Search notes:

DbgShell

DbgShell is a PowerShell front end for the Windows debugger engine (dbgeng.dll).

Clone and compile DbgShell:

PS C:\Users\Rene> git clone https://github.com/microsoft/DbgShell
PS C:\Users\Rene> cd DbgShell
PS C:\Users\Rene\DbgShell> msbuild .\DbgShell.sln -p:Configuration=Release

Start DbgShell executable:

PS C:\Users\Rene\DbgShell> .\bin\Release\x64\DbgShell.exe

Start a process and attach to it to debug it:

Dbg:/> notepad
Dbg:/> get-process notepad | connect-process

In order to start the process with the debuger, Start-DbgProcess can be used. A dump file can be loaded with Mount-DbgDumpFile.

Additional providers and drives

DbgShell comes with an additional provider: Debugger

PS: C:/> get-psProvider debugger

Name       Capabilities    Drives
----       ------------    ------
Debugger   ShouldProcess   {Dbg, procs}

The Dbg: drive has one directory, Process which seems to contain all currently running processes:

PS: C:> ls Dbg:\Process
…

It is unclear what the procs: drive contains as ls procs: results in an error.

The file system provider comes with an additional drive: Bin:.

PS C:\> get-psprovider fileSystem
Name           Capabilities                          Drives
----           ------------                          ------
FileSystem     Filter, ShouldProcess, Credentials    {C, Bin, D}

Log files

Some log files (*.etl) are written to $env:localAppData\temp\DbgProvider (The directory DbgProvider below the temp directory).

Such log files can then later be dumped into a CSV file for analyzing with tracerpt.exe:

PS:/> tracerpt -of CSV C:\Users\Rene\AppData\Local\Temp\DbgProvider\debugTrace_48d8e97fbc9cfa00.etl

Some interesting functions, classes and source files

The function Run in DbgShell\ColorconsoleHost.cs seems to implement the «REPL-loop».

This loop calls m_host.m_ui.ReadLineWithTabCompletion( true ); which returns the line that the user entered.

Commands (such as those destined for the debugging engine) are routed to RunspaceSettings._OnCommandNotFound(…) (DbgProvider\internal\RunspaceSettings.cs).

DbgProvider\Debugger.psm1 defines some PowerShell functions (such as ~x) which are called (initiated?) from _OnCommandNotFound().

Links

https://github.com/microsoft/DbgShell

I found the section A Brief Tour de Source in Contributing.md very helpful.

Index