Print Page - WinDbg - large memory dumps

Title: WinDbg - large memory dumps
Post by: UserLoser on February 24, 2007, 01:21 AM

I have 30720 bytes of memory I need to dump. db edi surely does not give me enough as it only supplies me with 128 bytes. How to make it display all 30720 bytes and not just 128? If so, can it output them to a file? Thanks

Title: Re: WinDbg - large memory dumps
Post by: Barabajagal on February 24, 2007, 01:26 AM

I don't have any Assembly skill at all, so this is a shot in the dark, but couldn't you just make a loop that gets 128 bytes 240 times, increasing the memory location to read 128 bytes per loop?

Title: Re: WinDbg - large memory dumps
Post by: Kp on February 24, 2007, 11:09 AM

To display it all in Windbg (not recommended for this much data): db edi l0n30720. To save it to a file: .writemem c:\mymemory.dat edi l0n30720.

Title: Re: WinDbg - large memory dumps
Post by: UserLoser on February 25, 2007, 06:21 PM

Works perfect, thanks.

Get back on Botnet/b.net

Valhalla Legends Archive

Programming => General Programming => Assembly Language (any cpu) => Topic started by: UserLoser on February 24, 2007, 01:21 AM