Here are some random notes about specific ICorDebug breaking changes between .NET v1.1 (Everett) and .NET 2.0 (Whidbey). (I came across these as I was cleaning out old documents in preparation for my upcoming move). This would have been more timely 2 years ago, but better late than never. This can be...

Interop-debugging (mixed-mode) is managed + native debugging combined. Well, sort of. Native and managed debugging have very different paradigms. Native debugging tends to own the whole process, while managed debugging tends to require control of the whole process while only exposing a managed view to...

System.Diagnostics.Debugger.Break() is a BCL method that causes a program to issue a User Breakpoint when run under the debugger. This translates to a Break() debug event on ICorDebugManagedCallback. (Not to be confused with Breakpoint(), which corresponds to actual breakpoints. Yeah, we could have given...

When you attach to a managed debuggee (via ICorDebug::DebugActiveProcess), ICorDebug generates a set of fake events designed to bring the debugger up to the current state. The motivation is that it pumps the debugger just as if the debugger was always attached. Native debugging does the same thing. ...

I've gotten some questions about how appdomains are handled at the ICorDebug level. Here's some random trivia (this is kind of like the AppDomain version of the random-ICDThread trivia post I did earlier): Breakpoints : An ICorDebugBreakpoint is AppDomain specific. That means the debugger needs...

Don't assume that if you have a thread doing a spin-wait, that you can attach / asynchronously-break ("async-break") and your debugger will immediately stop at the spin-wait. When you attach to a debuggee or async-break while debugging, the debuggee's threads could be anywhere. Even if you attach...

Detaching a managed-debugger is somewhat complicated at the ICorDebug API level. In a perfectly-friendly API, you could just call "ICorDebugProcess::Detach" and be done with it. With managed-debugging, there are two main constraints and the hresults (in parenthesis) that you'll get for violating them...

V2 CLR added support for 64-bit (amd64 and ia64), and that includes managed-debugging support. So a 64-bit MDbg can debug a 64-bit managed app. But what about cross-platform stuff when your debugger and debuggee are different platforms? Here's how MDbg and managed-debugging work across the 32/64 bit...

I've mentioned func-eval (aka property eval) is evil for end-users; but it's also evil if you want to write a debugger that uses func-eval. For example, let's say you're writing your own managed debugger and you have a watch window, and you want to eval property-getters and ToString() calls on items...

You can discern a lot of information about an API from what appear to be subtle or irrelevant details For example, each ICorDebug object has a logical parent. (See here for a brief explanation of the different ICorDebug interfaces). Here's a chart: ICorDebugProcess ICorDebugThread ICorDebugChain...

VS (and mdbg) expose the $exception pseudo-variable which shows you the most recent exception. (kudos to Shaykatc for mentioning this a year ago). Debugger authors can implement this with: HRESULT ICorDebugThread::GetCurrentException([out] ICorDebugValue **ppExceptionObject) This will return an...

Here's random information about ICorDebugThread that I hope eventually makes it into MSDN: 1. The managed CreateThread callback comes at the first bit of managed code that a thread runs. (I think this is a bad for these reasons , and instead it should come as soon as the CLR knows about the thread)....

ICorDebug has a nicely abstracted "Stepper" object, via ICorDebugStepper (I talked more about that here ). You setup a stepper object (via CreateStepper), resume the process, and then get an aysnchronous "StepComplete" debug event when the stepper is finished. For example, you could setup a StepOut...

I've gotten several questions about debugabbility IL round-tripping. Round-tripping is where you decompile an app (perhaps via ILDasm), potentially edit the IL, and then recompile it (perhaps via ILAsm). This is the backbone for rewriting an assembly, it's what my Inline IL tool does, and I notice Dotfuscator...

The ICorDebug API (the API for debugging managed apps) is about 70 total interfaces. Here is how I'd group the interfaces together, along with my random comments about how various interfaces fit into the big picture. A quick comment about interface versioning: 1. ICorDebug is a COM-classic unmanaged...

Some might consider writing a managed debugger in VB.Net to be an oxymoron . But maybe not. Here's a VB.Net snippet that serves as a highly-specialized debugger to launch an app and print all the modules that get loaded. This is adapted from the C# sample snippet here that does the same thing. Although...

ICorDebug (ICD) is a com-classic interface. In terms of COM threading models , ICorDebug is technically free-threaded (aka, should reside in the "neutral apartment"), which means that it manages its own threading. We go through great pains in the ICD to managed our own synchronization and takes internal...

Within a function, offset 0 into the native code stream corresponds to the very first native instruction in that function. Since the function is ultimately executed via native code (and not via interpreted IL), it's safe to say that native offset 0 corresponds to the very start of the function. When...

We added Just-My-Code (JMC) stepping (the ability to step through just your code and skip code that's not yours) in Whidbey. I blogged a demo from the end-user's perspective here . In response to some email, I wanted to talk a little more about how a debugger can implement JMC from the ICorDebug level...