Sunday, May 15, 2016

Can't search for things in a 64-bit address space with WinDbg

Today I attempted to use WinDbg to poke around in the memory of a 64-bit application. I wanted to search for a certain pattern of bytes, so I used the s command with the appropriate -s flag. The problem was that searching the entire 64-bit address space would take ages, since it's exponentially larger than the 32-bit address space, which I can search in a minute or so. Some Googling turned up a couple questions that are still unanswered. Though I can find the string in a dump of the process's memory, I don't know how to get the memory address from that. Therefore, I have no way to search for things in a 64-bit process using WinDbg.

No comments:

Post a Comment