winsiderss/systeminformer

Unloaded AppDomain is still shown in System Informer `.NET assemblies` tab.

Cracked5pider opened this issue · 1 comments

Brief description of your issue

While writing a small function to host the CLR in the current process and load and invoke an assembly. After invoking the assembly the app domain is getting unloaded but still shown in System Informer (just with the loaded assembly name missing). More shown below. When interacting with the CLR API to query all app domains and assemblies, the app domain that has been unloaded is no longer visible (API used are: ICorRuntimeHost::EnumDomains, ICorRuntimeHost::NextDomain, mscorlib::_AppDomain::GetAssemblies).

Code that unloads the App domain:
image

Steps to reproduce (optional)

No response

Expected behavior (optional)

I downloaded ProcessHacker to see if the same behavior is occurring. Which wasn't the case. (stomper.x64.exe is the process that I wrote to host the CLR and execute my .NET assembly).
image

Actual behavior (optional)

Under SystemInformer the AppDomain is still shown after calling ICorRuntimeHost::UnloadDomain.
image

Environment (optional)

My environment is Windows 11 (Build: 22631.3447) 64-bit and running a 64-bit process. If more information is required to understand the issue I am willing to help and show more.
dmex commented

What does windbg show?

Copy the value from the address column and from windbg try execute:
FindAppDomain ADDR
!DumpDomain ADDR
!DumpDomain should also list all the appdomains
dt coreclr!appdomain ADDR