Question

I have a little bit seen the representation of an array in memory with Windbg and SOS plugin.

Here it is the c# :

class myobj{
  public int[] arr;
}
class Program{
  static void Main(string[] args){
    myobj o = new myobj();
    o.arr = new int[7];
    o.arr[0] = 0xFFFFFF;
    o.arr[1] = 0xFFFFFF;
    o.arr[2] = 0xFFFFFF;
    o.arr[3] = 0xFFFFFF;
    o.arr[4] = 0xFFFFFF;
  }
}

I break at final of Main, and I observ :

    0:000> !clrstack -l
OS Thread Id: 0xc3c (0)
ESP       EIP     
0015f0cc 0043d1cf test.Program.Main(System.String[])
    LOCALS:
        0x0015f0d8 = 0x018a2f58
0:000> !do 0x018a2f58
Name: test.myobj
MethodTable: 0026309c
EEClass: 00261380
Size: 12(0xc) bytes
 (C:\Users\admin\Documents\Visual Studio 2008\Projects\test\test\bin\Debug\test.exe)
Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name
01324530  4000001        4       System.Int32[]  0 instance 018a2f64 tab
0:000> dd 018a2f64
018a2f64  01324530 00000007 00ffffff 00ffffff
018a2f74  00ffffff 00ffffff 00ffffff 00000000
018a2f84  00000000 00000000 00000000 00000000

I can see that the header contains the size of the array (00000007) but my question is : what is the value 01324530 ?

Thanks !

Answer 1

The value 01324530 is the method table. This is how .NET implements virtual methods– each method is a pointer to a function.

Note that the value of the array is at the pointer 018a2f64. I see you dumped the memory with dd. In case you didn’t know, you can also dump the array with the !da command:

!da 018a2f64