It is very easy to find stirngs on the stack of life debugging session or in a crash dump.
Simply set the context you are interested in with ~x s (replace x with the thread you are interested in) or set the excption context with .cxr 'address' or .ecxr (dump contains an excpetion record).
Then type:
0:000> da @ebp
You will likely get lots of trash, like this:
0012bf30 "X.."
then type
0:000> da
0012bf34 ".a.w..."
typing 'enter' repeats the last command, so we will walk down the stack by pressig 'enter'
0:000>
0012bf3c "8"
[...]
0:000>
0012c478 "Runtime Error!..Program: ...X.exe"
0012c4b8 "........................................This app"
0012c4d8 "lication has requested the Runti"
0012c4f8 "me to terminate it in an unusual"
0012c518 " way..Please contact the applica"
0012c538 "tion's support team for more inf"
0012c558 "ormation..."
This of course does not not work with strings on the heap.
Simply use 'dda' (or 'ddu' for unicode) to list those.
Friday, August 04, 2006
Scan the stack for strings
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment