WinDbg数据搜索技巧 --- 《格蠹汇编-从堆里抢救丢失的博客》

原文中作者是从堆里面寻找丢失的博客文章，在这里我模拟的环境是从gvim编辑器里面寻找一段文字的地址

强大的!address命令

!address -summary可以显示进程空间中内存使用情况的摘要

0:003> !address -summary
                                     
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...

--- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
Free                                    102     7fff`f37ff000 ( 128.000 TB)          100.00%
Image                                   399        0`04b2e000 (  75.180 MB)  37.60%    0.00%
MappedFile                               27        0`02e13000 (  46.074 MB)  23.04%    0.00%
Stack                                    12        0`02000000 (  32.000 MB)  16.00%    0.00%
<unknown>                                49        0`01830000 (  24.188 MB)  12.10%    0.00%
Heap                                     51        0`0149d000 (  20.613 MB)  10.31%    0.00%
Other                                     7        0`001d8000 (   1.844 MB)   0.92%    0.00%
TEB                                       4        0`0000a000 (  40.000 kB)   0.02%    0.00%
PEB                                       1        0`00001000 (   4.000 kB)   0.00%    0.00%

--- Type Summary (for busy) ------ RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_PRIVATE                             117        0`04cc9000 (  76.785 MB)  38.40%    0.00%
MEM_IMAGE                               399        0`04b2e000 (  75.180 MB)  37.60%    0.00%
MEM_MAPPED                               34        0`02ffa000 (  47.977 MB)  24.00%    0.00%

--- State Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_FREE                                102     7fff`f37ff000 ( 128.000 TB)          100.00%
MEM_COMMIT                              512        0`07862000 ( 120.383 MB)  60.21%    0.00%
MEM_RESERVE                              38        0`04f8f000 (  79.559 MB)  39.79%    0.00%

--- Protect Summary (for commit) - RgnCount ----------- Total Size -------- %ofBusy %ofTotal
PAGE_READONLY                           218        0`03ff2000 (  63.945 MB)  31.98%    0.00%
PAGE_EXECUTE_READ                        62        0`0248d000 (  36.551 MB)  18.28%    0.00%
PAGE_READWRITE                          167        0`0130e000 (  19.055 MB)   9.53%    0.00%
PAGE_WRITECOPY                           47        0`000b8000 ( 736.000 kB)   0.36%    0.00%
PAGE_READWRITE|PAGE_GUARD                 5        0`0000f000 (  60.000 kB)   0.03%    0.00%
PAGE_NOACCESS                            12        0`0000c000 (  48.000 kB)   0.02%    0.00%
PAGE_EXECUTE                              1        0`00002000 (   8.000 kB)   0.00%    0.00%

--- Largest Region by Usage ----------- Base Address -------- Region Size ----------
Free                                      0`7fff0000     7ff6`48020000 ( 127.962 TB)
Image                                  7ff9`4a4a1000        0`00e46000 (  14.273 MB)
MappedFile                                0`02f4d000        0`011e3000 (  17.887 MB)
Stack                                     0`04470000        0`007fb000 (   7.980 MB)
<unknown>                                 0`08341000        0`007ff000 (   7.996 MB)
Heap                                      0`08e0b000        0`00534000 (   5.203 MB)
Other                                     0`02ba0000        0`00181000 (   1.504 MB)
TEB                                       0`0040a000        0`00004000 (  16.000 kB)
PEB                                       0`005f8000        0`00001000 (   4.000 kB)

几个字段的说明：

Total Size ------ 总的内存大小
%ofBusy --------- 在已经使用了的内存中所占的百分比
%ofTotal -------- 在可用的内存地址中所占的百分比(因为是使用的64位系统，理论上可以寻址的范围大小是2^64，所使用的内存远远不及这个数字，所以这个字段大部分都是0.00%)

Usage Summary指的是内存不同用途的使用情况：

Free ----------- 空闲内存
Image ---------- 可执行文件映像所占的内存
MappedFile ----- 已经映射的文件所占的内存
Stack ---------- 栈空间所占用的内存
unknown -------- 顾名思义，未知的
Heap ----------- 堆
Other ---------- 其它
TEB ------------ 线程环境块
PEB ------------ 进程环境块

