[SOLVED] WinDbg+SOS : How to view the .NET object wrapping the handle?

WinDbg+SOS : How to view the .NET object wrapping the handle?

I have import a dump file from .NET Core process into WinDbg. There is an event handle

0:000> !handle 3760 f
Handle 0000000000003760
  Type          Event
  Attributes    0
  GrantedAccess 0x1f0003:
         Delete,ReadControl,WriteDac,WriteOwner,Synch
         QueryState,ModifyState
  HandleCount   2
  PointerCount  65534
  Name          <none>
  Object specific information
    Event Type Auto Reset
    Event is Waiting

How can I use the SOS extension to analyze this event? To see where it is created in managed code?

Solution

As Event Type is Auto Reset, imho you should look at the instances of AutoResetEvent class. Not sure about Core but in Framework you can take NetExt extension and perform queries to the heap. AutoResetEvent has a private field waitHandle with IntPtr to the handle you observe.

So, after running !windex NexExt query will look like:

!wfrom -type System.Threading.AutoResetEvent where (waitHandle == 0000000000003760)  select $addr(), $tohexstring(waitHandle)

If NetExt doesn't work with Core you can dump all instances on AutoResetEvents into text file like this and then find your event there.

.logopen c:\temp\autoresetevents.txt
.foreach (obj {!dumpheap -type AutoResetEvent -short}) {!do obj}
.logclose

With this approach you'll be able to find managed object that corresponds to the handle. You'll also be able to see the roots with !GCRoot. But you won't be able to see where it is created. You'll need to search around. Or you'll need to use different approach, something with PerfView allocation tracing or maybe some special breakpoints.