Comments on: Data Recovery with Memory Dump Analysis

By: Dmitry Vostokov

Dmitry Vostokov — Wed, 11 Jun 2008 07:40:28 +0000

Because it was not “ello” but its Russian equivalent. It uses different charset. For example, du on addresses containing Russian Unicode strings doesn’t show Russian characters in command output window.

By: ABeginner

ABeginner — Wed, 11 Jun 2008 02:14:54 +0000

why you not use
{s -u 003c0000 L?7FFFFFFF “ello” }
?

By: Dmitry Vostokov

Dmitry Vostokov — Tue, 10 Jun 2008 12:35:15 +0000

Thanks! This was indeed my first use of WinDbg in data recovery. I tried strings.exe from sysinternals on a dump file but it didn’t pull out correct Unicode data. Perhaps that tool works well only with English Unicode.

By: Soren Dreijer

Soren Dreijer — Tue, 10 Jun 2008 09:56:58 +0000

Great read. This is an innovative and unique way to put the debugger to good use.