Dumping Static Fields with WinDBG

May 5th, 2009

Here's something that I very ocassionally have to do and always forget it's done: Getting the values of static fields in a managed class when debugging using WinDBG with the SOS extensions:

Get the address where the CLASS object is located in memory. There are several ways to do this, but an easy one is to use the Name2EE function, passing in the assembly or module name and the fully qualified type name:

0:007> !name2ee mscorlib.dll System.Console
Module: 0000064278854000 (mscorlib.dll)
Token: 0x000000000200008b
MethodTable: 00000642788c8d10
EEClass: 0000064278a271a8
Name: System.Console

Now, we can use the DumpClass function, passing in the EEClass value returned by the previous command:

0:007> !dumpclass 0000064278a271a8

Class Name: System.Console

mdToken: 000000000200008b (C:\WINDOWS\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)

Parent Class: 00000642788c0c30

Module: 0000064278854000

Method Table: 00000642788c8d10

Vtable Slots: 4

Total Method Slots: 78

Class Attributes: 100181  Abstract,

NumInstanceFields: 0

NumStaticFields: d

              MT    Field   Offset                 Type VT     Attr            Value Name

00000642788f5aa0  40002ae       d8 System.IO.TextReader  0   shared           static _in

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788cdd08  40002af       e0 System.IO.TextWriter  0   shared           static _out

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788cdd08  40002b0       e8 System.IO.TextWriter  0   shared           static _error

                                 >> Domain:Value  000000000015b120:NotInit  <<

000006427895dcb0  40002b1       f0 ...ancelEventHandler  0   shared           static _cancelCallbacks

                                 >> Domain:Value  000000000015b120:NotInit  <<

000006427895db88  40002b2       f8 ...le+ControlCHooker  0   shared           static _hooker

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788c91e0  40002b3       d0 ...ative+InputRecord  1   shared           static _cachedInputRecord

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788dca98  40002b4      990       System.Boolean  1   shared           static _haveReadDefaultColors

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788c9f78  40002b5      994          System.Byte  1   shared           static _defaultColors

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788dca98  40002b6      998       System.Boolean  1   shared           static _wasOutRedirected

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788dca98  40002b7      99c       System.Boolean  1   shared           static _wasErrorRedirected

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788c0cd8  40002b8      100        System.Object  0   shared           static s_InternalSyncObject

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788c9618  40002b9      980        System.IntPtr  1   shared           static _consoleInputHandle

                                 >> Domain:Value  000000000015b120:NotInit  <<

00000642788c9618  40002ba      988        System.IntPtr  1   shared           static _consoleOutputHandle

                                 >> Domain:Value  000000000015b120:NotInit  <<

Notice that this was on an x86-64 system running 64-bit Windows, which is why all pointer values are 64-bit long.

Tomas Restrepo

Software developer located in Colombia.