3

I'm inspecting .NET object internals using WinDBG and SOS. I have a class with 3 methods. When I dump the method table using !dumpmt -md [address] command I get a description of 8 methods.

When I dump memory using dd [address] command I can't find 3 methods (see image - pink box). Also value 0x0003 (in a red circle) seams strange because it should represent the total number of methods (including virtual) but it represent only number of non-virtual methods. And what does the value in black box stand for?

enter image description here

Thomas Weller
  • 55,411
  • 20
  • 125
  • 222
Evgeny Belov
  • 308
  • 4
  • 12
  • 1
    This seems to be .NET 4. IMHO the red circle is wrong. It should be around 00000004 instead. Non-virtual methods are located in front of the method table (negative offsets)., try `dd
    -80`
     – Thomas Weller Apr 11 '16 at 22:26
  • Related: http://stackoverflow.com/questions/33201811/net-clr-method-table-structure – Thomas Weller Apr 11 '16 at 22:29
  • Thtank you! Where can I find some docs or specs related to this topic? – Evgeny Belov Apr 12 '16 at 03:41
  • 1
    These internal layouts are subject to change. You'll hardly find official information about it. Try looking for blog posts from Sasha Goldshtein (@goldshtn) or other people who work in the .NET team. – Thomas Weller Apr 12 '16 at 06:22

0 Answers0