black

 

Send-PowerDbgCommand("dd $dictInstance L4")

 

# Get the five DWORDs from the "dd" command output.

$array = Get-DD-L4

 

# Gets the 4th DWORD and dump it to get the number of elements.

$itemsAddress = $array[3]

 

Send-PowerDbgCommand("dd $itemsAddress L4")

 

# Get the five DWORDs from the "dd" command output.

$array = Get-DD-L4

 

# First element is the key, second element is the value and so on.

# The array below is NOT a multidimensional array.

$output       = @($array[3], $array[4])

$startAddress = $array[0]

 

# Whenever we use "dd" we get one key/value pair. So, if we have 8 elements that means 4 keys and 4 values.

# If we use dd four times, shifting 15 bytes each time we'll get 4 lines that have all 8 elements.

for([System.Int32]$i = 0;; $i++)

{  

    # The math below is to get the next address. So our array will have five DWORDs for each loop interation, like:

    # 027a2fa8  64d42008 00000007 027a2a60 027a2aa8

          # 027a2fb8  09927d33 ffffffff 027a2ad4 027a2b1c

          # 027a2fc8  496ed5f7 ffffffff 027a2b48 027a2b90

    $factor = 16 * ($i + 1)   

 

    Send-PowerDbgCommand("dd $startAddress + 0n$factor L4")

   

    # Get the five DWORDs from the "dd" command output.

    $array = Get-DD-L4

    

    # Exit loop when element is NULL.

    if($array[3] -eq "00000000")

    {

        break   # Exit loop. No more elements.

    }

   

    $output = $output + $array[3]   # Save key.     

    $output = $output + $array[4]   # Save value.

}

 

write-Host "Done!" -foreground Green -background Black

 

# At this point we have our array with keys and values, however, they're just addresses.

# Now let's display the output in string format. So, we have to loop through all key/value pairs.

for($i = 0; $i -lt ($output.Length / 2); $i++ )

{

    write-Host "`n==========================================================" -foreground Green -background Black

    write-Host "Key:" -foreground Green -background Black

   

    # Remember, the array is unidimensional. The first element is the key, the second is the value and so on...

    $index = $i * 2

   

    $value = $output[$index]  # This is to avoid problems when sending the command to the debugger.

   

    # Gets the string that starts at offset 0xC.

    Send-PowerDbgCommand "du $value + 0xc"

  

    # Displays the string. We get the output from the command directly from the file.

    # The file has always the command output :)

    write-host $global:g_commandOutput  -foreground Red -background Black

 

    write-Host "`nValue:" -foreground Green -background Black

 

    $value = $output[$index + 1]  # This is to avoid problems when sending the command to the debugger.

   

    # Gets the string that starts at offset 0xC.

    Send-PowerDbgCommand "du $value + 0xc"

  

    # Displays the string. We get the output from the command directly from the file.

    # The file has always the command output :)

    write-host $global:g_commandOutput  -foreground Red -background Black

}

 

# Notifies user. The user is probably looking at the WinDbg window.

Send-PowerDbgComment "PowerDbgScriptDumpDict was executed! See the PowerShell window to get the results."