Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is there a tool to allow inspecting .NET objects in a running process?

I was thinking about a tool to inspect objects at runtime, primarily for reverse-engineering and I'm wondering if such a thing exists.

The way I was thinking about it was that you had two views, a graph of objects and a class list. From the class list, you can select a class and see the instances of it, either in a list or in the graph. In the graph, you can see the connections between objects, annotated appropriately, e.g. keys in a hash table could be labels on the edges between the hash table object and the value.

You could also pull up a list of object properties and see/manipulate the values inside. The metadata provided in .NET would make this fairly trivial.

Does anyone know of a tool that can do this? It seems like an immensely useful tool for debugging and reverse-engineering.

Edit: Also, another useful feature would be the ability to set name mappings while looking at a binary. That is, if you have an obfuscated binary, you'd be able to exchange the obfuscated names for placeholders or real names. This wouldn't affect the actual binary, just the view in the inspector.

Edit part 2: The tool should be able to run on Vista and XP and have support for x64.

like image 658
Serafina Brocious Avatar asked Jan 28 '09 00:01

Serafina Brocious


Video Answer


1 Answers

There is a tool called Crack.NET, specifically for analyzing the managed heap.

http://joshsmithonwpf.wordpress.com/cracknet/

http://www.codeplex.com/cracknetproject

like image 144
Christian Klauser Avatar answered Nov 15 '22 07:11

Christian Klauser