3

I can inspect esp in radar2 using dr esp. In order to inspect 0x15(%esp) I do the following:

    dr esp
0xff966c60
    ? 0xff966c60 + 0x15
0xff966c75
    px 4 @ 0xff966c75

Is there an easier way to do this? px 4 @ esp + 0x15 is not what I need.

1 Answer 1

2

You could chain your steps in a single command with something like px 4 @ `dr esp` + 4, or simply use px 8 @ esp and look at the second word.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.