Getting handles data with MiniDump (DbgHelp.h)

Question

I am struggling with getting handles information via Minidump (DbgHelp.h).

I am getting a list of MINIDUMP_HANDLE_DESCRIPTOR_2 from mapped file stream.. Then I am getting for each descriptor a MINIDUMP_HANDLE_OBJECT_INFORMATION by using the ObjectInfoRva field.

However I cannot understand what information this MINIDUMP_HANDLE_OBJECT_INFORMATION structure gives me, I couldn't find any examples on the web for extracting a meaningful information from the MINIDUMP_HANDLE_OBJECT_INFORMATION, and the documentation is not very helpful.

How can I use MINIDUMP_HANDLE_OBJECT_INFORMATION structure data to get a a human readable data? I mean what do I need to do with it? I always get 0 at InfoType filed which means - MiniHandleObjectInformationNone.

MINIDUMP_HANDLE_OBJECT_INFORMATION struct:

public struct MINIDUMP_HANDLE_OBJECT_INFORMATION
{
    public uint NextInfoRva;
    public MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE InfoType;
    public UInt32 SizeOfInfo;
}

I've done some experiment with MINIDUMP_HANDLE_OBJECT_INFORMATION struct

When I am getting the struct, I am capable of reading a string from the RVA address with SizeOfInfo size. Here I am allays getting 'Directory' as a string on all the handles descriptors that I got...

link to doc:

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680375(v=vs.85).aspx

Any help will be appreciated :)

My process, on which I am trying to apply it, uses WaitForMultipleObjects and WaitForSingleObject Kernel32 calls.

Link to my implementation:

https://github.com/Pavel-Durov/Multithreading-Debugging-Asignments/blob/master/Assignments/Assignments.Core/Handlers/MiniDumpHandler.cs

Link to WinDbg !handle command output which I execute on the same dump file: https://docs.google.com/document/d/1Hjid-2dcM0aZrg5A1p5VrCBSysU_VQhynXdBAvXV29Q/edit?usp=sharing

Maybe the issue is that I don't set a valid values for my MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE enumeration, does anyone familiar with a reliable source with this enum values declaration? I didn't found anything official.

Just to make it clear.

In WinDbj, I get the same information as I get from the MINIDUMP_HANDLE_DESCRIPTOR_2, For instance if WinDbg !handle command has this output:

Handle 00000004
  Type                   Directory
Handle 00000008
  Type                   Directory
Handle 0000000c
  Type                   Event
Handle 00000010
  Type                   Event
Handle 00000014
  Type                   File
…

I can getthe same data from the MINIDUMP_HANDLE_DESCRIPTOR_2 ObjectName and TypeName which are of MINIDUMP_STRING type.

The information that I cannot get is the one located in the MINIDUMP_HANDLE_OBJECT_INFORMATION struct. Which is not visible on the !hanlde command output.

What kind of information suppose to be located in MINIDUMP_HANDLE_OBJECT_INFORMATION ?

The most likely reason is the documented one, you simply don't have any interesting handles in the process. You only get extra info for thread, process and mutex handles. The rest are "no extra info", 0. — Hans Passant, Feb 06 '16 at 15:50
I am collecting this information on a process which waits for multiple mutexes, there is suppose to be some kind of information cause if I am looking at the process with ClrMd I get mutex names... — Pavel Durov, Feb 07 '16 at 07:05
A managed Mutex object has nothing to do with an unmanaged one. This table is for the benefit of a debugger, use the Windbg !handle command to compare. — Hans Passant, Feb 07 '16 at 10:05
I've tested it on Kernel32 calls (updated the question) still, I get MiniHandleObjectInformationNone on each handle info — Pavel Durov, Feb 07 '16 at 17:52

score 0 · Accepted Answer · answered Mar 15 '16 at 07:33

After a couple of rough hours - debugging my managed code and comparing it to C++ code examples - I found my bug with MINIDUMP_HANDLE_OBJECT_INFORMATION struct reading – I didn’t calculated the rva + baseMinidump address appropriately.

Now it works, I am able of getting the additional information the handles :)

Mu code can be found here: https://github.com/Pavel-Durov/Multithreading-Debugging-Asignments/blob/master/Assignments/Assignments.Core/Handlers/MiniDumpHandler.cs

line 144, DealWithHandleInfo function

Getting handles data with MiniDump (DbgHelp.h)

1 Answers1