Memory address of an object in C#

Question

I have a function written some time ago (for .NET 3.5), and now that I have upgraded to 4.0

I can't get it to work.

The function is:

public static class MemoryAddress
{
    public static string Get(object a)
    {
        GCHandle handle = GCHandle.Alloc(a, GCHandleType.Pinned);
        IntPtr pointer = GCHandle.ToIntPtr(handle);
        handle.Free();
        return "0x" + pointer.ToString("X");
    }
}

Now, when I call it - MemoryAddress.Get(new Car("blue"))

public class Car
{
    public string Color;
    public Car(string color)
    {
        Color = color;
    }
}

I get the error:

Object contains non-primitive or non-blittable data.

Why doesn't it work anymore?

How can I now get the memory address of managed objects?

Glasswort

I am trying to get the address of the object. It is very helpful (and instructive) when determining whether stuff is actually being copied (i.e. passed by value) or not. – Glasswort

I assume (hope?) that he's trying to see whether his own code is cloning the object. – Methionine

"Because I want to know how it works" is a good enough reason. – Hobbyhorse

I agree that "because I want to know how it works" is a good enough reason -- additionally -- if you are trying to verify that two objects are the same instance (versus exact copies) you can use the object.ReferenceEquals method. It doesn't actually tell you what the reference is, but it does return a boolean indicating if the two objects point to the same heap location or not. (Hopefully that helps someone.) – Sousaphone

GCHandle.ToIntPtr returns an internal representation of the handle itself, not the address of the object it points to. If you create multiple handles for the same object, GCHandle.ToIntPtr will return different results for each handle. It is GCHandle.AddrOfPinnedObject that returns the address of the object the handle points to. See GCHandle.ToIntPtr vs. GCHandle.AddrOfPinnedObject for more details. – Pyramid

NOTE: for anyone who wants to look at the addresses to make sure they understand what is happening under the hood, PLEASE watch these two videos instead of racking your brain on this. (VIDEO 1: youtube.com/watch?v=h6aXzd1nTXQ ) (VIDEO 2: youtube.com/watch?v=mvieNUe9Urs ). This gave me everything I wanted to know. I came from a C++ background became incredibly frustrated when i couldn't freely look at the memory address using the watch window. When discussing memory, it is so useful to have a visual understanding about what is going on in the background. – Tommietommy

Answer 1

You can use GCHandleType.Weak instead of Pinned. On the other hand, there is another way to get a pointer to an object:

object o = new object();
TypedReference tr = __makeref(o);
IntPtr ptr = **(IntPtr**)(&tr);

Requires unsafe block and is very, very dangerous and should not be used at all. ☺

---

Back in the day when by-ref locals weren't possible in C#, there was one undocumented mechanism that could accomplish a similar thing – __makeref.

object o = new object();
ref object r = ref o;
//roughly equivalent to
TypedReference tr = __makeref(o);

There is one important difference in that TypedReference is "generic"; it can be used to store a reference to a variable of any type. Accessing such a reference requires to specify its type, e.g. __refvalue(tr, object), and if it doesn't match, an exception is thrown.

To implement the type checking, TypedReference must have two fields, one with the actual address to the variable, and one with a pointer to its type representation. It just so happens that the address is the first field.

Therefore, __makeref is used first to obtain a reference to the variable o. The cast (IntPtr**)(&tr) treats the structure as an array (represented via a pointer) of IntPtr* (pointers to a generic pointer type), accessed via a pointer to it. The pointer is first dereferenced to obtain the first field, then the pointer there is dereferenced again to obtain the value actually stored in the variable o – the pointer to the object itself.

However, since 2012, I have come up with a better and safer solution:

public static class ReferenceHelpers
{
    public static readonly Action<object, Action<IntPtr>> GetPinnedPtr;

    static ReferenceHelpers()
    {
        var dyn = new DynamicMethod("GetPinnedPtr", typeof(void), new[] { typeof(object), typeof(Action<IntPtr>) }, typeof(ReferenceHelpers).Module);
        var il = dyn.GetILGenerator();
        il.DeclareLocal(typeof(object), true);
        il.Emit(OpCodes.Ldarg_0);
        il.Emit(OpCodes.Stloc_0);
        il.Emit(OpCodes.Ldarg_1);
        il.Emit(OpCodes.Ldloc_0);
        il.Emit(OpCodes.Conv_I);
        il.Emit(OpCodes.Call, typeof(Action<IntPtr>).GetMethod("Invoke"));
        il.Emit(OpCodes.Ret);
        GetPinnedPtr = (Action<object, Action<IntPtr>>)dyn.CreateDelegate(typeof(Action<object, Action<IntPtr>>));
    }
}

