You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have been able to visualize some strings with the debugger's watch, but some others won't show up.
In the shot above, I tried setting the expression as [eax+08], ds:[eax+08], dword ptr ds:[eax+08], and they all return that ds.<block> value. I also tried showing the data in Unicode, it just changes the value as if new encoding, but not matching the preview in the assembly walk pane.
If I display EAX (1d46e800) in dump, and hover the mouse cursor over EAX+8, I get this tooltip suggesting it's a long chain of pointers:
Somewhere else, I pick [eax+4] as a string, and now I can query it:
Comparing both screenshots, it becomes evident the difference: [expr]:"string" and [expr]:&"string".
So how do I query this kind of strings? I guess I need to "resolve the address". Is there a way I can watch an expression with the same guesswork the "assembly walk" (not sure how to call it) panel does? Then I wouldn't need to keep changing its type, etc.
I guess here I could use something like pointer expression functions but the debugger already makes so good guesses I could really use its brains. :P
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
I have been able to visualize some strings with the debugger's watch, but some others won't show up.
In the shot above, I tried setting the expression as
[eax+08]
,ds:[eax+08]
,dword ptr ds:[eax+08]
, and they all return thatds.<block>
value. I also tried showing the data in Unicode, it just changes the value as if new encoding, but not matching the preview in the assembly walk pane.If I display EAX (

1d46e800
) in dump, and hover the mouse cursor over EAX+8, I get this tooltip suggesting it's a long chain of pointers:Somewhere else, I pick

[eax+4]
as a string, and now I can query it:Comparing both screenshots, it becomes evident the difference:
[expr]:"string"
and[expr]:&"string"
.So how do I query this kind of strings? I guess I need to "resolve the address". Is there a way I can watch an expression with the same guesswork the "assembly walk" (not sure how to call it) panel does? Then I wouldn't need to keep changing its type, etc.
I guess here I could use something like pointer expression functions but the debugger already makes so good guesses I could really use its brains. :P
Beta Was this translation helpful? Give feedback.
All reactions