save data from visual studio memory window

Question

Is any possiblility to save some buffer in any binary file, to view in standalone hex editor.

For example, can I save data from memory window in VS to hex dump, but not as ASCII ?

Answer 1

StNickolay has the answer that references some tool called "dumper" but, somehow, I was unable to find it around the net (also, user142207 is long gone). So I created the very same tool - it opens up running process (even with a debugger attached) and copies portion of its memory into the file. Very useful when you want to store some structure for later and don't want to struggle with VS Memory View "copy" output. Enjoy!

https://github.com/Alexx999/Dumper

Answer 2

user142207 has done a great job investigating VS internals, I recommend that solution. I have another way that was invented by my colleague, Sergey S., which is very useful:

Windows: Use a couple of functions ReadProcessMemory/WriteProcessMemory. It needs a standalone app that calls these functions with a target process id like:

dumper.exe <debugged process id> <memory_start_addr> <memory_length>

This app can be called directly during the VS debug session(compared to Linux, which doesn't have such a possibility). We can capture the memory address in the watch window, then pass the address to the dumper and voila. As user142207 says in his article, it's very useful in long-time recompiled projects.

Linux/MacOS has different approaches. For example: from the gdb console, use command dump memory. This command can also be used directly during the debug session.

Answer 3

I don't know if this helps, but you can use WinDbg's .writemem command. It takes a filename and a memory range and dumps it (as binary) to the disk.

Answer 4

There is an extension for that: https://marketplace.visualstudio.com/items?itemName=OvidiuIonescu.VSDebugTool. It opens its console in VisualStudio window and allows dumping memory to file and a couple of other memory operation (enter "help" in the console for details).

Also, some hex editors (e.g. Hex Editor Neo) can browse process memory as an ordinary file. Maybe you'll find a free editor with this feature too.

Answer 5

The watch window in the Visual Studio debugger can run functions, if you are debugging your own code, you can just add some function to your code for saving a buffer to file and call it from the watch window. for example:

void WriteToFile(char* name, void* buffer, size_t size)
{
    FILE* fp;
    fopen_s(&fp, name, "wb");
    fwrite(buffer, 1, size, fp);
    fclose(fp);
}

Then just type something like this in the watch window:

WriteToFile("c:\\temp\\dump.dat", buffer, len)

Answer 6

I suspect that you can get what you want from the ClrMD, you can then same the data however you want.

If you literally want a core dump then WinDbg might be what you're looking for?

There is also this post on MSDN Blogs: https://blogs.msdn.microsoft.com/dondu/2010/10/24/writing-minidumps-in-c/

It describes how to create dump-ish things in .NET programmatically.