Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Dump a dereferenced address in WinDbg

Tags:

windbg

I'm trying to evaluate the contents of a call stack in WindDbg using the d* commands. I know that the address to the data I want to dump is at [ebp+8]. However when using this command WinDbg is dumping the data at ebp with an 8 byte offset. I want to dump the data pointed to by ebp+8. I've been manually dd ebp then manually typing the address in a subsequent du address.

Is there a way to instruct WinDbg to automatically dereference a pointer when dumping data?

like image 395
Paul Alexander Avatar asked Oct 12 '11 08:10

Paul Alexander


1 Answers

you can use any d* command with the address poi(ebp+8)

like image 190
plodoc Avatar answered Oct 23 '22 15:10

plodoc