search
HomePenetration TestingVulnerability ManagementLinkdin

WinDgb Basics

Unassemble from Memory:

We can display the assembly translation of a specified program code in memory with ”u” command.

0:006> **u kernel32!GetCurrentThread**
KERNEL32!GetCurrentThread:
77542620 b8feffffff      mov     eax,0FFFFFFFEh
77542625 c3              ret
77542626 cc              int     3
77542627 cc              int     3
77542628 cc              int     3
77542629 cc              int     3
7754262a cc              int     3
7754262b cc              int     3

“u” command accepts either single memory address or range of memory as an argument

Reading from Memory using Display commands:

Display bytes through the db command

0:006> db esp
0638fe6c  f9 9b 94 77 31 43 21 9e-c0 9b 94 77 c0 9b 94 77  ...w1C!....w...w
0638fe7c  00 00 00 00 70 fe 38 06-00 00 00 00 e4 fe 38 06  ....p.8.......8.
0638fe8c  90 73 91 77 e9 86 81 ef-00 00 00 00 ac fe 38 06  .s.w..........8.
0638fe9c  64 95 53 77 00 00 00 00-40 95 53 77 a4 a1 20 b1  [email protected].. .
0638feac  f4 fe 38 06 3c 29 8e 77-00 00 00 00 5d 43 21 9e  ..8.<).w....]C!.
0638febc  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
0638fecc  00 00 00 00 00 00 00 00-00 00 00 00 5d 43 21 9e  ............]C!.
0638fedc  b8 fe 38 06 00 00 00 00-fc fe 38 06 90 73 91 77  ..8.......8..s.w

Display data in a larger size format:

dw prints WORDs (two bytes)

Display DWORDs (four bytes) with dd:

Display QWORDs (eight bytes) with dq

We can display ASCII characters in memory along with WORDs or DWORDs with dW and dc, respectively.

The default length when displaying data is 0x80 bytes. We can change this value by using the L parameter

L parameter change this value with display commands

Examining the memory contents at the address stored in the esp register (the stack pointer) and displaying the next 4 double words (32-bit values) from that location

Few Other example with Length parameter:

Pointer to Data:

It is used to display the value stored at a memory address pointed to by a given pointer variable or expression.

Above output can be achieved using below single command

NextDisplay Type

Last updated