rodneyviana / netext

WinDbg extension for data mining managed heap. It also includes commands to list http request, wcf services, WIF tokens among others
http://blogs.msdn.microsoft.com/rodneyviana
Other
224 stars 35 forks source link

!wfrom where clause not filtering as expected. #6

Closed Alois-xx closed 4 years ago

Alois-xx commented 5 years ago

The where clause does never match when I want to filter e.g. for null text strings.

0:000> !wver
Runtime(s) Found: 1
0: Filename: mscordacwks_X86_X86_4.7.3394.00.dll Location: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll
.NET Version: 4.7.3394.0
NetExt (this extension) Version: 2.1.38.5000

String length is not used?

0:000> !wfrom -type syngo.Common.Controls.WinForms.Core.Label where ( text.m_stringLength!=0 ) select text

0 Object(s) listed
2,779 Object(s) skipped by filter

when I change it to !wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text) select text then it will filter out all NULL strings.

But when I try to filter for null strings

!wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text==0) select text
!wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text==null) select text
!wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text==NULL) select text

it will not work. What finally did work was to use the text in quotation marks:

!wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text=="NULL") select text

That is pretty unituitive and is not mentioned as far as I did try to read the help. Apart from that this is an amazing extension.

What I sometimes miss is the ability to filter only live instances. That would be helpful to get true object counts when it matters e.g. if handle wrappers are around and I need the exact handle count.

rodneyviana commented 5 years ago

You are correct. This is counter-intuitive. I will think of something next time I put together a new version.

rodneyviana commented 4 years ago

Now you can use: For NULL strings: !wfrom -type syngo.Common.Controls.WinForms.Core.Label where (!text) select text

For NOT NULL strings: !wfrom -type syngo.Common.Controls.WinForms.Core.Label where (text) select text

Alois-xx commented 4 years ago

Thanks!