.NET Object Dump

Question

Hi all,

I have a question about the dump of an objet.

0:000> !do 0x012817b8

Name: blabla.Union2
MethodTable: 009231ac
EEClass: 00921548
Size: 16(0x10) bytes
Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name
790fd0f0  4000003        4        System.Object  0 instance 00000000 o
7912d7c0  4000004        8       System.Int32[]  0 instance 00000000 arr

What are the significations of : Field, Offset, VT ?

Answer 1

It's been a while since I worked with the .net metadata layer, but IIRC:
- Field is the token for that field of the union (contains a value since these are fields)
- Offset is the byte offset for that field in the union (the union is 16 bytes, field1 starts at byte 4 and field2 starts at byte 8)
- VT is the V-Table slot (not applicable since these are fields and not methods)

Answer 2

And also you can look at the memory of the fields by doing dd youobjectaddress+4 l1

and you can use it in windbg script by using the poi(youobjectaddress+4) which essentially is the pointer to first field o