WinDbg Scripting - Dump column names from a data table

WinDbg Scripting - Dump column names from a data table

  • Comments 3

Windbg provides a nice scripting mechanism with which we can automate repetitive tasks. It is seldom used and I have found very few people who actually utilize it but it is a great way to automate tasks.

One annoying routine that I regularly used to do is to find the column names of a data table in a memory dump. It is annoying as it is a lot of !dumpobject's :) The column name is stored as a String _columnName in the System.Data.DataColumn object. But first you need to get to it by digging all your way through

DataTable -> columnCollection -> list -> _items

The _items object is a collection of System.Data.DataColumn type. So if you dump the list (!do address -v) you will get the DataColumn objects. The _columnName object under DataColumn is a String that will give you the column name. And of course you will have to repeat it for all the DataColumn objects in the _items list :)

So here is a simple script that automates this task. You just pass the address of the DataTable and it will list out all the column names for you.

It uses the SOS extension so please load it before you execute the script.

$$
$$ Dumps all column names from a DataTable
$$
$$ Written by: Vijay
$$
$$ Run as: $$>a<DumpColumnNames.txt DataTableAddress
$$
$$ Example : $$>a<D:\CaseFiles\DumpColumnNames.txt 0x5a055714
$$

ad /q *

.printf "\n Data Table : ${$arg1} \n";

.foreach (DataColumn {!do poi(poi(poi(${$arg1}+0x18)+0x8)+0x4) -v -short}){
    .printf "     Data Column : ${DataColumn} \t";
    $$    !do poi(${DataColumn}+0x28)
    !dumpfield -field _columnName ${DataColumn} -string
}
.printf "\n";

 

Download the attached zip file and extract the text file or you can even copy the above script to a text file. The script is written for the framework version 1.1.4322.2407. In SOS for the 2.0 framework version the !do address -v command is no longer supported and is replaced by !da address.

Bookmark and Share
Attachment: DumpColumnNames.zip
Leave a Comment
  • Please add 8 and 5 and type the answer here:
  • Post
  • Very interesting, please let me know how can I do to extract XML text from memory to a file?

    Thank you.

    Rene.

  • When I try and use !dumpfield I get "No export dumpfield found." I have the sos extension downloaded, but can't find any reference to dumpfield in the documentation. Is it a feature went away with version 2.0 of the framework like do -v? If so, is there a replacement command you use for similar tasks?

  • it is not working for me, this is what is generating:

    $$>a<DumpColumns.txt 516d3004

    Data Table : 516d3004

        Data Column : Name: Wrong option: -string

        Data Column : System.Object[] Wrong option: -string

        Data Column : MethodTable: Wrong option: -string

        Data Column : 0dac42f4 Wrong option: -string

        Data Column : EEClass: Wrong option: -string

        Data Column : 0d8ada64 Wrong option: -string

        Data Column : Size: Wrong option: -string

        Data Column : 48(0x30) Wrong option: -string

        Data Column : bytes Wrong option: -string

        Data Column : Array: Wrong option: -string

        Data Column : Rank Wrong option: -string

        Data Column : 1, Wrong option: -string

        Data Column : Number Wrong option: -string

        Data Column : of Wrong option: -string

    btw, i have change one line to .foreach (DataColumn {!da poi(poi(poi(${$arg1}+0x18)+0x8)+0x4) }){

Page 1 of 1 (3 items)