[SOLVED] in windbg how to save byte array to the file

in windbg how to save byte array to the file

before i had see this question and answer: Use WinDbg to Write Contents of Managed Byte[] to File,but i have a question that the mention answer that write all bytes to the file( Method table pointer,array length and the array content),i want just write a array content to the file.

for example,i created a byte array with 8192 length.

var bytes=new Byte[8192]

and use windbg and crash this.

0:034> !do 0x0143fd1c
Name:        System.Byte[]
MethodTable: 5ce54944
EEClass:     5cb8af1c
Size:        8204(0x200c) bytes
Array:       Rank 1, Number of elements 8192, Type Byte
Element Type:System.Byte
Content:     .0.................:.i......$...,x"!.a_.h#......66..vx.4...P.R?...M
Fields:
None
0:034> dd 0x0143fd1c
0143fd1c  5ce54944 00002000 0a0d300a 16460a0d
0143fd2c  957bd993 1f92335c 79a2d058 72455ef6
0143fd3c  cc16c7b1 05b18e14 5b1df595 0fb5dbd8
0143fd4c  629a16c6 0edb5c9a 6ede4110 5d5da54e
0143fd5c  4638143a efcad6db 060935f1 a9a48285
0143fd6c  e414cff0 8aeaae92 f169b93a f80bd6de
0143fd7c  9a9824d1 22782ccd 5f610c21 0f2368b4
0143fd8c  ae09d410 083636c3 0b787616 101ab234

0:034> !da 0143fd1c
Name:        System.Byte[]
MethodTable: 5ce54944
EEClass:     5cb8af1c
Size:        8204(0x200c) bytes
Array:       Rank 1, Number of elements 8192, Type Byte
Element Methodtable: 5ce525ec
[0] 0143fd24
[1] 0143fd25
.......

so,how to location at start offset and output length in the .writemem command?thanks.

Solution

!da gives you the answer. [0] 0143fd24<-- Address of first byte here.

Take the address of the first byte and pass it to .writemem along with a file name.

.writemem C:\somefile 143fd24 L0n8192

This command says write to C:\somefile, data starting at 143fd24, continuing for decimal 8192 bytes.