Use Windbg Memory (RAM) window

In WinDbg, you can view and edit the memory by entering commands or by using a memory window .

Memory window opens

  • By menu View -> Memory
  • By shortcut Alt + 5
  • Toolbar

Using Memory window

Window opened by the above manner is as follows:

 

 

Memory window displays data in a plurality of columns. Column shows the start address of each row in the left window. The remaining columns display the desired information, from left to right. If the selected byte in the display format of the menu, corresponding to the two-byte ASCII characters to the right of the window displays.

Please note that   by default, the memory window displays virtual memory. This type is the only type of memory available in the user-mode memory. In kernel mode, you can use the memory options dialog box to display the physical memory space and other data.

In the memory window, you can perform the following operations:

  • To write to memory, click Memory window and type the new data. You can only edit the hex data, ASCII and Unicode characters can not be edited directly. Just type the new information, changes take effect.

  • To see other parts of memory, use the Memory window toolbar Previous and Next buttons ( ) or press PAGE UP or PAGE DOWN keys. These buttons and keys front of or behind the display portion immediately memory. If you request an invalid page, an error message will be displayed.

  • To the navigation window, the right to use, to the left, the up and down arrow keys. If you use these keys to leave the page, a new page will be displayed. Before using these keys, you should adjust the size of the memory window so that it does not contain a scroll bar. This sizing can be distinguished and the edges of the actual page off window.

  • To change the memory location are viewing the address box at the top of the memory window ( enter a new address) in. Please note that the memory refresh its display window, and you enter an address, so before you finish typing the address has been obtained an error message. Please note that   the current base box, enter the address in the interpretation. If the current base other than 16, you should prefix the hexadecimal address 0x . To change the default radix, use the n (Set Number Base) command in the debugger command window. Memory window displays itself from the current base.

  • To change the window display memory for data types, use the Memory window toolbar menu display format (

    ). Supported data types include short word, double word, and quadword; short, long, integer and with four unsigned integers; 10 bytes, 16 bytes, 64 bytes and 32-bit real number; the ASCII characters; the Unicode characters; and hexadecimal bytes. Displays the contents of hexadecimal bytes of ASCII characters and include.

A memory window has two buttons, menus, and a box contains, but with other command shortcut menu of the toolbar. To access the menu, right-click the title bar or click the window (icon near the top right corner Screenshot shortcut menu button on the display memory window toolbar). Toolbars, and shortcut menu contains the following options:

  • (Toolbar only) box address, specify a new address or offset. The exact meaning of this box depends on the type of memory you are viewing. For example, if you are viewing virtual memory, box, specify a new virtual address or offset.

  • (Toolbar only) display format enables you to select a new display format.

  • (Toolbars and menus) Previous (on the toolbar) and Previous Page (on the shortcut menu) will lead on a memory to be displayed.

  • (Toolbars and menus) the Next (on the toolbar) and the Next Page (on the shortcut menu) will lead to the next section of memory to be displayed.

  • (Menu only) toolbar toolbar on and off.

  • (Menu only) to automatically adjust the column to ensure that the width of the number of columns in the memory of the display memory window for the window.

  • (Menu only) dock or undock will stop window to enter or leave the state.

  • (Menu only) to a new dock memory window will close and will open its new platform.

  • (Menu only) is set to tabbed docked to the window, type the destination as a tabbed window docking target other memory settings for the selected memory window. After the set will be grouped automatically tabbed window in the dock as a tab in the form of target select all the memory window open.

  • (Menu only) is always a floating point will dock the window, drag even still docked position.

  • (Menu only) movement of the frame will move WinDbg moves the window frame, even when the window is unfixed.

  • (Menu only) Properties will open memory options dialog box, in the following sections of this topic.

  • (Menu only) to help open the Debugging Tools for Windows documentation related to this topic.

  • (Menu only) Close to close the window.

Guess you like

Origin www.cnblogs.com/yilang/p/12076199.html
RAM