Doesn’t work for a module with no symbols loaded.
Roger Coote wrote:
Hi,
Maybe I misunderstand what you want but if you do ‘u ’ it will give you
> the module and offset of that address.
>
> Eg.
>
> kd> x nt!MmSizeOfPagedPoolInBytes
> 80535a80 nt!MmSizeOfPagedPoolInBytes =
>
> kd> u 80535a80
> nt!MmSizeOfPagedPoolInBytes:
> 80535a80 0000 add [eax],al
>
> The disassembly is rubbish because WinDbg is disassembling data but it does
> give you the mod!offset
>
> Yours
> Roger
>
> Roger Coote,
> Senior Design Engineer
> PowerVR Technologies, A Division of Imagination Technologies Ltd
> Home Park Estate, Kings Langley, Hertfordshire, WD4 8LZ, UK
> phone :+44 (1923) 260511 fax :+44 (1923) 268969
> direct :+44 (1923) 277247
> mailto:xxxxx@powervr.com www.powervr.com
>
>
>
>
> -----Original Message-----
> From: Nick Ryan [mailto:xxxxx@nryan.com]
> Sent: 11 December 2003 21:28
> To: Kernel Debugging Interest List
> Subject: [windbg] How to easily determine module&offset into for a given
> address?
>
>
> Is there a !windbg command that can take an address and return the
> module name and offset where that address resides (if any)? I’m tired of
> having to manually scan through the list of base addresses return by
> !drivers to eyeball which one is closest too and less than the address
> I’m curious about. (No, the ln command does not work for this purpose).
>
–
Nick Ryan (MVP for DDK)