Displaying & Editing & Searching Memory
Using d*, e*, and s* commands
Last updated
Using d*, e*, and s* commands
Last updated
One of the debugger's essential tasks is displaying or editing memory, and HyperDbg is not an exception.
You can display, edit, and search both physical and virtual addresses using the following commands.
The following command is used when we want to read the content of memory at fffff800`3ad6f010
with the length of 0x50
from the memory layout view of the process (4
a.k.a. system process) in a hex byte format.
The following example shows the content of memory at fffff800`3ad6f010
from current process layout in a Double-word value (4 bytes) and ASCII characters format.
The following example shows the content of memory at fffff800`3ad6f010
from current process layout in a Double-word values (4 bytes) format with the length of 0x10
.
The following example shows the content of memory at fffff800`3ad6f010
from current process layout in a Quad-word values (8 bytes) format.
The following command is used when we want to edit the content of memory at fffff800`3ad6f010
in a hex byte form and change it to 0x90 0x90 0x90
(modify three bytes).
The following example is used when we want to edit the contents of memory at fffff800`3ad6f010
in Double-word values (4 bytes), change it to 245C8948
.
The following example is used when we want to edit the contents of memory at fffff800`3ad6f010
in Quad-word values (8 bytes), change it to 88889898`85858686
and92929393`97979898
(16 bytes).
The following command is used to search for 4156415748
starting from fffff807`7356f010
to fffff807`7356f010+ffff
.
The following example is used when we want to search for f0cc8549
from 7FF62C9016AD
to 7FF62C9016AD+fff
in a different process (process id = 1dd0
).
The following example is used when we want to search for 0f450000`00c0888b
8b410000`0092b1b7
from fffff807`7356f010
to fffff807`7356f010+100
.
If you want to perform the above actions on physical addresses, you can add !
to any of the above commands.