sb : search virtual memory as Byte valuessd : search virtual memory as Double-word values (4 bytes)sq : search virtual memory as Quad-word values (8 bytes)
sb [StartAddress (hex)] [l Length (hex)] [BytePattern (hex)] [pid ProcessId (hex)]sd [StartAddress (hex)] [l Length (hex)] [BytePattern (hex)] [pid ProcessId (hex)]sq [StartAddress (hex)] [l Length (hex)] [BytePattern (hex)] [pid ProcessId (hex)]
7FF62C9016AD+fffin a different process (process id =
IOCTL = IOCTL_DEBUGGER_SEARCH_MEMORY, you have to send it in the following structure.
Addressis where we want to start searching from its memory, and it can be both a physical address or a virtual address.
ProcessIdis the process that we want to modify based on its memory layout (cr3), it can't be
MemoryTypeshows whether the
Addressis a physical address or a virtual address.
ByteSizeshows whether we want to search the target Address in a byte, dword, or qword format.
0x90 0x90then you should provide an array of
0x0000000000000090and append it to the end of the above structure. The count of these chunks is stored at
CountOf64Chunksin the above structure and the final buffer that will be sent into the kernel has a size of
MaximumSearchResults * sizeof(UINT64)) as the output buffer, so the kernel-mode module will fill this buffer with a 64-bit array or addresses that match our search results.
UINT64array, and if you encounter a null entry, then it means there is no other result.