Is there a tool to allow inspecting .NET objects in a running process?

Question

I was thinking about a tool to inspect objects at runtime, primarily for reverse-engineering and I'm wondering if such a thing exists.

The way I was thinking about it was that you had two views, a graph of objects and a class list. From the class list, you can select a class and see the instances of it, either in a list or in the graph. In the graph, you can see the connections between objects, annotated appropriately, e.g. keys in a hash table could be labels on the edges between the hash table object and the value.

You could also pull up a list of object properties and see/manipulate the values inside. The metadata provided in .NET would make this fairly trivial.

Does anyone know of a tool that can do this? It seems like an immensely useful tool for debugging and reverse-engineering.

Edit: Also, another useful feature would be the ability to set name mappings while looking at a binary. That is, if you have an obfuscated binary, you'd be able to exchange the obfuscated names for placeholders or real names. This wouldn't affect the actual binary, just the view in the inspector.

Edit part 2: The tool should be able to run on Vista and XP and have support for x64.

Answer 1

There is a tool called Crack.NET, specifically for analyzing the managed heap.

http://joshsmithonwpf.wordpress.com/cracknet/

http://www.codeplex.com/cracknetproject

Answer 2

If you have a running process, then you have the binary somewhere on your machine.

You can load this binary in Reflector.

Or if you have Visual Studio installed, you can attach the Visual Studio Debugger to the running process.

Answer 3

There is a program called Hawkeye which can let you look at UI elements in a .NET app.

I have also found a program called .NET Component Inspector I'm not sure how good it is (trying it now).

Answer 4

You could always get a minidump from the application in question and inspect it with WinDBG and SOS.