Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi dear all,
according to the windbg document , a virtual address is interpreted in a process context (use the process's paging table) , so , if there is not a process context (for example , in debugging winload , which has no concept of process) , s command will not work ,
kd> db 00000000
00844000 l2 0000000000844000 4d 5a MZ
kd> s 00000000`00844000 l2 4d 5a
s command return nothing
so , is there any alternative for s command in this situation ?
and why db command works ? it seems interpreting of virtual address in a db command do not use process context.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Kernel Debugging||30 January 2023||Live, Online|
|Developing Minifilters||20 March 2023||Live, Online|
|Internals & Software Drivers||17 April 2023||Live, Online|
|Writing WDF Drivers||22 May 2023||Live, Online|
@ys: I saw your post caught in the spam filter. Check out this post... no need for you to repost multiple times.
ETA: I've marked your account to indicate that posts from you should never be considered spam in the future.
windbg has broken because of sxe ibp here
kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
NULL value in PsActiveProcess List
kd> ? nt
Evaluate expression: -2105483264 = 8280e000
kd> db nt l2
8280e000 4d 5a MZ
kd> s nt l2 5a
8280e001 5a 90 00 03 00 00 00 04-00 00 00 ff ff 00 00 b8 Z...............
i just booted a win-x 32 bit vm (15563 rs2) with /bootdebug on and
tried to search and it appears it can search for ascii strings but not
bytes i think you should possibly raise an issue in thier github doc
account it also appears you can search for aligned dwords but not bytes