1

I am studying reading dumped memory image and analyzing it with volatility.

I wrote this c# program and I was hoping to see the analyzed data from Volatiliy

namespace CSharpEx1
{
    class Program
    {
        static void Main(string[] args)
        {
            int numberA = 12345;
            string textA = "This is Message";
            var someClassA = new SomeClassA();
            Console.WriteLine("Something printed here");
            Console.ReadKey();
        }

        class SomeClassA
        {
            private int _numberB;
            private string _textB;

            public SomeClassA()
            {
                _numberB = 67890;
                _textB = "Another Message";
            }
        }

    }
}

I would like to be able to see: numberA, textA, numberB and textB

I hope I was clear, thanks for any direction

  • Do you really want to read variables through memory dumping? Won't using a debugger do the trick for you? – NirIzr Sep 22 '18 at 5:06
  • Yes, I would like to see them from the memory dumping image. – RollRoll Sep 22 '18 at 5:19
  • It's a little bit as finding a needle in a haystack... not very efficient. You'd better use a debugger (and spare your time). – perror Sep 22 '18 at 6:36
  • thanks for the answer. efficiency is not the motivation for this post, I wanna see the address and memory from a dumped memory image from volatility. – RollRoll Sep 22 '18 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.