This creates a dynamic method that first pins the object (so its storage doesn't move in the managed heap), then executes a delegate that receives its address. During the execution of the delegate, the object is still pinned and thus safe to be manipulated via the pointer:

object o = new object();
ReferenceHelpers.GetPinnedPtr(o, ptr => Console.WriteLine(Marshal.ReadIntPtr(ptr) == typeof(object).TypeHandle.Value)); //the first pointer in the managed object header in .NET points to its run-time type info

This is the easiest way to pin an object, since GCHandle requires the type to be blittable in order to pin it. It has the advantage of not using implementation details, undocumented keywords and memory hacking.

Relegate

I find this useful in just one scenario: when I'm about to initiate a self-dump of the process, and before I do I want to print out a bunch of memory addresses to managed objects to make analyzing the dump file easier later. – Caines

I used it for validating the concept of string interning, it worked well! – Promotive

"is very, very dangerous". Is there anything that could go wrong if you do this only to read the actual address of the object and store it somewhere ? (eg : as a unique identifier). Let's say you want to walk on a hierarchy of objects and want to make sure you visit them only once. – Sensational

@Sensational The garbage collector could quite possibly step in and move the object around in memory, changing its address. The first unique identifier of an object you should think about using is its reference, i.e. simply object. If you want something numerical, both ObjectIDGenerator and GCHandle can be used to produce a unique number for an object. – Relegate

Shouldn't the third line be : IntPtr ptr = *(IntPtr*)&tr?? – Unloosen

@MohammadOmidvar No. The first dereferencing is extracting the pointer to the variable, the second is reading the pointer to the object. – Relegate

@IllidanS4 No I meant the casting part. According to source code the first field of TypedReference is Value which is a IntPtr. So simply casting the address to IntPtr pointer would be enough to extract first 8 bytes (x64) and the object's address. – Unloosen

@MohammadOmidvar TypedReference points to a variable, not to an object. The pointer to the object is stored in the variable, but first, it's address must be known. – Relegate

Apparently this answer got used, because it spawned a related question to explain the code: #50618924 – Compressed

@Compressed Thanks. I have finally edited the answer to include more details and a better way to obtain the address. – Relegate

I was used to see addresses of objects in Xcode as an iOS developer. Though the framework is terrible in many aspects, I liked that specific feature. The unsafe way from the top was enough to make a small PoC in the C# Interactive window. Thanks :) – Hurry

Next time someone tells me C# is much nicer than C or C++ (the classical "I hate pointers"), I'll show this answer (which is very clever, dont get me wrong, it's just C#'s way and compared to those simple & and *...) – Trichotomy

Answer 2

Instead of this code, you should call GetHashCode(), which will return a (hopefully-)unique value for each instance.

You can also use the ObjectIDGenerator class, which is guaranteed to be unique.

Methionine

GetHashCode is not unique. The object id generator id is unique but it prevents the object from being collected. – Rushy

@Eric: 1) For practical purposes, I think (but never checked) that it's good enough. 2) Is that documented anywhere? Checking the source, it is true. – Methionine

Re (1) well, what is practical depends on the problem being solved; There is a >1% chance of collision after only 9300 hashes. Re (2) it is not explicitly documented, but as you note, if you use reflector to take apart the implementation you'll see that all it does is sticks the objects into a hash table. As long as that hash table is alive, so are the objects. The documentation implies that the id generator should be kept alive only as long as the serialization operation is running. – Rushy

+1 for the object ID generator, I didn't know it existed. Hashes do not work well with large amounts of objects that need to be cached, wouldn't be the first time I'd encounter a Duplicate Hashkey error. Not sure if @EricLippert comments means that collisions can appear with the ID Generator as well. – Helbonnas

@Abel: No; ObjectIdGenerator will not collide. Just beware of memory leaks. – Methionine

