Hi dear all,
according to the windbg document , a virtual address is interpreted in a process context (use the process's paging table) , so , if there is not a process context (for example , in debugging winload , which has no concept of process) , s command will not work ,
kd> db 00000000
00844000 l2 0000000000844000 4d 5a MZ
kd> s 00000000`00844000 l2 4d 5a
s command return nothing
so , is there any alternative for s command in this situation ?
and why db command works ? it seems interpreting of virtual address in a db command do not use process context.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Developing Minifilters||29 July 2019||OSR Seminar Space|
|Writing WDF Drivers||23 Sept 2019||OSR Seminar Space|
|Kernel Debugging||21 Oct 2019||OSR Seminar Space|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|