Question

I ran into a situation where I needed to find the memory address of a String that I use in a piece of VB Code. I tried using various debuggers and also using the simple procexplorer to display a list of printable strings in memory. But it does not show anything which puzzles me. Does VB (.net framework 4) use some kind of encoding mechanism to store strings so that it does not appear in a printable format ?

Here’s the variable am trying to locate in memory: “spoilt”

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        MessageBox.Show("Button1")
        Dim spoilt As String
        spoilt = TextBox1.Text
        Label1.Text = spoilt


    End Sub

Answer 1

To answer my own question regarding encoding: Yes, Unicode encoding is used to store all strings. The above answer by @vcsjones provides a detailed explanation of how to find the memory location of these strings.

For the benefit of people who are looking for answers on how to find this address, there is a simpler way. mona.py (http://redmine.corelan.be/projects/mona) is a plugin for immunity debugger to do this job. I used it to find the memory location. The only reason I wasn’t able to find what I was looking for is because of the unicode format. But, with mona.py there is an option to search for unicode strings as well.