正在获取系统的RCW值。\uuuu windbg脚本中的ComObject

我正在尝试编写一个Windbg脚本，其中一个文件中有1k个地址。 对于每个地址，偏移量

0x30

处是一个COM对象

我想从COM对象获取所有本机指针。我知道如何像下面这样手动操作。我在脚本中迭代它时遇到了麻烦

来自

系统。uu ComObject

，

！do

在文本中给出

RCW:in

。使用

卸载
RCW
！DumpRCW

提供我所需的

IUnknown指针

Name:        System.__ComObject
MethodTable: 00007ffcf2941330
EEClass:     00007ffcf22264b0
RCW:         000001d3634f3460
Size:        32(0x20) bytes
File:        C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
Fields:
              MT    Field   Offset                 Type VT     Attr            Value Name
00007ffcf2949de8  40005b2        8        System.Object  0 instance 0000000000000000 __identity
00007ffcf294d1f8  400045c       10 ...ections.Hashtable  0 instance 0000000000000000 m_ObjectToDataMap

0:000> !DumpRCW /d 000001d35a9e0d70
Managed object:             000001d37976a708
Creating thread:            000001d35d552a60
IUnknown pointer:           000001d31e63ce28
COM Context:                000001dffecab0f8
Managed ref count:          1
IUnknown V-table pointer :  00007ffcd3f0edb8 (captured at RCW creation time)
Flags:                      
COM interface pointers:
              IP          Context               MT Type
000001d31e63ce20 000001dffecab0f8 00007ffc949869c0 NativeClass.ClassX
000001d31e63ce28 000001dffecab0f8 00007ffc949868e0 NativeClass.ClassX

对于脚本，问题是：

如何使用脚本从
ComObject
获取
RCW
值？
System.\uu ComObject
中的字段为空

到目前为止，我拥有的脚本：

0:000> .foreach /f ( obj "d:\windbg\debug1.allmanagedtxs.small.txt") { .printf "%p\n", obj; !do poi(${obj}+0x30) }
000001d378daa6d8
Name:        System.__ComObject
MethodTable: 00007ffcf2941330
EEClass:     00007ffcf22264b0
RCW:         000001d3634f3460
Size:        32(0x20) bytes
File:        C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
Fields:
              MT    Field   Offset                 Type VT     Attr            Value Name
00007ffcf2949de8  40005b2        8        System.Object  0 instance 0000000000000000 __identity
00007ffcf294d1f8  400045c       10 ...ections.Hashtable  0 instance 0000000000000000 m_ObjectToDataMap
000001d37976a728
Name:        System.__ComObject
MethodTable: 00007ffcf2941330
EEClass:     00007ffcf22264b0
RCW:         000001d35a9e0d70
Size:        32(0x20) bytes
File:        C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
Fields:
              MT    Field   Offset                 Type VT     Attr            Value Name
00007ffcf2949de8  40005b2        8        System.Object  0 instance 0000000000000000 __identity
00007ffcf294d1f8  400045c       10 ...ections.Hashtable  0 instance 0000000000000000 m_ObjectToDataMap

我讨厌解析字符串：），但这里有一个解析字符串的方法
它在一个实时会话上，使其适应从文件解析

/// <reference path="JSProvider.d.ts" />
function log(x) {
    host.diagnostics.debugLog(x + "\n")
}
function exec(cmdstr) {
    return host.namespace.Debugger.Utility.Control.ExecuteCommand(cmdstr);
}
function rcw(first) {
    var obs = exec("!DumpHeap -short -type System.__ComObject")
    for (i of obs) {
        var cstr = "!do -nofields " + i
        foo = exec(cstr)
        for (j of foo) {
            if (j.includes("RCW") == true) {
                blah = exec("!DumpRCW " + j.substr(j.lastIndexOf(" ") + 1))
                for (k of blah) {
                    if (k.includes("IUnknown pointer") == true) {
                        log(k)
                    }
                }
            }
        }
    }
}

实际点击点击注意3bf0

0:007> !DumpHeap -short -type System.__ComObject
00000227dc23b218
00000227dc23f620
00000227dc23f640
00000227dc25e7d0
00000227dc25faa0
00000227dc25fac0
0:007> !DumpObj /d 00000227dc23b218
Name:        System.__ComObject
MethodTable: 00007ffda24adad8
EEClass:     00007ffda2492608
RCW:         00000227da7450e0
Size:        32(0x20) bytes
File:        C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
Fields:
              MT    Field   Offset                 Type VT     Attr            Value Name
00007ffda2518948  40005b8        8        System.Object  0 instance 0000000000000000 __identity
00007ffda251bb18  4000462       10 ...ections.Hashtable  0 instance 0000000000000000 m_ObjectToDataMap
0:007> !DumpRCW /d 00000227da7450e0
Managed object:             00000227dc23b218
Creating thread:            00000227da6e30b0
IUnknown pointer:           00000227da903bf0
COM Context:                00000227da72c668
Managed ref count:          1
IUnknown V-table pointer :  00007ffdc3252190 (captured at RCW creation time)
Flags:                      
COM interface pointers:
              IP          Context               MT Type
00000227da903bf0 00000227da72c668 00007ffd4a1b5c88 TestDispatchUtility.DispatchUtility+IDispatchInfo

顺便说一句，使用的二进制文件来自
我还发现了
！sosex.rcw
。。但是这更好，因为我现在可以添加更多的自动化来转储本机中的对象：）我在所有RCW中查找的ref count为1的本机COM对象在任何RCW中都不存在。这是否意味着托管c#已经释放了COM对象？可能有其他人拥有本机COM对象的句柄。
0:007> !DumpHeap -short -type System.__ComObject
00000227dc23b218
00000227dc23f620
00000227dc23f640
00000227dc25e7d0
00000227dc25faa0
00000227dc25fac0
0:007> !DumpObj /d 00000227dc23b218
Name:        System.__ComObject
MethodTable: 00007ffda24adad8
EEClass:     00007ffda2492608
RCW:         00000227da7450e0
Size:        32(0x20) bytes
File:        C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
Fields:
              MT    Field   Offset                 Type VT     Attr            Value Name
00007ffda2518948  40005b8        8        System.Object  0 instance 0000000000000000 __identity
00007ffda251bb18  4000462       10 ...ections.Hashtable  0 instance 0000000000000000 m_ObjectToDataMap
0:007> !DumpRCW /d 00000227da7450e0
Managed object:             00000227dc23b218
Creating thread:            00000227da6e30b0
IUnknown pointer:           00000227da903bf0
COM Context:                00000227da72c668
Managed ref count:          1
IUnknown V-table pointer :  00007ffdc3252190 (captured at RCW creation time)
Flags:                      
COM interface pointers:
              IP          Context               MT Type
00000227da903bf0 00000227da72c668 00007ffd4a1b5c88 TestDispatchUtility.DispatchUtility+IDispatchInfo