How can I see the value of an element in a char array in WinDBG?
The first command shows me the elements of an array in a network process memory dump. When I try to see the actual character stored in each item at index 0 using the second command, it fails. For example, if the array contained "f", "o", "o" as the first three characters, I need a command that displays "f" on the screen.
0:000> !da -length 3 0000000001f11af8 Name: System.Char[] MethodTable: 000007fef77e9688 EEClass: 000007fef73eef58 Size: 74(0x4a) bytes Array: Rank 1, Number of elements 25, Type Char Element Methodtable: 000007fef77e97d8 [0] 0000000001f11b08 [1] 0000000001f11b0a [2] 0000000001f11b0c 0:000> !do 0000000001f11b08 <Note: this object has an invalid CLASS field> Invalid object
source to share
sos.dumpobj
used to remove managed objects, or more specifically, objects that are propagated (directly or indirectly) from System.Object. A char (or System.Char) is a valuetype type that extends from System.ValueType, not System.Object.
To reset the valuetype you can use the command !sos.dumpvc <MT> <address>
. The MT (Method Table) is listed above as 000007fef77e97d8, so to reset each of the values, you must do the following:
!sos.dumpvc 000007fef77e97d8 0000000001f11b08
!sos.dumpvc 000007fef77e97d8 0000000001f11b0a
!sos.dumpvc 000007fef77e97d8 0000000001f11b0c
This will result in the following:
Name: System.Char
MethodTable 000007fef77e97d8
EEClass: 000007feea37f018
Size: 24(0x18) bytes
(C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)
Fields:
MT Field Offset Type VT Attr Value Name
000007fef77e97d8 400021e 0 System.Char 1 instance 66 m_value
The value 66 is the hexadecimal value 'f'. Also notice the VT column. This means it is a value type.
Smarter option sosex.mdt
. If you don't have SOSEX, you can get it here . Among the many options, the -e argument expands the type of the collection (such as an array), although many levels are specified. You would use it like sosex.mdt -e:1 <address>
. The address in this case will have an array, or 0000000001f11af8. The result will look something like this:
!sosex.mdt -e:1 0000000001f11af8
0000000001f11af8(System.Char[], Elements: 3)
[0] 'f'
[1] 'o'
[2] 'o'
source to share