Skip to content

krk/cosos

Repository files navigation

CoSoS - Cousin of Son of Strike

A WinDbg extension to visualize 32bit native heap and CLR heap in a similar manner to vmmap.

  • Tested with WinDbg 10.0 x86
  • Does not work with 64bit dumps.
  • Requires SoS extension to be loaded.
  • Works with dump files and live debugging session.

Usage:

  • .load cosos
  • !waitingforobjects - Finds kernel objects that are waited upon by threads.

wfo text output

  • !wfo c:\waitchains\waitchain.dot - Writes wait-chain information to a Graphviz dot file. wfo rendered dot file

  • !gcview shows the heap map in a Qt5.5 window.

gcview Qt window

  • !gcview c:\images\dump-101 saves native heap as dump-101.png and GC heap as dump-101-gc.png

gcview dump-101 gcview dump-101-gc