CODEWITHSUNDEEP
c#dll.net-assembly
Drake
Drake

Reputation: 2703

See what method is currently being used from a DLL

I know that I can open a DLL file with an assembly browser, such as ILSpy, to see the classes and methods that it contains. But if a process is currently using a DLL, is it possible to know what method it is currently using? And any other details, such as the exact line that it is on, and if it threw an exception?

This question isn't language specific, but I'm most interested in doing this in C#. And the DLLs are compiled in the .NET framework.

My goal is to build a logger that shows what part of my code a process is using, and if it threw an exception, which function it came from.

Upvotes: 1

Views: 659

Answers (2)

Gilad
Gilad

Reputation: 6575

1.A simple approach will be to add into Main() function 

 AppDomain.CurrentDomain.UnhandledException += CurrentDomain_UnhandledException;


and the handler will be something like

static void CurrentDomain_UnhandledException(object sender, UnhandledExceptionEventArgs e)
{
   string errorMessage = e.ExceptionObject.ToString();
   Logger.Error(e.ExceptionObject.ToString());
   Current.Shutdown(1);
}

2.you can use ProcDump with the flag "-e" to catch unhandled exceptions.

for example myApp.exe:

Procdump -ma -e -w myApp.exe C:\temp\fe.dmp

and then you will need to load some stuff for winDB
1. load the dump file into WinDBG
2. .loadby sos clr in winDBG
3. !printexception

0:005> !printexception 
Exception object: 0000000002becc68 
Exception type:   System.NullReferenceException 
Message:          Object reference not set to an instance of an object. 
InnerException:   <none> 
StackTrace (generated):     
SP               IP               Function     
000000001B94F190 000007FF7E551B74 myApp!myApp.MainForm+...     
000000001B94F220 000007F8010FFD85 mscorlib_ni!System.Threading...     
000000001B94F380 000007F8010FFAE9 mscorlib_ni!System.Threading...     
000000001B94F3B0 000007F8010AC31F mscorlib_ni!System.Threading...     
000000001B94F400 000007F8010AC92A mscorlib_ni!System.Threading... ...


you might need SOSEX extension as well

Upvotes: 1

azog
azog

Reputation: 703

The closest I know how to get to this is to check the callstack of a process. It is easy to do this using ProcessExplorer (get it here: https://technet.microsoft.com/en-gb/sysinternals/bb896653.aspx)

Then:

  1. Open Process Explorer, select the process you need more information about, then right click > Properties...
  2. Select the 'Threads' tab. This will open up the list of all threads for this process.
  3. Select the thread you are interested in then click on 'Stack' This will reveal the list of loaded DLLs and the method called

You should get something like this:

enter image description here

Note that the above would work if PE can resolve symbols. This page provides an example on how to enable symbol resolution in Process Explorer : http://windowsexplored.com/2012/01/31/resolve-symbols-in-process-explorer-monitor-without-installing-the-debugging-tools/

Upvotes: 1

Related Questions