O'Reilly logo

Windows Debugging: Practical Foundations by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 8. Reconstructing a Program with Pointers

Example of Disassembly Output: No Optimization

The ability to reconstruct approximate C or C++ code from code disassembly is very important in memory dump analysis and debugging.

The project for this chapter can be downloaded from:

ftp://dumpanalysis.org/pub/WDPF/Chapter8/

The executable is located under PointersAsVariables\Debug sub-folder. We load it into WinDbg and disassemble its main function.

First we load PointersAsVariables.exe using File\Open Executable... menu option in WinDbg and get the following output:

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86 Copyright (c) Microsoft Corporation. All rights reserved. CommandLine: C:\WDPF\PointersAsVariables\Debug\PointersAsVariables.exe Symbol ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required