Analyze dump file using WinDbg with SOS: How do I get the urls of all currently executing requests?

Question

I have a dump file from a w3c process that I need to analyze.
According to a "!DumpHeap -type HttpRequest", there are currently some three thousand active connections to the server.
The question is if it is possible to get the requested URLs of these connections? I would really like to avoid doing a !do for each object to find the reference of the "url" property..

Answer 1

.foreach (object {!DumpHeap -type System.Web.HttpRequest -short}) { !do ${object} }

This will dump every HttpRequest. The URL is a bit deeper down. First you have to find the offset of the _url property:

              MT    Field   Offset                 Type VT     Attr            Value Name
000007feedc1cc70  4000d7d       90           System.Uri  0 instance 00000000025f2020 _url

In this case (64 bit) it's at offset 0x90. To dump all the Uri objects, replace the !do ${object} by !do poi(${object}+90). But still this is not the URL, so let's see:

              MT    Field   Offset                 Type VT     Attr            Value Name
000007feeeaa68f0  400161c        8        System.String  0 instance 00000000025f1e18 m_String
000007feeeaa68f0  400161d       10        System.String  0 instance 0000000000000000 m_originalUnicodeString

At offset 0x8, the URI has a string and at 0x10 another string. Again we add the offset, so exchange !do poi(${object}+90) by !do poi(poi(${object}+90)+8) (or +10). This will print the .NET string object with all fields. If you want the pure string, do it once again:

              MT    Field   Offset                 Type VT     Attr            Value Name
000007feeeaab318  4000104        c          System.Char  1 instance               68 m_firstChar

This time we're not using !do any more, because we're on raw bits and bytes and dump a unicode string with du poi(poi(${object}+90)+8)+c. The total command for all HttpRequests is then:

.foreach (object {!DumpHeap -type System.Web.HttpRequest -short}) { du poi(poi(${object}+90)+8)+c }

Answer 2

Some variant of the .foreach command, e.g.

.foreach (object {!sos.DumpHeap -type System.String -short}) { !sos.DumpObj object }