I am studying reading dumped memory image and analyzing it with volatility.

I wrote this c# program and I was hoping to see the analyzed data from Volatiliy

namespace CSharpEx1
    class Program
        static void Main(string[] args)
            int numberA = 12345;
            string textA = "This is Message";
            var someClassA = new SomeClassA();
            Console.WriteLine("Something printed here");

        class SomeClassA
            private int _numberB;
            private string _textB;

            public SomeClassA()
                _numberB = 67890;
                _textB = "Another Message";


I would like to be able to see: numberA, textA, numberB and textB

I hope I was clear, thanks for any direction

  • Do you really want to read variables through memory dumping? Won't using a debugger do the trick for you?
    – NirIzr
    Sep 22 '18 at 5:06
  • Yes, I would like to see them from the memory dumping image.
    – RollRoll
    Sep 22 '18 at 5:19
  • It's a little bit as finding a needle in a haystack... not very efficient. You'd better use a debugger (and spare your time).
    – perror
    Sep 22 '18 at 6:36
  • thanks for the answer. efficiency is not the motivation for this post, I wanna see the address and memory from a dumped memory image from volatility.
    – RollRoll
    Sep 22 '18 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.