Type Summary指的是不同类型的内存的使用情况：

MEM_PRIVATE ---- 进程私有的内存(堆栈占大部分)
MEM_IMAGE ------ 可执行文件映像(程序文件、动态库等等)所占的，一般为多个进程共享
MEM_MAPPED ----- 内存映射文件

State Summary指的是不同状态的内存的使用情况：

MEM_FREE ------- 空闲
MEM_COMMIT ----- 已提交(虚拟地址已经被物理地址映射)的内存
MEM_RESERVE ---- 保留(该段虚拟内存地址为被分配到物理内存，但是保留起来不再分配给别人)

Protect Summary指的是不同的内存保护属性的内存的使用情况：

PAGE_READONLY --------- 只读
PAGE_EXECUTE_READ ----- 可读可执行
PAGE_READWRITE -------- 可读写
PAGE_WRITECOPY -------- 写时复制
PAGE_READWRITE|PAGE_GUARD
PAGE_NOACCESS --------- 不可访问
PAGE_EXECUTE ---------- 可执行

缩小搜索范围

可以看出已经使用的堆空间占用了20.613MB，从这么多的内存中找到所需要的数据不是一件轻松的事情

我们可以使用!address -f:Heap命令过滤出堆内存的地址分布

0:003> !address -f:Heap

        BaseAddress      EndAddress+1        RegionSize     Type       State                 Protect             Usage
--------------------------------------------------------------------------------------------------------------------------
       0`00250000        0`00260000        0`00010000 MEM_MAPPED  MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 1; Handle: 0000000000250000; Type: Segment]
       0`00390000        0`00393000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Front End]
       0`00393000        0`003aa000        0`00017000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 0; Handle: 0000000000f00000; Type: Front End]
       0`003b0000        0`003b2000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Front End]
       0`003b2000        0`003ca000        0`00018000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 2; Handle: 0000000002980000; Type: Front End]
       0`00e00000        0`00e05000        0`00005000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Front End]
       0`00e05000        0`00e1a000        0`00015000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000002900000; Type: Front End]
       0`00e80000        0`00e89000        0`00009000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 4; Handle: 0000000000e80000; Type: Segment]
       0`00e89000        0`00e8f000        0`00006000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 4; Handle: 0000000000e80000; Type: Segment]
       0`00f00000        0`00fff000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`02800000        0`028ff000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`02900000        0`0290f000        0`0000f000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`02980000        0`0298f000        0`0000f000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Segment]
       0`05c70000        0`05cab000        0`0003b000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Segment]
       0`05cab000        0`05d6f000        0`000c4000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 2; Handle: 0000000002980000; Type: Segment]
       0`05e30000        0`05ffb000        0`001cb000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`05ffb000        0`05ffc000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`05ffc000        0`0602f000        0`00033000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06030000        0`06074000        0`00044000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06074000        0`06075000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06075000        0`06125000        0`000b0000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06125000        0`06126000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06126000        0`06131000        0`0000b000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06131000        0`06132000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06132000        0`06218000        0`000e6000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06218000        0`06219000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06219000        0`06230000        0`00017000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06230000        0`06231000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06231000        0`0624e000        0`0001d000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`0624e000        0`0624f000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`0624f000        0`063f4000        0`001a5000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`063f4000        0`063f5000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`063f5000        0`0640f000        0`0001a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`0640f000        0`06410000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06410000        0`0641a000        0`0000a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`0641a000        0`0642f000        0`00015000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06670000        0`06706000        0`00096000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06706000        0`06707000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06707000        0`0676f000        0`00068000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`068f0000        0`06a26000        0`00136000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06a26000        0`06aef000        0`000c9000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06c70000        0`06c71000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 4; Handle: 0000000000e80000; Type: Front End]
       0`06c71000        0`06c8a000        0`00019000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 4; Handle: 0000000000e80000; Type: Front End]
       0`08b40000        0`08b81000        0`00041000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b81000        0`08b82000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b82000        0`08b8e000        0`0000c000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b8e000        0`08b8f000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_NOACCESS                      Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b8f000        0`08d22000        0`00193000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08d22000        0`08dcd000        0`000ab000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08dcd000        0`08e0b000        0`0003e000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08e0b000        0`0933f000        0`00534000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]

