New answers tagged

0

You Cannot use contains for objects they are not strings contains only is meaningful when you have a partial case Sensitive pattern here is how you may use contains 0: kd> dx Debugger.Sessions.First().Processes.Where(p=>p.Name.Contains("Taskm")) Debugger.Sessions.First().Processes.Where(p=>p.Name.Contains("Taskm")) [0x2c14] ...


1

Here is how to do it: dx @$cursession.Processes.Where(p => p.Environment.EnvironmentBlock.ProcessParameters->CommandLine->ToDisplayString().Contains("chrome")) If you have other way, please share.


1

maybe try : C:\Program Files (x86)\Windows Kits\10\Debuggers\x86


0

After I ran: 0: kd> .symfix C:\debug\symbols *** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'. *** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'. 0: kd> !sym noisy noisy mode - symbol prompts on 0: kd> .reload /f Now I was able to use it: 0: kd> dd user32!SetWindowTextW 00007ffc`...


1

Use the following from idapython: import ida_dbg ida_dbg.edit_manual_regions()


1

I am not sure what you are asking (never used sticky notes and don't have it installed ) but if you want to run sticky notes from command line you can do something like this the command below will run calculator instead of the wildcard calc use stick C:\>powershell -c "(get-startapps -name *calc*).Appid Microsoft.WindowsCalculator_8wekyb3d8bbwe!App ...


Top 50 recent answers are included