Skip to content

Instantly share code, notes, and snippets.

@rusanu
Created September 21, 2017 14:47
Show Gist options
  • Save rusanu/57ccbf53c38be784f1de1e68c59bb87a to your computer and use it in GitHub Desktop.
Save rusanu/57ccbf53c38be784f1de1e68c59bb87a to your computer and use it in GitHub Desktop.
Windbg script to dump all SqlConnections and last packet sent to server from dump or process
$$ First find the MT of System.Data.SqlClient.SqlInternalConnectionTds
$$
r @$t9=0
.foreach(obj {!dumpheap -mt <MT> -short}) {
r @$t9=@$t9+1
.printf /D "%i <link cmd=\"!do %p\">%p</link> ", @$t9, ${obj}, ${obj}
r @$t0 = poi(${obj}+98)
.printf /D "<link cmd=\"!do %p\">%p</link> ", @$t0, @$t0
r @$t0 = poi(@$t0+8)
.printf /D "<link cmd=\"!do %p\">%p</link> ", @$t0, @$t0
r @$t0 = poi(@$t0+28)
.printf /D "<link cmd=\"!do %p\">%p</link> ", @$t0, @$t0
r @$t1 = @$t0+10
r @$t2 = 0
.if (by(@$t1)==1) {
.printf "BTC"
r @$t2 = 0x18
}
.if (by(@$t1)==3) {
.printf "RPC"
r @$t2 = 0x40
}
.if (by(@$t1)==6) {.printf "ATN"}
.if (by(@$t1)==7) {.printf "BLK"}
.if (by(@$t1)==0n14) {.printf "XMR"}
.if (@$t2!=0) {
r @$t1 = @$t0 + @$t2
.printf " %mu", @$t1
}
.printf "\n"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment