Memory and disassembly

!address

Describe what an address belongs to (module+section, or VAD region).

!address <address-expression>

Also: address

!db

Display guest-physical memory as bytes.

!db <address> [L<count>|length|end]

!dd

Display guest-physical memory as doublewords.

!dd <address> [L<count>|length|end]

!dq

Display guest-physical memory as quadwords.

!dq <address> [L<count>|length|end]

!dw

Display guest-physical memory as words.

!dw <address> [L<count>|length|end]

!eb

Write one or more bytes to guest-physical memory.

!eb <address> <value...>

!ed

Write one or more doublewords to guest-physical memory.

!ed <address> <value...>

!eq

Write one or more quadwords to guest-physical memory.

!eq <address> <value...>

.pagein

Make a paged-out address resident, using the guest’s debugger worker.

.pagein [/p <pid|eprocess>] <address>

The guest does the work, so the target is resumed and comes back halted at nt!DbgBreakPointWithStatus rather than where it was. /p attaches the worker to a process first, which user-space addresses need.

.readmem

Read a file into a virtual memory range.

.readmem <file> <address> [L<len>|end]

.writemem

Write a virtual memory range to a file.

.writemem <file> <address> [L<len>|end]

dS

Display a UNICODE_STRING descriptor and its buffer.

dS <address>

dW

Display memory as words with an ASCII column.

dW <address> [L<count>|length|end]

da

Display a NUL-terminated ASCII string.

da <address> [max-chars]

db

Display memory as bytes.

db <address> [L<count>|length|end]

dc

Display memory as doublewords with an ASCII column.

dc <address> [L<count>|length|end]

dd

Display memory as doublewords (4 bytes).

dd <address> [L<count>|length|end]

dds

Display memory as doublewords, annotating values that resolve to symbols.

dds <address> [L<count>|length|end]

dl

Dump a bounded _LIST_ENTRY chain.

dl [-b] <address> <maxcount> [size]

The default walk follows Flink; -b follows Blink. The optional size is the number of pointer-sized words displayed per element (default 2). The address given is the first element, like WinDbg, so the walk emits every node up to the return to that address. A list head and a record link are indistinguishable in memory, so starting at a list head (rather than poi(ListHead)) prints the head as one pseudo-record instead of dropping a real record; an empty list, whose link points at itself, prints nothing. The walk keeps whatever it collected and reports null links, cycles, unreadable links, and reaching the entry bound; reaching the requested maxcount is not reported.

dp

Display memory as pointer-sized values.

dp <address> [L<count>|length|end]

dpp

Display pointers, dereference them, and annotate symbols.

dpp <address> [L<count>|length|end]

dq

Display memory as quadwords (8 bytes).

dq <address> [L<count>|length|end]

dqs

Display memory as quadwords, annotating values that resolve to symbols.

dqs <address> [L<count>|length|end]

Also: dps

raw stack triage: dqs @rsp scrapes return addresses when the unwinder can’t

ds

Display an ANSI_STRING descriptor and its buffer.

ds <address>

du

Display a NUL-terminated UTF-16 string (e.g. a UNICODE_STRING Buffer).

du <address> [max-chars]

dw

Display memory as words (2 bytes).

dw <address> [L<count>|length|end]

dyb

Display memory as binary values with their bytes.

dyb <address> [L<count>|length|end]

ea

Write an ANSI string to memory.

ea <address> "text"

eb

Write one or more bytes to memory.

eb <address> <value...>

ed

Write one or more doublewords (4 bytes) to memory.

ed <address> <value...>

eq

Write one or more quadwords (8 bytes) to memory.

eq <address> <value...>

eu

Write a UTF-16 string to memory.

eu <address> "text"

ew

Write one or more words (2 bytes) to memory.

ew <address> <value...>

eza

Write a NUL-terminated ANSI string to memory.

eza <address> "text"

ezu

Write a NUL-terminated UTF-16 string to memory.

ezu <address> "text"

f

Fill memory with a repeated byte pattern.

f <address> <hex bytes> [L<count>|length|end]

hex bytes: 90, 4883792000740a, or \x90\x90

s

Search memory for a byte pattern.

s <address> <hex bytes> [length]

hex bytes: 4883792000740a or \x48\x83\x79\x20\x00\x74\x0a

u

Disassemble memory at a symbol or address.

u <address> [L<count>|length|end]

Also: disasm

L<count> counts instructions (default 8); an end address bounds the range in bytes.

ub

Disassemble instructions ending at an address.

ub <address> [L<count>]

uf

Disassemble the function containing an address.

uf [address]