0

I'm using ICorProfilerCallback2 interface to profiler my application. On function enter hook I'm trying to read the value from byte array which is passed as an argument to a function. I've the argument info COR_PRF_FUNCTION_ARGUMENT_INFO from which I can get the starting address of the byte array argument.

If it is a string argument I can use "GetStringLayout" method from ICorProfilerInfo2 interface to get the bufferoffset and stringlengthoffset.

How can I find the offsets for byte array and how to read the values from it?

Where can I find the documents for those?

valiano
  • 16,433
  • 7
  • 64
  • 79
Zader
  • 67
  • 7

1 Answers1

1

If you have the ObjectID (or COR_PRF_FUNCTION_ARGUMENT_RANGE) of the argument, you have an easy life (at least for Objects/Arrays, not for Value Types. You have to validate the parameter type using the metadata).

You can use ICorProfilerInfo::GetClassFromObject and ICorProfilerInfo::IsArrayClass to determine if it's an array. If so, IsArrayClass gives you the type of array. Arrays in .Net have a specific layout (I don't think it's in the official docs): It's always 8 bytes for ClassID, 8 bytes for size, and than all the elements, without padding (Note: Objects are stored by ObjectID, just like in other memory regions). You can also use ICorProfilerInfo2::GetArrayObjectInfo to get the size (need to calculate from dimensions) and the starting address of the objects.

Relevant reads: https://mattwarren.org/2017/05/08/Arrays-and-the-CLR-a-Very-Special-Relationship/ https://windowsdebugging.wordpress.com/2012/04/24/memorylayoutofarraysx64/

Egozy
  • 380
  • 2
  • 13