Where does .NET place the String value?

I am using SOS debug extension dll to check the memory layout of a String type, and below is the result.

!dso

ESP/REG  Object   Name

0015EFC0 01c6b9cc System.String    hello,world

!do 01c6b9cc

Name:        System.String

MethodTable: 6de3f9ac

EEClass:     6db78bb0

Size:        36(0x24) bytes

File:        C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089>\mscorlib.dll

String:      hello,world

Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name

6de42978  40000ed        4         System.Int32  1 instance       11 m_stringLength

6de41dc8  40000ee        8          System.Char  1 instance       68 m_firstChar

6de3f9ac  40000ef        8        System.String  0   shared   static Empty

    >> Domain:Value  00331488:01c61228 <<

Now I am wondering, where exactly is the string value "hello world" stored?

Thanks.

Solution

At m_firstChar. The heap allocation is large enough to fit the entire string, not just the first character. Easy to see in Visual Studio as well:

class Program {
    static void Main(string[] args) {
        string s = "hello" + "world";
    }  // <=== Breakpoint here
}

When the breakpoint hits, use Debug + Windows + Memory + Memory1. In the Address box type s. You'll see:

0x01B3F6BC  e8 0a 67 6e 0b 00 00 00 0a 00 00 00 68 00 65 00  è.gn........h.e.
0x01B3F6CC  6c 00 6c 00 6f 00 77 00 6f 00 72 00 6c 00 64 00  l.l.o.w.o.r.l.d.

The object starts at the address - 4, the syncblk is stored there (not visible).
Next 4 bytes is the method table pointer (0x6e670ae8, aka type handle).
Next 4 bytes is the m_arrayLength member, the allocated size of the string (0x0b).
Next 4 bytes is the m_stringLength member, the actual number of characters in the string (0x0a).
Next bytes store the string, starting at m_firstChar.

This is for .NET 3.5 SP1. You won't see the m_arrayLength member in .NET 4.0 and up, the field was removed.