CODEWITHSUNDEEP
windbg
Paul Alexander
Paul Alexander

Reputation: 32367

Dump a dereferenced address in WinDbg

I'm trying to evaluate the contents of a call stack in WindDbg using the d* commands. I know that the address to the data I want to dump is at [ebp+8]. However when using this command WinDbg is dumping the data at ebp with an 8 byte offset. I want to dump the data pointed to by ebp+8. I've been manually dd ebp then manually typing the address in a subsequent du address.

Is there a way to instruct WinDbg to automatically dereference a pointer when dumping data?

Upvotes: 7

Views: 13507

Answers (2)

plodoc
plodoc

Reputation: 2803

you can use any d* command with the address poi(ebp+8)

Upvotes: 12

Nilesh
Nilesh

Reputation: 6155

You can use dp* command to display data pointed by pointer at ebp+8. You can also use d*p.

Upvotes: 3

Related Questions