I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the recording.

Now I'm trying to find this string or byte pattern x41 x41 x41 x41 x42 ... in the memory trace.

Does anyone know if this it is possible to search the whole trace (instead current memory image)? I looked at the commands using dx @$curprocess.TTD but there wasn't something useful, so maybe I can modify a query like this:

dx @$curprocess.TTD.Events.Where(t => t.Type == "ModuleLoaded").Where(t => t.Module.Name.Contains("bcrypt"))

But there aren't any helpful commands at first sight. So in the end I would like to search for pattern which appears at any time in the memory.

I would be grateful for any suggestions.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.