I frequently need to debug .NET binaries on test machines (by test-machine, I mean that the machine doesn't have Visual Studio installed on it, it's frequently re-imaged, It's not the same machine that I do my development on, etc).
I love the Visual Studio debugger, but it's not practical for me to install visual studios on a freshly imaged test-machine just to debug an assertion or crash (the install takes way too long, the footprint is too large, etc).
I'd really like a quickly installed program that could break into a running process, let me specify the location of symbols/source code, and let me jump right into debugging. For native binaries, windbg works great, but I haven't found anything similiar for managed binaries. Any recommendations?
(as a side note, I am aware of visual studios remote debugging capabilities, but for some reason it never seems to work consistently for me... I often have connection issues)
For a bit nicer interface than MDbg or cordbg take a look at DbgCLR - a cut-down version of the Visual Studio debugger (at least it looks like one) that handles only managed code. It comes with the .NET Framework (I'm not sure if it's in the runtime or if you need the Framework SDK):
- http://msdn.microsoft.com/en-us/library/7zxbks7z(VS.85).aspx
Note that cordbg is deprecated in favor of MDbg (even though MDbg doesn't have all of cordbg's features):
- http://blogs.msdn.com/jmstall/archive/2005/11/07/views_on_cordbg_and_mdbg.aspx
And in looking back at MDbg whle writing this post, I found that there's a GUI wrapper available for MDbg (which I haven't tried):
- http://blogs.msdn.com/jmstall/archive/2005/02/04/367506.aspx
Use dnSpy.
dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available.
It's so wonderful. Very small and lightweight. No installation or configuration needed. Its interface is exactly like Visual Studio. Even its shortcuts are the same as VS.
Features:
Debugger
- Debug .NET Framework, .NET Core and Unity game assemblies, no source code required
- Set breakpoints and step into any assembly
- Locals, watch, autos windows
- Variables windows supports saving variables (eg. decrypted byte arrays) to disk or view them in the hex editor (memory window)
- Object IDs
- Multiple processes can be debugged at the same time
- Break on module load
- Tracepoints and conditional breakpoints
- Export/import breakpoints and tracepoints
- Call stack, threads, modules, processes windows
- Break on thrown exceptions (1st chance)
- Variables windows support evaluating C# / Visual Basic expressions
- Dynamic modules can be debugged (but not dynamic methods due to CLR limitations)
- Output window logs various debugging events, and it shows timestamps by default :)
- Assemblies that decrypt themselves at runtime can be debugged, dnSpy will use the in-memory image. You can also force dnSpy to always use in-memory images instead of disk files.
- Public API, you can write an extension or use the C# Interactive window to control the debugger
Assembly Editor
- All metadata can be edited
- Edit methods and classes in C# or Visual Basic with IntelliSense, no source code required
- Add new methods, classes or members in C# or Visual Basic
- IL editor for low level IL method body editing
- Low level metadata tables can be edited. This uses the hex editor internally.
Hex Editor
- Click on an address in the decompiled code to go to its IL code in the hex editor
- Reverse of above, press F12 in an IL body in the hex editor to go to the decompiled code or other high level representation of the bits. It's great to find out which statement a patch modified.
- Highlights .NET metadata structures and PE structures
- Tooltips shows more info about the selected .NET metadata / PE field
- Go to position, file, RVA
- Go to .NET metadata token, method body, #Blob / #Strings / #US heap offset or #GUID heap index
- Follow references (Ctrl+F12)
Other
- BAML decompiler
- Blue, light and dark themes (and a dark high contrast theme)
- Bookmarks
- C# Interactive window can be used to script dnSpy
- Search assemblies for classes, methods, strings etc
- Analyze class and method usage, find callers etc
- Multiple tabs and tab groups
- References are highlighted, use Tab / Shift+Tab to move to next reference
- Go to entry point and module initializer commands
- Go to metadata token or metadata row commands
- Code tooltips (C# and Visual Basic)
- Export to project