如何从dump中查找ASP.NET Session的数据【转】

问题简介

ASP.NET应用中, 每一访问者都会单独获得一个Session。在Web应用程序中，当一个用户访问该应用时，Session类型的变量可以供这个用户在该Web应用的所有页面中共享数据；如果另一个用户也同时访问该Web应用，他也拥有自己的Session变量，但两个用户之间无法通过Session变量共享信息.很多时候在生产环境中调试需要从dump中分析session中的特定数据, 我们可以从HttpContext对象上找到与这个请求有关的用户Session.以下是从dump中分析查找session中存储对象的一般步骤。

查找方法

通过ILSPY反编译HttpContext.Current.Session. 发现Session是一个HttSessionState类型的对象, 保存在HttpContext.Items中, Key值为AspSession. 要找到Session对象, 需要先从DUMP中找到HttpContext的Items对象, 并从这个Hashtable中找到AspSession.

1. 加载 sos.dll

.load C:\Windows\Microsoft.NET\Framework64\v2.0.50727\sos.dll

2. 定位到需要关注的线程, 找到当前的HttpContext

0:027> !dso OS Thread Id: 0x2d8c (27) RSP/REG          Object           Name …… 0000001a05fee8d0 00000019043a3328 System.Web.HttpContext ……

3. 首先需要找到items的地址. 在items中找到buckets的地址. 用命令 !da –details <address>将里面的元素列出来, 找到key为"AspSession", 它所保存的value就是Session对象.

0:027> !do 00000019043a3328  Name: System.Web.HttpContext MethodTable: 000007f9e9294ac0 EEClass: 000007f9e8ef2428 Size: 336(0x150) bytes  (C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007f9e92975e8  4000fe6        8 ...IHttpAsyncHandler  0 instance 0000000000000000 _asyncAppHandler 000007f9e9297118  4000fe7       10 ...b.HttpApplication  0 instance 00000019043a66c8 _appInstance 000007f9e9297658  4000fe8       18 ....Web.IHttpHandler  0 instance 000000190441fcd0 _handler 000007f9e9297a98  4000fe9       20 ...m.Web.HttpRequest  0 instance 00000019043a3478 _request 000007f9e9297e18  4000fea       28 ....Web.HttpResponse  0 instance 00000019043a35c8 _response 000007f9e9298330  4000feb       30 ...HttpServerUtility  0 instance 00000018c43e2188 _server 000007fa22e711c0  4000fec       38 ...Collections.Stack  0 instance 0000000000000000 _traceContextStack 000007f9e929d698  4000fed       40 ....Web.TraceContext  0 instance 0000000000000000 _topTraceContext 000007fa22e7f578  4000fee       48 ...ections.Hashtable  0 instance 00000018c43e2450 _items ……..  0:027> !do 00000018c43e2450  Name: System.Collections.Hashtable MethodTable: 000007fa22e7f578 EEClass: 000007fa22a82390 Size: 88(0x58) bytes  (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e7f740  400098d        8 ...ashtable+bucket[]  0 instance 00000018c43e24a8 buckets 000007fa22e7ee90  400098e       38         System.Int32  1 instance                2 count 000007fa22e7ee90  400098f       3c         System.Int32  1 instance                0 occupancy 000007fa22e7ee90  4000990       40         System.Int32  1 instance                7 loadsize 000007fa22e74318  4000991       44        System.Single  1 instance 0.720000 loadFactor   0:027> !da -details 00000018c43e24a8  Name: System.Collections.Hashtable+bucket[] MethodTable: 000007fa22e7f740 EEClass: 000007fa22b214c8 Size: 288(0x120) bytes Array: Rank 1, Number of elements 11, Type VALUETYPE Element Methodtable: 000007fa22e7f8a8 ………….. [5] 00000018c43e2530     Name: System.Collections.Hashtable+bucket     MethodTable 000007fa22e7f8a8     EEClass: 000007fa22b21600     Size: 40(0x28) bytes      (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)     Fields:                   MT    Field   Offset                 Type VT     Attr            Value Name     000007fa22e77510  4000999        0        System.Object  0 instance 00000018c43e2db0 key     000007fa22e77510  400099a        8        System.Object  0 instance 00000018c43e2de0 val     000007fa22e7ee90  400099b       10         System.Int32  1 instance        817416418 hash_coll  0:027> !do 00000018c43e2db0  Name: System.String MethodTable: 000007fa22e77c20 EEClass: 000007fa22a7e550 Size: 46(0x2e) bytes  (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) String: AspSession ……  0:027> !do 00000018c43e2de0  Name: System.Web.SessionState.HttpSessionState MethodTable: 000007f9e9298258 EEClass: 000007f9e8ef3e70 Size: 24(0x18) bytes  (C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007f9e9238018  4001f5e        8 ...IHttpSessionState  0 instance 00000018c43e2d70 _container

4. 直接通过review代码来找到Session内的数据保存在那里有点困难. HttpSessionState的 _container是一个接口类型. 在代码中找到确切的类型会比较花时间.

5. 通过dump, 我们可以看到_container的确切类型是System.Web.SessionState.HttpSessionStateContainer. 所以也就检查该类型的代码, 发生数据是保持在 _sessionItems的对象上.

0:027> !do 00000018c43e2de0  Name: System.Web.SessionState.HttpSessionState MethodTable: 000007f9e9298258 EEClass: 000007f9e8ef3e70 Size: 24(0x18) bytes  (C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007f9e9238018  4001f5e        8 ...IHttpSessionState  0 instance 00000018c43e2d70 _container  0:027> !do 00000018c43e2d70  Name: System.Web.SessionState.HttpSessionStateContainer MethodTable: 000007f9e92a0ea0 EEClass: 000007f9e8ef73b8 Size: 64(0x40) bytes  (C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e77c20  4001f5f        8        System.String  0 instance 0000000000000000 _id 000007f9e9208b28  4001f60       10 ...ateItemCollection  0 instance 00000018c43e2630 _sessionItems 000007f9e92979c8  4001f61       18 ...ObjectsCollection  0 instance 00000018c43e2b80 _staticObjects 000007fa22e7ee90  4001f62       28         System.Int32  1 instance               20 _timeout 000007fa22e76df0  4001f63       34       System.Boolean  1 instance                1 _newSession 000007f9e92a1f00  4001f64       2c         System.Int32  1 instance                1 _cookieMode 000007f9e92a1dd0  4001f65       30         System.Int32  1 instance                1 _mode 000007fa22e76df0  4001f66       35       System.Boolean  1 instance                0 _abandon 000007fa22e76df0  4001f67       36       System.Boolean  1 instance                0 _isReadonly 000007f9e92a0de8  4001f68       20 ...essionStateModule  0 instance 00000019043a7190 _stateModule

6. 按照同样的步骤, _sessionItem的类型为System.Web.SessionState.SessionStateItemCollection. 数据保存在_entriesTable 中, 这里是Session保存数据的地方.

7. 按照代码中找到的结果, 需要从DUMP中列出_entriesTable的元素. 这样就可以检查Session中所保存的数据.

实例代码 :

0:027> !do 00000018c43e2630  Name: System.Web.SessionState.SessionStateItemCollection MethodTable: 000007f9e9208c70 EEClass: 000007f9e8eafd60 Size: 112(0x70) bytes  (C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e76df0  400118f       44       System.Boolean  1 instance                0 _readOnly 000007fa22e7eb08  4001190        8 ...ections.ArrayList  0 instance 00000018c43e29e0 _entriesArray 000007fa22e7ff28  4001191       10 ...IEqualityComparer  0 instance 00000018c436e9e0 _keyComparer 000007fa22e7f578  4001192       18 ...ections.Hashtable  0 instance 00000018c43e2a08 _entriesTable 000007fa22173e60  4001193       20 ...e+NameObjectEntry  0 instance 0000000000000000 _nullKeyEntry  0:027> !do 00000018c43e2a08  Name: System.Collections.Hashtable MethodTable: 000007fa22e7f578 EEClass: 000007fa22a82390 Size: 88(0x58) bytes  (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e7f740  400098d        8 ...ashtable+bucket[]  0 instance 00000018c4423be8 buckets 000007fa22e7ee90  400098e       38         System.Int32  1 instance               10 count 000007fa22e7ee90  400098f       3c         System.Int32  1 instance                4 occupancy 000007fa22e7ee90  4000990       40         System.Int32  1 instance               16 loadsize …..  0:027> !da -details 00000018c4423be8  Name: System.Collections.Hashtable+bucket[] MethodTable: 000007fa22e7f740 EEClass: 000007fa22b214c8 Size: 576(0x240) bytes Array: Rank 1, Number of elements 23, Type VALUETYPE Element Methodtable: 000007fa22e7f8a8  …… [10] 00000018c4423ce8     Name: System.Collections.Hashtable+bucket     MethodTable 000007fa22e7f8a8     EEClass: 000007fa22b21600     Size: 40(0x28) bytes      (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)     Fields:                   MT    Field   Offset                 Type VT     Attr            Value Name     000007fa22e77510  4000999        0        System.Object  0 instance 00000018c44235f0 key     000007fa22e77510  400099a        8        System.Object  0 instance 00000018c4423690 val 000007fa22e7ee90  400099b       10         System.Int32  1 instance       1884180917 hash_coll …….  0:027> !do 00000018c4423690  Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry MethodTable: 000007fa22173e60 EEClass: 000007fa21ee9158 Size: 32(0x20) bytes  (C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e77c20  4001199        8        System.String  0 instance 00000018c44235f0 Key 000007fa22e77510  400119a       10        System.Object  0 instance 00000018c4423650 Value 0:027> !do 00000018c4423690 Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry MethodTable: 000007fa22173e60 EEClass: 000007fa21ee9158 Size: 32(0x20) bytes  (C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e77c20  4001199        8        System.String  0 instance 00000018c44235f0 Key 000007fa22e77510  400119a       10        System.Object  0 instance 00000018c4423650 Value    0:027> !do 00000018c44235f0  Name: System.String MethodTable: 000007fa22e77c20 EEClass: 000007fa22a7e550 Size: 40(0x28) bytes  (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) String: Key : 2    ------------->  测试数据中的Key值 …….   0:027> !do 00000018c4423690 Name: System.Collections.Specialized.NameObjectCollectionBase+NameObjectEntry MethodTable: 000007fa22173e60 EEClass: 000007fa21ee9158 Size: 32(0x20) bytes  (C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll) Fields:               MT    Field   Offset                 Type VT     Attr            Value Name 000007fa22e77c20  4001199        8        System.String  0 instance 00000018c44235f0 Key 000007fa22e77510  400119a       10        System.Object  0 instance 00000018c4423650 Value 0:027> !do 00000018c4423650  Name: System.String MethodTable: 000007fa22e77c20 EEClass: 000007fa22a7e550 Size: 62(0x3e) bytes  (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) String: Here is value :20;    ------------->  测试数据中的Value值 ……..

希望以上内容对您有所帮助