Никакое различие кроме, как Вы говорят, пустая безопасность. Всегда предпочитайте первого последнему.
Я изменил сценарий @Naveen для работы над x64 платформами.
Большой сценарий btw!
$ Dumps the managed strings to a file
$ Platform x64
$ Usage $>a<"c:\temp\dumpstringtofolder.txt" 00007ffa6c509808 5000 c:\temp\stringtest
$ First argument is the string method table pointer
$ Second argument is the Min size of the string that needs to be used filter
$ the strings
$ Third is the path of the file
.foreach ($string {!dumpheap -short -mt ${$arg1} -min ${$arg2}})
{
$ MT Field Offset Type VT Attr Value Name
$ 00007ffa6c50c158 400027b 8 System.Int32 1 instance 18 m_stringLength
$ 00007ffa6c50a9c0 400027c c System.Char 1 instance 53 m_firstChar
$ 00007ffa6c509808 4000280 c0 System.String 0 shared static Empty
$ start of string is stored in the 8th offset, which can be inferred from above
$ Size of the string which is stored in the c-th offset
r@$t0= (poi(${$string}+8) & 00000000FFFFFFFF) *2
.writemem ${$arg3}${$string}.txt (${$string}+c) (${$string}+c+@$t0)
}