数量有点大呀！不过考虑到编辑器buffer中的数据肯定已经被存储到物理内存中，所以其所在的地址属性应该是MEM_COMMIT，而且其保护属性应该是可读写的，即PAGE_READWRITE，使用!address -f:Heap,MEM_COMMIT,PAGE_READWRITE再过滤一下

0:003> !address -f:Heap,MEM_COMMIT,PAGE_READWRITE

        BaseAddress      EndAddress+1        RegionSize     Type       State                 Protect             Usage
--------------------------------------------------------------------------------------------------------------------------
       0`00250000        0`00260000        0`00010000 MEM_MAPPED  MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 1; Handle: 0000000000250000; Type: Segment]
       0`00390000        0`00393000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Front End]
       0`003b0000        0`003b2000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Front End]
       0`00e00000        0`00e05000        0`00005000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Front End]
       0`00e80000        0`00e89000        0`00009000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 4; Handle: 0000000000e80000; Type: Segment]
       0`00f00000        0`00fff000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`02800000        0`028ff000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`02900000        0`0290f000        0`0000f000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`02980000        0`0298f000        0`0000f000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Segment]
       0`05c70000        0`05cab000        0`0003b000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000002980000; Type: Segment]
       0`05e30000        0`05ffb000        0`001cb000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`05ffc000        0`0602f000        0`00033000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06030000        0`06074000        0`00044000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06075000        0`06125000        0`000b0000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06126000        0`06131000        0`0000b000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06132000        0`06218000        0`000e6000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06219000        0`06230000        0`00017000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06231000        0`0624e000        0`0001d000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`0624f000        0`063f4000        0`001a5000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`063f5000        0`0640f000        0`0001a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06410000        0`0641a000        0`0000a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`06670000        0`06706000        0`00096000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06707000        0`0676f000        0`00068000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`068f0000        0`06a26000        0`00136000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000f00000; Type: Segment]
       0`06c70000        0`06c71000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 4; Handle: 0000000000e80000; Type: Front End]
       0`08b40000        0`08b81000        0`00041000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b82000        0`08b8e000        0`0000c000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08b8f000        0`08d22000        0`00193000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]
       0`08dcd000        0`08e0b000        0`0003e000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000002900000; Type: Segment]

这下需要搜索的地址就小了，我们可以从00250000到08e0b000搜索关键字

使用搜索命令

搜索命令为s -[au] <Range> "<String>"，-a搜索ASCII数据，-u搜索Unicode数据，注意在windbg中输入的中文是gbk编码的数据

Range有两种表示方法，一种是起始地址结束地址，另一种是起始地址 L地址长度，比如s -a 00001000 00002000 "abc"和s -a 00001000 L1000 "abc"是等价的

保存内存中的数据到文件中

.writemem d:\blog.txt 07288600 L2000

最后编辑于：2017.12.07 06:43:51

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 199,519评论 5赞 468
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 83,842评论 2赞 376
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 146,544评论 0赞 330
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 53,742评论 1赞 271
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 62,646评论 5赞 359
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,027评论 1赞 275
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 37,513评论 3赞 390
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,169评论 0赞 254
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 40,324评论 1赞 294
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,268评论 2赞 317
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,299评论 1赞 329
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 32,996评论 3赞 315
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 38,591评论 3赞 303
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,667评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 30,911评论 1赞 255
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 42,288评论 2赞 345
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 41,871评论 2赞 341

WinDbg数据搜索技巧 --- 《格蠹汇编-从堆里抢救丢失的博客》

强大的!address命令

缩小搜索范围

使用搜索命令

保存内存中的数据到文件中

推荐阅读更多精彩内容