Search code examples
windbgcrash-dumpssos

Dumping array using Windbg


In C#,I have an object say Shape which has two fields area and length.

I got a shapeList which is a collection of Shapes.

I have got a shapeList address in my crash dump.

I need a script in windbg that iterates through each item in the shapeList array and display the value of area alone for each shape.


Solution

  •     .for ( r $t1 = 0; @$t1 < [length] * [element size]; r $t1 = @$t1 + [element size];) {!do poi(poi(@$t1+poi([address of list]+0x8)+0x18)+[offset of child object in parent object) }
    
        For example:
    
         class Foo
            {
                public Bar MyBar { get; set; }
            }
    
            class Bar
            {
                public String MyString { get; set; }
            }
    
    0:000> .for ( r $t1 = 0; @$t1 < 0x5 * 0x8; r $t1 = @$t1 + 0x8;) {!do poi(poi(@$t1+poi(0000000002362e40+0x8)+0x18)+0x8) }
    Name:        testdebug.Bar
    MethodTable: 000007fe95eb3928
    EEClass:     000007fe95fc22d8
    Size:        24(0x18) bytes
    File:        C:\users\testdebug.exe
    Fields:
                  MT    Field   Offset                 Type VT     Attr            Value Name
    000007fef47b4130  4000002        8        System.String  0 instance 00000000023653b0 <MyString>k__BackingField
    Name:        testdebug.Bar
    MethodTable: 000007fe95eb3928
    EEClass:     000007fe95fc22d8
    Size:        24(0x18) bytes
    File:        C:\users\testdebug.exe
    Fields:
                  MT    Field   Offset                 Type VT     Attr            Value Name
    000007fef47b4130  4000002        8        System.String  0 instance 0000000002365468 <MyString>k__BackingField
    Name:        testdebug.Bar
    MethodTable: 000007fe95eb3928
    EEClass:     000007fe95fc22d8
    Size:        24(0x18) bytes
    File:        C:\users\testdebug.exe
    Fields:
                  MT    Field   Offset                 Type VT     Attr            Value Name
    000007fef47b4130  4000002        8        System.String  0 instance 0000000002365520 <MyString>k__BackingField
    Name:        testdebug.Bar
    MethodTable: 000007fe95eb3928
    EEClass:     000007fe95fc22d8
    Size:        24(0x18) bytes
    File:        C:\users\testdebug.exe
    Fields:
                  MT    Field   Offset                 Type VT     Attr            Value Name
    000007fef47b4130  4000002        8        System.String  0 instance 00000000023655d8 <MyString>k__BackingField
    Name:        testdebug.Bar
    MethodTable: 000007fe95eb3928
    EEClass:     000007fe95fc22d8
    Size:        24(0x18) bytes
    File:        C:\users\testdebug.exe
    Fields:
                  MT    Field   Offset                 Type VT     Attr            Value Name
    000007fef47b4130  4000002        8        System.String  0 instance 0000000002365690 <MyString>k__BackingField