‫از DAC تا cDAC؛ دات‌نت چگونه معماری Debugging داخلی CLR را بازطراحی می‌کند؟

0x000001F3A82C4010

var customer = new Customer();

MethodTable
MethodDesc
Thread
Module
Assembly
AppDomain
LoaderAllocator
LoaderHeap
GCHeap
HeapSegment
SyncBlock
CodeHeap
...

Thread
+0x00 State
+0x10 Id
+0x20 Next
...

Thread
+0x00 State
+0x18 Id
+0x28 Next
...

mscordaccore.dll

Process Memory
      │
      ▼
     DAC
      │
      ▼
CLR concepts

!dumpheap
!clrstack
!dumpobj
!threads
!eeheap
!gcroot

!dumpheap -stat

• GC Heapها کجا هستند؛
• Segmentها کجا قرار گرفته‌اند؛
• Objectها چگونه Layout شده‌اند؛
• MethodTable هر Object چیست.

WinDbg / LLDB / dotnet-dump
           │
           ▼
          SOS
           │
           ▼
          DAC
           │
           ▼
   CLR Process / Dump

using DataTarget target =
    DataTarget.LoadDump("memory.dmp");

ClrRuntime runtime =
    target.ClrVersions[0].CreateRuntime();

foreach (ClrThread thread in runtime.Threads)
{
    Console.WriteLine(thread.ManagedThreadId);
}

Thread
MethodTable
MethodDesc
GCHeap
HeapSegment
LoaderHeap

Runtime 8.0.x build A
        │
        └── DAC build A

Runtime 8.0.x build A
        │
        └── DAC build B

production.dmp

8.0.x
Linux
x64
specific servicing build

Failed to load DAC

• Runtime را خودتان Build کرده باشید؛
• Vendor دیگری Runtime سفارشی داشته باشد؛
• Runtime Patch شده باشد.

در معماری DAC، دانش ساختار داخلی Runtime داخل یک Binary خارجی Build شده است.

Runtime memory

Thread.Id is at offset 16
HeapSegment.Next is at offset 48
pointer size is 8
GC contract version is c1

به‌جای اینکه یک Binary خارجی ساختار Runtime را از قبل بداند، خود Runtime اطلاعات لازم برای تفسیر حافظه‌اش را منتشر کند.

PointerSize = 8

Type Thread:
    Id    -> offset 16
    OSId  -> offset 224
    State -> offset 0

GC Contract:
    version = c1

داده‌های Runtime در حافظه چه شکلی هستند؟

Thread.Id offset = 16
Thread.OSId offset = 224
HeapSegment.Next offset = 80

NumHeaps global exists

GC contract version = c1

• Typeها؛
• Field Offsetها؛
• Size بعضی Typeها؛
• Global Valueها؛
• Sub-descriptorها؛
• Version Contractها

LoaderHeap.FirstBlock offset = 32
LoaderHeapBlock.Next offset = 24

Data Descriptor
      =
What does memory look like?

Algorithmic Contract
      =
How should I interpret it?

DotNetRuntimeContractDescriptor

struct DotNetRuntimeContractDescriptor
{
    uint64_t  magic;
    uint32_t  flags;
    uint32_t  descriptor_size;
    const char *descriptor;
    uint32_t  pointer_data_count;
    uint32_t  pad0;
    uintptr_t *pointer_data;
};

{
  "version": "1",

  "types": {
    "Thread": {
      "Id": 16,
      "OSId": 224,
      "State": 0
    }
  },

  "globals": {
    "GCInfoVersion": "0x4",
    "AppDomain": [[2], "pointer"]
  },

  "sub-descriptors": {
    "GC": [[45], "pointer"]
  },

  "contracts": {
    "GC": "c1",
    "Thread": "c1",
    "SyncBlock": "c1"
  }
}

AppDomain
GC heap table
ThreadStore

pointer_data

"AppDomain": [[2], "pointer"]

Static metadata

Runtime addresses

HeapSegment.Next -> offset X

docs/design/datacontracts/

GC.md
Loader.md
ExecutionManager.md
Thread.md
...

src/native/managed/cdac

Runtime version
       +
Architecture
       +
Platform
       ↓
matching DAC

Memory Reader
      +
Contract Descriptor
      +
Algorithm implementation
      ↓
Runtime analysis

"GC": "c1"

Version بزرگ‌تر لزوماً Version جدیدتر یا بهتر نیست.

GC c1

GC c2

IGC gc = version switch
{
    "c1" => new GCContractV1(target),
    "c2" => new GCContractV2(target),

    _ => throw new NotSupportedException()
};

Diagnostic Tool
       │
       ▼
Legacy DAC surface
       │
       ├── old implementation
       │
       └── cDAC-backed implementation

Dump
 │
 ├── Runtime memory
 │
 └── Runtime contract descriptor
          │
          ▼
   portable managed reader

find exact DAC
download exact DAC
load native DAC
trust native DAC
match architecture

binary-match driven

contract-driven

profilers
production diagnostics
memory analyzers
crash analyzers
runtime inspection tools
eBPF-based observability

Runtime private implementation
        │
        ├── completely private details
        │
        └── diagnostic contract surface

dotnet-dump
dotnet-debug
SOS
ClrMD
WinDbg integrations
cross-platform diagnostics