Oftentimes it's useful to search images for strings, they
can provide clues as to where a module came from or what exactly was running on
a machine. However, doing this typically requires extracting an image from a
memory dump and running a standalone application. If you want to save yourself
some time, you can instead do this right from the debugger with s, the search
memory command.
Searching for ANSI Strings
To search for ANSI strings, use the following syntax:
s -sa range
For example:
0: kd> s
-sa fffff880`0132b000 fffff880`0132c000
fffff880`0132b04d?
"!This program cannot be run in D"
fffff880`0132b06d?
"OS mode."
fffff880`0132b0c8?
"Rich"
fffff880`0132b1f0?
".text"
fffff880`0132b217?
"h.rdata"
fffff880`0132b23f?
"H.data"
fffff880`0132b268?
".pdata"
fffff880`0132b28f?
"HPAGE"
fffff880`0132b2b7?
"`INIT"
fffff880`0132b2e0?
".rsrc"
fffff880`0132b307?
"B.reloc"
Searching for Unicode Strings
To search for Unicode strings, use the following syntax:
s -su range
For example:
0: kd> s
-su fffff880`01370100 fffff880`01371100
fffff880`01370132?
"WEVT_TEMPLATE"
fffff880`0137014e?
"MUI"
fffff880`01370166?
"VS_VERSION_INFO"
fffff880`013701c2?
"StringFileInfo"
fffff880`013701e6?
"000004B0"
fffff880`013701fe?
"CompanyName"
fffff880`01370218?
"Microsoft Corporation"
fffff880`0137024a?
"FileDescription"
Specifying
a Minimum Character Requirement
By default,
any string that's over three characters is displayed in the output. You can change
this limit by using the l (lower case L) flag as part of the expression.
The syntax is a bit strange, but here's an example that searches ANSI strings
that are at least six characters:
0: kd> s
-[l6]sa fffff880`0132b000 fffff880`0132c000
fffff880`0132b04d?
"!This program cannot be run in D"
fffff880`0132b06d?
"OS mode."
fffff880`0132b217?
"h.rdata"
fffff880`0132b23f?
"H.data"
fffff880`0132b268?
".pdata"
fffff880`0132b307?
"B.reloc"
The same
syntax also applies to Unicode searches:
0: kd> s
-[l6]su fffff880`01370100 fffff880`01371100
fffff880`01370132?
"WEVT_TEMPLATE"
fffff880`01370166?
"VS_VERSION_INFO"
fffff880`013701c2?
"StringFileInfo"
fffff880`013701e6?
"000004B0"
fffff880`013701fe?
"CompanyName"
fffff880`01370218?
"Microsoft Corporation"
fffff880`0137024a?
"FileDescription"
fffff880`0137026c?
"Storage Spaces Driver"
fffff880`0137029e?
"FileVersion"