WinDbg 查看静态变量

有如下Class。若想查看静态变量内容。因为静态变量和类绑定，仅需要查看类即可。

namespace ConsoleApplication13

{

    class Program

    {

        public static string public_string = "pubstr_static";

        public static string private_string = "pristr_static";
        ...
 

    }

}

1、查找类。 !Name2EE ConsoleApplication13.exe ConsoleApplication13.Program

:> !Name2EE ConsoleApplication13.exe ConsoleApplication13.Program

Module:      00007ff83abd40c0

Assembly:    ConsoleApplication13.exe

Token:

MethodTable: 00007ff83abd5d98

EEClass:     00007ff83ace3238

Name:        ConsoleApplication13.Program

2、导出类。 !DumpClass 00007ff83ace3238

:> !DumpClass 00007ff83ace3238

Class Name:      ConsoleApplication13.Program

mdToken:

File:            E:\新建文件夹\ConsoleApplication13\bin\Debug\ConsoleApplication13.exe

Parent Class:    00007ff887de4b60

Module:          00007ff83abd40c0

Method Table:    00007ff83abd5d98

Vtable Slots:

Total Method Slots:

Class Attributes:

Transparency:        Critical

NumInstanceFields:

NumStaticFields:

              MT    Field   Offset                 Type VT     Attr            Value Name

00007ff888498538                  System.String     static 000000000f0143a0 public_string

00007ff888498538                 System.String     static 000000000f0143d8 private_string

                                   static  CS$<>9__CachedAnonymousMethodDelegate1

3、可看出3个静态变量，其中2个String。!do  000000000f0143a0 。红色即为内容。

:> !do  000000000f0143a0

Name:        System.String

MethodTable: 00007ff888498538

EEClass:     00007ff887de4ab8

Size:        (0x34) bytes

File:        C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll

String:      pubstr_static

Fields:

              MT    Field   Offset                 Type VT     Attr            Value Name

00007ff88849af60                   System.Int32   instance                m_stringLength

00007ff8884996e8          c          System.Char   instance                m_firstChar

00007ff888498538                 System.String     shared           static Empty

                                 >> Domain:Value  0000000000559b60:NotInit  <<