If you override Equals you have to also override GetHashCode -- sometimes you also need reference based hash and not an equality based hash. (i.e. two copies of the same object, should give two different hashes in this instance.) – Sousaphone

@JHBonarius That is completely incorrect. GetHashCode is virtual, so a derived class should override it. Calling the method on object still calls the derived class's method. That is just how OOP works. You can use RuntimeHelpers.GetHashCode to get the actual "default" implementation. – Relegate

Answer 3

There's a better solution if you don't really need the memory address but rather some means of uniquely identifying a managed object:

using System.Runtime.CompilerServices;

public static class Extensions
{
    private static readonly ConditionalWeakTable<object, RefId> _ids = new ConditionalWeakTable<object, RefId>();

    public static Guid GetRefId<T>(this T obj) where T: class
    {
        if (obj == null)
            return default(Guid);

        return _ids.GetOrCreateValue(obj).Id;
    }

    private class RefId
    {
        public Guid Id { get; } = Guid.NewGuid();
    }
}

This is thread safe and uses weak references internally, so you won't have memory leaks.

You can use any key generation means that you like. I'm using Guid.NewGuid() here because it's simple and thread safe.

Update

I went ahead and created a Nuget package Overby.Extensions.Attachments that contains some extension methods for attaching objects to other objects. There's an extension called GetReferenceId() that effectively does what the code in this answer shows.

Warms

One would use it like so: System.Guid guid1 = Overby.Extensions.Attachments.AttachmentExtensions.GetReferenceId(myObject); – Brannen

Or as an extension method if you're into the whole brevity thing. – Warms

Answer 4

When you free that handle, the garbage collector is free to move the memory that was pinned. If you have a pointer to memory that's supposed to be pinned, and you un-pin that memory, then all bets are off. That this worked at all in 3.5 was probably just by luck. The JIT compiler and the runtime for 4.0 probably do a better job of object lifetime analysis.

If you really want to do this, you can use a try/finally to prevent the object from being un-pinned until after you've used it:

public static string Get(object a)
{
    GCHandle handle = GCHandle.Alloc(a, GCHandleType.Pinned);
    try
    {
        IntPtr pointer = GCHandle.ToIntPtr(handle);
        return "0x" + pointer.ToString("X");
    }
    finally
    {
        handle.Free();
    }
}

Meroblastic

I agree with your comment about the possibility of object a being moved after it's unpinned, but I don't think your code example and the OP's behave differently. Both compute pointer before handle.Free(). – Wendling

@Joh: It does seem that I mis-read his code at first. From what we can see, it looks like both should act the same. I wonder if they do. If mine acts differently, I'd have to wonder what the JIT compiler is doing. – Meroblastic

It's the "GCHandle.Alloc(a, GCHandleType.Pinned)" that fails executing. – Glasswort

Answer 5

Here's a simple way I came up with that doesn't involve unsafe code or pinning the object. Also works in reverse (object from address):

public static class AddressHelper
{
    private static object mutualObject;
    private static ObjectReinterpreter reinterpreter;

    static AddressHelper()
    {
        AddressHelper.mutualObject = new object();
        AddressHelper.reinterpreter = new ObjectReinterpreter();
        AddressHelper.reinterpreter.AsObject = new ObjectWrapper();
    }

    public static IntPtr GetAddress(object obj)
    {
        lock (AddressHelper.mutualObject)
        {
            AddressHelper.reinterpreter.AsObject.Object = obj;
            IntPtr address = AddressHelper.reinterpreter.AsIntPtr.Value;
            AddressHelper.reinterpreter.AsObject.Object = null;
            return address;
        }
    }

    public static T GetInstance<T>(IntPtr address)
    {
        lock (AddressHelper.mutualObject)
        {
            AddressHelper.reinterpreter.AsIntPtr.Value = address;
            T obj = (T)AddressHelper.reinterpreter.AsObject.Object;
            AddressHelper.reinterpreter.AsObject.Object = null;
            return obj;
        }
    }

    // I bet you thought C# was type-safe.
    [StructLayout(LayoutKind.Explicit)]
    private struct ObjectReinterpreter
    {
        [FieldOffset(0)] public ObjectWrapper AsObject;
        [FieldOffset(0)] public IntPtrWrapper AsIntPtr;
    }

    private class ObjectWrapper
    {
        public object Object;
    }

    private class IntPtrWrapper
    {
        public IntPtr Value;
    }
}

Koziara

That's a neat hack. – Abscess

In GetInstance<T> you have a memory leak. You should set the object to null again with something like reinterpreter.AsObject.Object = null before returning the instance. Otherwise this static class will keep a reference to the last instance you where retrieving. – Lacilacie

Answer 6

This works for me...

