Click here to Skip to main content
15,868,349 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hey all,

I am working on a WinDBG extension that can alter data of a running application.
At this point i am able to fetch the memory addresses of critical sections.
But my requirement is to get the memory address of a given function name.
Is there a way to do the same (a direct command or a set of commands).

Thanks in advance.
Posted

When you need to find the address at which a known function or a global variable resides, you can
use the x command of the windbg.exe debugger. This translation is often useful when trying to set
code or data breakpoints. For this to work, naturally, the module (DLL or main EXE) that contains the
function or global symbol should’ve already been loaded by the target process. Note that this command
also supports the wildcard character (*), which is often convenient for discovering the available
symbol (function or global variable) names that match a given pattern
.

0:000> x notepad!*main*
00151320 notepad!_imp____getmainargs = <no type information>
00151405 notepad!WinMain = <no type information>
00153689 notepad!WinMainCRTStartup = <no type information>
0:000> x notepad!g_*
0015c00c notepad!g_ftOpenedAs = <no type information>
0015e040 notepad!g_ftSaveAs = <no type information>
0015c100 notepad!g_wpOrig = <no type information>


reference : Inside Windows Debugging (Tarik Soulami)
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900