1

I'm debugging a .NET application and see a declaration of a local array:

$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;

I break on an instruction that uses data inside that (char*) array:

num9 = <Module>.strtoul(*(ref $ArrayType$$$BY05PAD + 4), null, 10);

Before the call to strtoul, I want to show in a hex editor the contents of *(ref $ArrayType$$$BY05PAD + 4), but this is not a valid expression in the watch window and it doesn't appear as a local variable. How can I inspect raw field memory?

  • what happens if you, in Locals window, right click on this array and select Show in Memory window -> Memory 1? – Paweł Łukasik Apr 9 at 18:49
  • Hi Paweł, unfortunately the array does not appear at all in the Locals window. – Jonas Mechtheim Apr 9 at 18:59
  • is it possible that you put this binary somewhere for me to check? – Paweł Łukasik Apr 9 at 20:08
0

Those are identified as raw locals. You can enable their visibility by going to Options in Debug menu.

enter image description here

After that you will be able to see those elements in the locals window.

enter image description here

And from there you can right click on it and select Show in Memory Window -> Memory 1

enter image description here

and analyze the data:

enter image description here

But that's not the end of our work. Those are just the pointers so our array contains such addresses (little-endian):

[0x610245D4,0x610245D7,0x610245DA,0x610245DD,0x610245E0]

So if your example tries to access offset +4 it will get the second address and if we navigate there in the Memory window we will see the strings there that will be passed to strtoul method

enter image description here

  • Thank you SO MUCH, this is exactly what I was looking for! – Jonas Mechtheim Apr 12 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.