OSRLogo
OSRLogoOSRLogoOSRLogo x Subscribe to The NT Insider
OSRLogo
x

Everything Windows Driver Development

x
x
x
GoToHomePage xLoginx
 
 

    Tue, 17 Oct 2017     115080 members

   Login
   Join


 
 
Contents
  Online Dump Analyzer
OSR Dev Blog
The NT Insider
Downloads
ListServer / Forum
Driver Jobs
  Express Links
  · The NT Insider Digital Edition - May-June 2016 Now Available!
  · Windows 8.1 Update: VS Express Now Supported
  · HCK Client install on Windows N versions
  · There's a WDFSTRING?
  · When CAN You Call WdfIoQueueP...ously

Using WinDbg to hunt for strings

Oftentimes it's useful to search images for strings, they can provide clues as to where a module came from or what exactly was running on a machine. However, doing this typically requires extracting an image from a memory dump and running a standalone application. If you want to save yourself some time, you can instead do this right from the debugger with s, the search memory command.

Searching for ANSI Strings

To search for ANSI strings, use the following syntax:

s -sa range

For example:

0: kd> s -sa fffff880`0132b000 fffff880`0132c000

fffff880`0132b04d? "!This program cannot be run in D"

fffff880`0132b06d? "OS mode."

fffff880`0132b0c8? "Rich"

fffff880`0132b1f0? ".text"

fffff880`0132b217? "h.rdata"

fffff880`0132b23f? "H.data"

fffff880`0132b268? ".pdata"

fffff880`0132b28f? "HPAGE"

fffff880`0132b2b7? "`INIT"

fffff880`0132b2e0? ".rsrc"

fffff880`0132b307? "B.reloc"

 

Searching for Unicode Strings

To search for Unicode strings, use the following syntax:

s -su range

For example:

 

0: kd> s -su fffff880`01370100 fffff880`01371100

fffff880`01370132? "WEVT_TEMPLATE"

fffff880`0137014e? "MUI"

fffff880`01370166? "VS_VERSION_INFO"

fffff880`013701c2? "StringFileInfo"

fffff880`013701e6? "000004B0"

fffff880`013701fe? "CompanyName"

fffff880`01370218? "Microsoft Corporation"

fffff880`0137024a? "FileDescription"

 

Specifying a Minimum Character Requirement

 

By default, any string that's over three characters is displayed in the output. You can change this limit by using the l (lower case L) flag as part of the expression. The syntax is a bit strange, but here's an example that searches ANSI strings that are at least six characters:

 

0: kd> s -[l6]sa fffff880`0132b000 fffff880`0132c000

fffff880`0132b04d? "!This program cannot be run in D"

fffff880`0132b06d? "OS mode."

fffff880`0132b217? "h.rdata"

fffff880`0132b23f? "H.data"

fffff880`0132b268? ".pdata"

fffff880`0132b307? "B.reloc"

 

The same syntax also applies to Unicode searches:

 

0: kd> s -[l6]su fffff880`01370100 fffff880`01371100

fffff880`01370132? "WEVT_TEMPLATE"

fffff880`01370166? "VS_VERSION_INFO"

fffff880`013701c2? "StringFileInfo"

fffff880`013701e6? "000004B0"

fffff880`013701fe? "CompanyName"

fffff880`01370218? "Microsoft Corporation"

fffff880`0137024a? "FileDescription"

fffff880`0137026c? "Storage Spaces Driver"

fffff880`0137029e? "FileVersion"

Related Articles
Enabling Debugging on the Local Machine for Windows XP®
You're Testing Me - Testing WDM/Win2K Drivers
Analyze This - Analyzing a Crash Dump
More on Kernel Debugging - KMODE_EXCEPTION_NOT_HANDLED
Making WinDbg Your Friend - Creating Debugger Extensions
Life Support for WinDbg - New Windows NT Support Tools
Life After Death? - Understanding Blue Screens
Special Win2K PnP Tracing and Checks
All About Lint - PC Lint and Windows Drivers
Bagging Bugs — Avoidance and Detection Tips to Consider

Writing WDF Drivers I: Core Concepts
LAB

Nashua (Amherst), NH
15-19 May 2017

Writing WDF Drivers II: Advanced Implementation Techniques
LAB

Nashua (Amherst), NH
23-26 May 2017

Kernel Debugging and Crash Analysis
LAB

Dulles (Sterling), VA
26-30 Jun 2017

Windows Internals and Software Driver Development
LAB

Nashua (Amherst), NH
24-28 Jul 2017

 
 
 
 
x
LetUsHelp
 

Need to develop a Windows file system solution?

We've got a kit for that.

Need Windows internals or kernel driver expertise?

Bring us your most challenging project - we can help!

System hangs/crashes?

We've got a special diagnostic team that's standing by.

Visit the OSR Corporate Web site for more information about how OSR can help!

 
bottom nav links