1

I'm debugging a .NET application and see a declaration of a local array:

$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;

I break on an instruction that uses data inside that (char*) array:

num9 = <Module>.strtoul(*(ref $ArrayType$$$BY05PAD + 4), null, 10);

Before the call to strtoul, I want to show in a hex editor the contents of *(ref $ArrayType$$$BY05PAD + 4), but this is not a valid expression in the watch window and it doesn't appear as a local variable. How can I inspect raw field memory?

3
  • what happens if you, in Locals window, right click on this array and select Show in Memory window -> Memory 1? Apr 9, 2019 at 18:49
  • Hi Paweł, unfortunately the array does not appear at all in the Locals window. Apr 9, 2019 at 18:59
  • is it possible that you put this binary somewhere for me to check? Apr 9, 2019 at 20:08

1 Answer 1

0

Those are identified as raw locals. You can enable their visibility by going to Options in Debug menu.

enter image description here

After that you will be able to see those elements in the locals window.

enter image description here

And from there you can right click on it and select Show in Memory Window -> Memory 1

enter image description here

and analyze the data:

enter image description here

But that's not the end of our work. Those are just the pointers so our array contains such addresses (little-endian):

[0x610245D4,0x610245D7,0x610245DA,0x610245DD,0x610245E0]

So if your example tries to access offset +4 it will get the second address and if we navigate there in the Memory window we will see the strings there that will be passed to strtoul method

enter image description here

1
  • Thank you SO MUCH, this is exactly what I was looking for! Apr 12, 2019 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.