What do C# values look like in WinDbg

One of the important areas you need to master when analyzing memory dumps is to recognize patterns that are normal and not normal.  You can only come to those conclusions after looking at many, many, many, many memory dumps and either remembering or taking notes on how a process looks when all is ok, so that when, what you see is having a different pattern, then you can drill deeper in that area looking for the cause of the issue for which you took the memory dump for in the first place.  One such scenario is knowing what NULL, True, False, empty strings look like.

Create a simple Console application with this code:

namespace values
    class Program
        static bool boolTrue = true;
        static bool boolFalse = false;

        static bool? nullableBoolTrue = true;
        static bool? nullableBoolFalse = false;
        static bool? nullableBoolNull = null;

        static byte byteValue = 123;
        static char charValue = 'X'; 

        static decimal decimalValue = 12.34m;

        static float floatValue = 12.34f;

        static string stringEmpty = "";
        static string stringValue = "abc123";
        static string stringNull = null;

        static int intValue = 123;

        static int? nullableIntNull = null;
        static int? nullableIntValue = 123;

        static SimpleClass referenceNull = null;
        static SimpleClass referenceNotNull = new SimpleClass();

        static Line structValue = new Line(1, 1);

        static List<SimpleClass> populatedList = new List<SimpleClass>() { new SimpleClass { simpleProperty = 100 } };

        static void Main(string[] args)

            Program p = new Program();
            WriteLine("Wait for WinDbg break in.");

        public struct Line
            public int x, y;
            public Line(int p1, int p2)
                x = p1;
                y = p2;

        public class SimpleClass
            public int simpleProperty { get; set; }


Run the code and then open WinDbg, in this case the 32 bit version and attach WinDbg to the process, as shown in Figure 1.


Figure 1, attach WinDbg to a process

Load the SOS.dll debug extension, as shown in Figure 2.


Figure 2, load SOS debug extension in WinDbg to debug or analyze a proces

Dump out the heap using !SOS.Dumpheap and find the Address of the values.Program, as seen in Figure 3.


Figure 3, dump the heap in WinDbg to find objects stored in memory of a process

Dump the object using the !SOS.Dumpobject method and its address found previously.  See Figure 4.


Figure 4, view the values of class objects within a process

Notice that a bool set to True is 1 and False is 0, just like you have been taught, notice the the StringNull is 00000000 and that the stringValue has a memory address of 03802e68.  Dump that out using !do and you will see its value of abc123, just like it is set in the code.

0:002> !do 03802f1c
Name:        values.Program
MethodTable: 01684edc
EEClass:     01681444
Size:        12(0xc) bytes
File:        C:\Temp\values.exe
      MT    Field   Offset                 Type VT     Attr    Value Name
60514718  4000001       2e       System.Boolean  1   static        1 boolTrue
60514718  4000002       2f       System.Boolean  1   static        0 boolFalse
6051d608  4000003        4 ...olean, mscorlib]]  1   static 048034fc nullableBoolTrue
6051d608  4000004        8 ...olean, mscorlib]]  1   static 04803500 nullableBoolFalse
6051d608  4000005        c ...olean, mscorlib]]  1   static 04803504 nullableBoolNull
60510c70  4000006       30          System.Byte  1   static      123 byteValue
605101e8  4000007       2c          System.Char  1   static       58 charValue
605295d8  4000008       10       System.Decimal  1   static 04803508 decimalValue
60515254  4000009       24        System.Single  1   static 12.340000 floatValue
6050f7a4  400000a       20        System.String  0   static 03801228 stringEmpty
6050f7a4  400000b       24        System.String  0   static 03802e68 stringValue
6050f7a4  400000c       28        System.String  0   static 00000000 stringNull
60511638  400000d       28         System.Int32  1   static      123 intValue
6052c12c  400000e       14 ...Int32, mscorlib]]  1   static 0480350c nullableIntNull
6052c12c  400000f       18 ...Int32, mscorlib]]  1   static 04803510 nullableIntValue
01684f64  4000010       2c ...ogram+SimpleClass  0   static 00000000 referenceNull
01684f64  4000011       30 ...ogram+SimpleClass  0   static 03802e84 referenceNotNull
01684e98  4000012       1c  values.Program+Line  1   static 04803514 structValue
01684fb4  4000013       34 ...leClass, values]]  0   static 03802e90 populatedList
0:002> !do 03802e68
Name:        System.String
MethodTable: 6050f7a4
EEClass:     600e6318
Size:        26(0x1a) bytes
File:        C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
String:      abc123
      MT    Field   Offset                 Type VT     Attr    Value Name
60511638  4000248        4         System.Int32  1 instance        6 m_stringLength
605101e8  4000249        8          System.Char  1 instance       61 m_firstChar
6050f7a4  400024d       48        System.String  0   shared   static Empty
    >> Domain:Value  014150f0:NotInit  <<
Comments (0)

Skip to main content