Practical Malware Analysis

Using WinDbg

WinDbg uses a command-line interface for most of its functionality. We will cover the more important commands here. You can browse the complete list of commands in the WinDbg Help menu.

Reading from Memory

WinDbg’s memory window supports memory browsing directly from the command line. The d command is used to read locations in memory such as program data or the stack, with the following basic syntax:

dx addressToRead

where x is one of several options for how the data will be displayed. Table 10-1 shows the most common ways that data can be displayed.

Table 10-1. WinDbg Reading Options

Option	Description
da	Reads from memory and displays it as ASCII text
du	Reads from memory and displays it as Unicode text
dd	Reads from memory and displays it as ...