windbg 操作整理 : search, modify, save

查看堆地址

0:011> !address -f:Heap

  BaseAddr EndAddr+1 RgnSize     Type       State                 Protect             Usage
---------------------------------------------------------------------------------------------
   30000    40000    10000                                                            Heap       [ID: 4; Handle: 00030000; Type: Segment]
  150000   250000   100000                                                            Heap       [ID: 0; Handle: 00150000; Type: Segment]
  250000   256000     6000                                                            Heap       [ID: 1; Handle: 00250000; Type: Segment]

在堆上搜索字符串

0:011> s -u 150000 L100000 "学"
001b5960  5b66 671f 603b 4f1a 53bb 51e0 6b21 95f5  f[.g;`.O.S.Q!k..
001b5d54  5b66 8001 5bb6 5e26 6765 7684 ff0c 8089  f[...[&^eg.v....
001b6a42  5b66 5230 90a3 91cc 6253 7535 5b50 6e38  f[0R....Sb5uP[8n

显示字符串

0:011> du 001b5960 L30
001b5960  "学期总会去几次闵行老街，有时是买东西，有时是去闲逛。当时校园附件"
001b59a0  "很是空旷，去一次市区不容易，所以"

修改内存

eb 001b5960-2 ff fe
ew 001b595e feff

显示内存

0:011> db 001b5960-2 L10
001b595e  ff fe 66 5b 1f 67 3b 60-1a 4f bb 53 e0 51 21 6b  ..f[.g;`.O.S.Q!k

0:011> dw 001b595e L14
001b595e  feff 5b66 671f 603b 4f1a 53bb 51e0 6b21
001b596e  0000 884c 8001 8857 ff0c 6709 65f6 662f
001b597e  4e70 4e1c 897f ff0c

保存内存到文件

0:011> .writemem c:\text_out.txt 001b595e L14
Writing 14 bytes.