Symbols, types, and expressions¶

.fetchimage¶

Download a loaded module’s PE file into the symbol cache and print its path.

.fetchimage <module>

The file is looked up by the TimeDateStamp and SizeOfImage in the module’s mapped PE header, the symbol-server key, so it is the exact build that is running. A disassembler database made from it rebases onto the live module.

.formats¶

Display an expression in common numeric formats.

.formats <expression>

.reload¶

Reload symbols for one module or every module in the current scope.

.reload [module]

.srcpath¶

Display or replace ordered local source path mappings.

.srcpath [<local-root|recorded-prefix=local-root> ...]

.srcpath+¶

Append local source path mappings.

.srcpath+ <local-root|recorded-prefix=local-root> ...

.symfix¶

Restore the ntoseye cache and Microsoft symbol server defaults.

.symfix

.sympath¶

Display or replace the ordered symbol source path.

.sympath [<directory|http-server> ...]

.sympath+¶

Append entries to the ordered symbol source path.

.sympath+ <directory|http-server> ...

?¶

Evaluate an expression.

? <expression>

Also: ev

memory reads: by() 1 wo() 2 dwo() 4 qwo()/poi() 8; &expr is storage, ->/. are values

dt¶

Display a type layout or decoded structure.

dt [-r[N]] [-a[N]] [-v] [-y] [-l <field>] [module!]<type> [address] [field-pattern...]

-r expands nested structures, -a expands bounded arrays, -v shows field sizes, -y uses case-insensitive prefix matching, and -l walks a LIST_ENTRY field. Nested field paths are dotted, and field patterns support * and ?. With -l, the address given is the first element, like WinDbg, so the walk emits every node up to the return to that address. A list head and a record link are indistinguishable in memory, so starting at a list head (rather than poi(ListHead)) prints the head as one pseudo-record instead of dropping a real record; an empty list, whose link points at itself, prints nothing. The walk keeps whatever it collected and reports null links, cycles, unreadable links, and reaching the entry bound.

dv¶

Display procedure locals and parameters at an address.

dv [address]

ln¶

List the nearest symbol to an address.

ln <address>

ls¶

List source lines of the current scope’s file.

ls [.] [first][,count]

With no arguments, continues after the lines the previous ls or lsa listed; . restarts at the current line. first is a line number; count defaults to 10. The file is the one the current scope IP ($scopeip) maps to, found through .srcpath.

lsa¶

List source lines around an address.

lsa [address][,first][,count]

Defaults to the current scope IP ($scopeip), five lines before it, and twelve lines in all. first is an offset from the address’s line (negative for lines before it). The line at the address is marked >.

n¶

Display or set the default numeric radix for REPL expressions.

n [8|10|16]

set¶

Define a convenience variable usable in expressions as $.

set $<name> <expression>

unset¶

Remove a convenience variable.

unset $<name>

vars¶

List defined convenience variables and result slots.

vars

x¶

Fuzzy-search symbols by name.

x <query>  or  x <module>!<query>

* and ? are globs. Operators: ^ prefix, $ suffix, ' exact, ! negation, and space-separated terms are ANDed.