-
Notifications
You must be signed in to change notification settings - Fork 5k
Class fields missing in NativeAOT-generated PDBs (not visible in IDA or other debuggers) #115283
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Tagging subscribers to this area: @agocke, @MichalStrehovsky, @jkotas |
The problem may be writing the size of the class (LF_CLASS) in the file. CodeViewTypesBuilder.cs Unfortunately, I spent the whole day working on the problem in disassembler and couldn't solve it. |
Indeed. To be more precise, here's where runtime/src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/UserDefinedTypeDescriptor.cs Lines 131 to 136 in 712b3fc
Reading LLVM source, I think we're supposed to put |
Hello.
I'm encountering an issue with the PDBs generated by NativeAOT: while they correctly list all fields of user-defined classes, they often report an incorrect total type size. This inconsistency makes it difficult to analyze memory layout using reverse engineering or debugging tools such as IDA Pro, since such tools rely on accurate type sizes to determine field boundaries and class structure.
Repro scenario
In my project, I have a class like this:
After compiling the app with NativeAOT and inspecting the resulting PDB using IDA Pro, I observe the following:
Type: ClipboardTranslator_Core_ClipboardTranslator_Core_ClipboardHandler_WindowsClipboardMonitor | Index: 19481 | Size: 8
Field: Object
Field: +0020: ClipboardTranslator_Core_Windows_Win32_Foundation_PCWSTR _className
Field: +0028: ClipboardTranslator_Core_Windows_Win32_Foundation_HWND _hwnd
Field: +0008: (S_P_CoreLib_System_Threading_Thread)* _messageLoopThread
Field: +0018: UInt32 _messageLoopThreadId
Field: +001C: Boolean8 _isDisposed
Field: +0030: S_P_CoreLib_System_Threading_CancellationToken _token
Field: +0010: (S_P_CoreLib_System_Func_2<String__S_P_CoreLib_System_Threading_Tasks_Task>)* ClipboardUpdate
From this layout, it's clear the actual type size should be at least 0x38 (56 bytes), not 8. But NativeAOT reports the size as 8.
To confirm that the issue is only with the reported size, I manually patched the corresponding byte in the .pdb file (or in-memory via IDA) to change the reported type size from 0x08 to 0x38.
After doing this, IDA Pro immediately recognizes the full layout, and all fields are displayed correctly, including those beyond the 8-byte boundary.
This confirms that:
This issue does not affect value types (structs). All struct sizes in the same PDB are reported correctly, and their fields are fully visible in IDA without patching.
The text was updated successfully, but these errors were encountered: