是否有工具允许在运行的进程中检查 .NET 对象？
我正在考虑一种在运行时检查对象的工具，主要用于逆向工程，我想知道这样的东西是否存在。
我的想法是你有两个视图，一个对象图和一个类列表。 从类列表中，您可以选择一个类并在列表或图表中查看它的实例。 在图中，您可以看到对象之间的连接，并进行了适当的注释，例如散列表中的键可以是散列表对象和值之间边缘上的标签。
您还可以提取对象属性列表并查看/操作其中的值。 .NET 中提供的元数据将使这变得相当简单。
有谁知道有一个工具可以做到这一点？ 它似乎是一个非常有用的调试和逆向工程工具。
编辑：另外，另一个有用的功能是在查看二进制文件时设置名称映射的能力。 也就是说，如果您有一个混淆的二进制文件，您就可以将混淆的名称替换为占位符或真实名称。 这不会影响实际的二进制文件，只会影响检查器中的视图。
编辑第 2 部分：该工具应该能够在 Vista 和 XP 上运行，并支持 x64。
I was thinking about a tool to inspect objects at runtime, primarily for reverse-engineering and I'm wondering if such a thing exists.
The way I was thinking about it was that you had two views, a graph of objects and a class list. From the class list, you can select a class and see the instances of it, either in a list or in the graph. In the graph, you can see the connections between objects, annotated appropriately, e.g. keys in a hash table could be labels on the edges between the hash table object and the value.
You could also pull up a list of object properties and see/manipulate the values inside. The metadata provided in .NET would make this fairly trivial.
Does anyone know of a tool that can do this? It seems like an immensely useful tool for debugging and reverse-engineering.
Edit: Also, another useful feature would be the ability to set name mappings while looking at a binary. That is, if you have an obfuscated binary, you'd be able to exchange the obfuscated names for placeholders or real names. This wouldn't affect the actual binary, just the view in the inspector.
Edit part 2: The tool should be able to run on Vista and XP and have support for x64.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
有一个工具叫Crack.NET，专门用于分析托管堆。
http://joshsmithonwpf.wordpress.com/cracknet/
http://www.codeplex.com/cracknetproject
There is a tool called Crack.NET, specifically for analyzing the managed heap.
http://joshsmithonwpf.wordpress.com/cracknet/
http://www.codeplex.com/cracknetproject
如果您有一个正在运行的进程，那么您的计算机上的某个位置就有二进制文件。
您可以在 Reflector 中加载此二进制文件。
或者，如果您安装了 Visual Studio，则可以将 Visual Studio 调试器附加到正在运行的进程。
If you have a running process, then you have the binary somewhere on your machine.
You can load this binary in Reflector.
Or if you have Visual Studio installed, you can attach the Visual Studio Debugger to the running process.
有一个名为 Hawkeye 的程序，它可以让您查看 . NET应用程序。
我还找到了一个名为 .NET Component Inspector 的程序，我不确定它有多好（现在尝试）。
There is a program called Hawkeye which can let you look at UI elements in a .NET app.
I have also found a program called .NET Component Inspector I'm not sure how good it is (trying it now).
您始终可以从相关应用程序中获取小型转储，并使用 WinDBG 和 SOS 检查它。
You could always get a minidump from the application in question and inspect it with WinDBG and SOS.