Find all instances that inherit from base class

Question

In WinDbg, I used !name2ee to find a baseclass's EEClass and MethodTable. How can I find all instances that inherit from that specific type?

Answer 1

I wish there is an easy answer and someone else can solve it easier than this.

Background information

1. dump all objects in a way you can get the addresses from the output: !dumpheap -short

2. loop over all those objects .foreach ( adr {!dumpheap -short}) { ... }

3. The method table will be the first pointer size bytes at the address of the object, so instead of !do <address> to find the method table, you can also do ? poi(<address>).

   !dumpmt does not list the base class, so you need to find it yourself. On 64 bit, the base class is 16 bytes away, so to get the type of a base class from an object address, you can do !dumpmt poi(poi(<address>)+0x10). You can repeat that to get the base-base class: !dumpmt poi(poi(<address>)+0x10)+0x10).

   You can repeat this until the pointer is 0x00000000, which means you have reached System.Object and there is no more base class.

   Since you want to automate this process, you need to put that into a loop as well:

   r$t0 =poi(<address>); .while(@$t0) { .if(@$t0 == <basemt>) {...}; r$t0=poi(@$t0+0x10);}

4. Do whatever you want with the address, e.g. just list it: .echo ${adr} or dump it: !do ${adr}.

5. Put it all together.

Example

Since I don't know what you're looking for, I'll use Exception as an example. And since there's always a StackOverflowException, OutOfMemoryException and ExecutionEngineException in any .NET program, it should at least find three objects if you try it.

0:021> !name2ee *!System.Exception
Module:      000007fef2091000
Assembly:    mscorlib.dll
Token:       0000000002000005
MethodTable: 000007fef2776738
EEClass:     000007fef214d7b0
Name:        System.Exception

So the <basemt> parameter which I'm looking for is 000007fef2776738.

The full statement is now (formatted for readability):

.foreach ( adr {!dumpheap -short}) { 
    r$t0 =poi(${adr}); 
    .while(@$t0) { 
        .if(@$t0 == 000007fef2776738) {!do ${adr}}; 
        r$t0=poi(@$t0+0x10);
    }
}

or (formatted for copy & paste):

.foreach ( adr {!dumpheap -short}) { r$t0 =poi(${adr}); .while(@$t0) { .if(@$t0 == 000007fef2776738) {!do ${adr}}; r$t0=poi(@$t0+0x10);} }