#region AddressOf

    /// <summary>
    /// Provides the current address of the given object.
    /// </summary>
    /// <param name="obj"></param>
    /// <returns></returns>
    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.AggressiveInlining)]
    public static System.IntPtr AddressOf(object obj)
    {
        if (obj == null) return System.IntPtr.Zero;

        System.TypedReference reference = __makeref(obj);

        System.TypedReference* pRef = &reference;

        return (System.IntPtr)pRef; //(&pRef)
    }

    /// <summary>
    /// Provides the current address of the given element
    /// </summary>
    /// <typeparam name="T"></typeparam>
    /// <param name="t"></param>
    /// <returns></returns>
    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.AggressiveInlining)]
    public static System.IntPtr AddressOf<T>(T t)
        //refember ReferenceTypes are references to the CLRHeader
        //where TOriginal : struct
    {
        System.TypedReference reference = __makeref(t);

        return *(System.IntPtr*)(&reference);
    }

    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.AggressiveInlining)]
    static System.IntPtr AddressOfRef<T>(ref T t)
    //refember ReferenceTypes are references to the CLRHeader
    //where TOriginal : struct
    {
        System.TypedReference reference = __makeref(t);

        System.TypedReference* pRef = &reference;

        return (System.IntPtr)pRef; //(&pRef)
    }

    /// <summary>
    /// Returns the unmanaged address of the given array.
    /// </summary>
    /// <param name="array"></param>
    /// <returns><see cref="IntPtr.Zero"/> if null, otherwise the address of the array</returns>
    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.AggressiveInlining)]
    public static System.IntPtr AddressOfByteArray(byte[] array)
    {
        if (array == null) return System.IntPtr.Zero;

        fixed (byte* ptr = array)
            return (System.IntPtr)(ptr - 2 * sizeof(void*)); //Todo staticaly determine size of void?
    }

    #endregion

Aphorize

AddressOf(object obj) in your code returns the address of the stack-allocated TypedReference, not the object address. To obtain the object address, you have to dereference two times as in this answer. – Pyramid

Answer 7

For .net core

public static string Get(object a)
{
    var ptr = Unsafe.As<object, IntPtr>(ref a);
    return $"0x{ptr:X}";
}

Brosy

Thank you for contributing to the Stack Overflow community. This may be a correct answer, but it’d be really useful to provide additional explanation of your code so developers can understand your reasoning. This is especially useful for new developers who aren’t as familiar with the syntax or struggling to understand the concepts. Would you kindly edit your answer to include additional details for the benefit of the community? – Louralourdes

This works great on .NET 8, and is by far the simplest answer. My use case was to find out where the object was being cached and I could pass the output of this to !gcroot in sos.dll to get the answer. – Tatouay

Answer 8

Switch the alloc type:

GCHandle handle = GCHandle.Alloc(a, GCHandleType.Normal);

Chlores

If he switches the GCHandleType he wouldn't be able to use the ToIntPtr method. – Ornstead

Does this not change the instruction to the GC that I don't want it to move the object around? (Changing the code does however compile and gives no errors during run-time.) – Glasswort

You can still call ToIntPtr() on a non pinned object. But the ptr it returns is only really valid within the .NET run-time. It no longer represents a pyhsical address you can write directly to, but within the CLR is can be used as a "reference" to an object – Avestan

For all GCHandle types, pinned or non-pinned, GCHandle.ToIntPtr returns an internal representation of the handle itself, not the address of the object it points to. If you create multiple handles for the same object, GCHandle.ToIntPtr will return different results for each handle. It is GCHandle.AddrOfPinnedObject that returns the address of the object the handle points to, however, you may use that method for pinned handles only. – Pyramid

Answer 9

Getting the address of an arbitrary object in .NET is not possible, but can be done if you change the source code and use mono. See instructions here: Get Memory Address of .NET Object (C#)

Campanula

Not usual yes, not possible... no... see above – Aphorize