I'm trying to evaluate the contents of a call stack in WindDbg using the d* commands. I know that the address to the data I want to dump is at [ebp+8]
. However when using this command WinDbg is dumping the data at ebp with an 8 byte offset. I want to dump the data pointed to by ebp+8. I've been manually dd ebp
then manually typing the address in a subsequent du address
.
Is there a way to instruct WinDbg to automatically dereference a pointer when dumping data?
you can use any d* command with the address poi(ebp+8)
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With