x (examine symbols and find functions and variables address)
Description of the 'x' command in HyperDbg.

Command

x

Syntax

x [Module!Symbol (wildcard string)]

Description

Finds the functions or variables address in the memory based on symbols.

Parameters

[Module!Symbol (wildcard string)]
Specifies a function or a variable name or a pattern that the symbol must contain. The Symbol can contain a variety of wildcard characters and specifiers. (For more information about the syntax, see Remarks)

Examples

In the following example, we searched for the address of the ExAllocatePoolWithTag function in the nt module.
1
HyperDbg> x nt!ExAllocatePoolWithTag
2
fffff803`1dbb1030 nt!ExAllocatePoolWithTag
Copied!
In the following example, we searched for the address of functions (and names) which, starts with ExAllocatePoo in the nt module.
1
0: kHyperDbg> x nt!ExAllocatePoo*
2
fffff803`1dbb1030 nt!ExAllocatePoolWithTag
3
fffff803`1d4421d0 nt!ExAllocatePoolWithQuotaTag
4
fffff803`1d44fde0 nt!ExAllocatePoolWithTagPriority
5
fffff803`1d522500 nt!ExAllocatePool
6
fffff803`1dbb1340 nt!ExAllocatePool3
7
fffff803`1dbb1280 nt!ExAllocatePool2
8
fffff803`1d7ad3d0 nt!ExAllocatePoolWithQuota
9
fffff803`1d45c5c0 nt!ExAllocatePoolEx
10
fffff803`1dbe9d84 nt!ExAllocatePoolSanityChecks
11
fffff803`1d4a1070 nt!ExAllocatePoolMm
Copied!

IOCTL

None

Remarks

The default module is nt. If you don't specify the module name, then nt is selected.
These are some examples of wildcard characters supported by this command.
Value
Meaning
foo
Looks for a global symbol (functions, variables) named "foo".
foo?
Looks for a global symbol that starts with "foo" and contains one extra character afterward, such as "fool" and "foot".
foo!bar*
Looks for a global symbol in "foo" that starts with "bar" and contains extra characters afterward, such as "foo!bar1" and "foo!bar2".

Requirements

None
None