<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
looking into the source code i found out the corresponding function
"dbgcCmdWorkerSearchMem" in
src/VBox/Debugger/DBGCEmulateCodeView.cpp<br>
the 'range' parameter correspond to the 'pAddress' parameter of this
function, which is claimed to be "Where to start searching".<br>
I tested the 'sa' command in such a way and it seemed to work as
expected. See below:<br>
<br>
-------------------------------------------------------------------------------------------------------------------------------<br>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">VBoxDbg>
sa 1 kd</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%00000000009df960:
6b 64 19 6d 80 64 19 6d-75 64 19 6d 8b 64 19 6d kd.m.d.mud.m.d.m</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000000a08a4f:
6b 64 02 8e f0 80 40 32-95 80 8d 5a 0e 75 81 16 <a
class="moz-txt-link-abbreviated" href="mailto:kd....@2...Z.u">kd....@2...Z.u</a>..</p>
....
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%00000000011045df:
6b 64 65 66 2e 55 00 84-21 53 6e 6f 77 64 6f 6f kdef.U..!Snowdoo</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001112076:
6b 64 6f 6f 72 00 a4 21-5a 69 6e 64 6f 73 2e 41 kdoor..!Zindos.A</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;"><br>
VBoxDbg> sa 1000000 kd</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%00000000011045df:
6b 64 65 66 2e 55 00 84-21 53 6e 6f 77 64 6f 6f kdef.U..!Snowdoo</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001112076:
6b 64 6f 6f 72 00 a4 21-5a 69 6e 64 6f 73 2e 41 kdoor..!Zindos.A</p>
...<br>
%0000000001c7436f: 6b 64 18 86 15 c1 09 4c-0d 49 00 1c 90 dc 62 1a
kd.....L.I....b.
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001ccd585:
6b 64 0f 00 cf 84 60 01-8e 43 92 30 34 6c 3f 10 kd....`..C.04l?.</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;"><br>
VBoxDbg> sa 1cc0000 kd</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001ccd585:
6b 64 0f 00 cf 84 60 01-8e 43 92 30 34 6c 3f 10 kd....`..C.04l?.</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001cd8c90:
6b 64 1d 48 4e 80 51 62-e5 10 94 73 41 83 01 c0 kd.HN.Qb...sA...</p>
...<br>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001eb725b:
6b 64 44 0d 00 01 00 00-00 dd b9 6d e9 3d 01 00 kdD........m.=..</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">%0000000001edc4e9:
6b 64 44 00 27 05 8c f0-c4 ed 01 f0 c4 ed 01 28 kdD.'..........(</p>
----------------------------------------------------------------------------------------------------------------------------<br>
<br>
When you will test it on your own, you will notice that the command
will output a maximum of 25 hits per search.<br>
This is encoded in the wrapper function "dbgcCmdSearchMemType"
within the same file and, unfortunately, it cannot be changed by any
debugger parameter.<br>
The only way to do it, is to modify the sources.<br>
<br>
Hope this helps,<br>
Regards,<br>
Federico<br>
<br>
<div class="moz-cite-prefix">On 07/05/2015 14:31, Lonnie Cumberland
wrote:<br>
</div>
<blockquote
cite="mid:CAK_VvoMEar2jZ47Ar0LORNnFV4NuMNtoAzxF4w5CNhVpOXPCBA@mail.gmail.com"
type="cite">
<div dir="ltr">Hello All,
<div><br>
</div>
<div>Can someone please tell me if there are any examples or
tutorials on using the VirtualBox built-in debugger? I have
read over the information in Chapter 12 of the manual, but it
really does not show any specifics related to the address
"range" format used in the SA (Search) command to access Guest
ram. I need to scan the Guest ram while the VM is active to
collect come information. The Host is a Windows 7 (64Bit) and
test Guest is also a Windows 7 (64bit).</div>
<div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Any information or experiences using
the built-in debugger would be greatly appreciated.</div>
<div class="gmail_extra">
<div>
<div class="gmail_signature">
<div dir="ltr">
<div dir="ltr">
<div><br>
</div>
Thanks and have a great day,<br>
Lonnie <br>
<br>
< CONFIDENTIALITY NOTICE > The information
contained in this communication is confidential and
is intended only for the use of the recipient named
above, and may be legally privileged and exempt from
disclosure under applicable law. If the reader of
this message is not the intended recipient, please
resend to sender and delete the original from your
computer system. You are hereby notified that any
dissemination, distribution or copying of this
communication is strictly prohibited. Opinions,
conclusions and other information in this message
that do not relate to our official business should
be understood as neither given nor endorsed.</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Wed, May 6, 2015 at 9:44 AM,
Lonnie Cumberland <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:lonnie@biofuelstechnologyinc.com"
target="_blank">lonnie@biofuelstechnologyinc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi Again All,
<div><br>
</div>
<div>I think that I have answered my own question in
that I have now been looking through the VBox
debugger commands and actually what I wanted to do
was to search through the guest memory for a
specific string.</div>
<div><br>
</div>
<div>To do this, I have found the </div>
<div><br>
</div>
<div>sa <range> <pattern> ---- search
memory for ASCII string.</div>
<div><br>
</div>
<div>Is there any information, or example, on the
format needed for the <range> ?
<div class="gmail_extra"><span class="">
<div>
<div>
<div dir="ltr">
<div dir="ltr">
<div><br>
</div>
Kind Regards and have a great day,<br>
Lonnie<br>
<br>
< CONFIDENTIALITY NOTICE > The
information contained in this
communication is confidential and is
intended only for the use of the
recipient named above, and may be
legally privileged and exempt from
disclosure under applicable law. If the
reader of this message is not the
intended recipient, please resend to
sender and delete the original from your
computer system. You are hereby
notified that any dissemination,
distribution or copying of this
communication is strictly prohibited.
Opinions, conclusions and other
information in this message that do not
relate to our official business should
be understood as neither given nor
endorsed.</div>
</div>
</div>
</div>
<br>
</span>
<div>
<div class="h5">
<div class="gmail_quote">On Wed, May 6, 2015
at 9:29 AM, Lonnie Cumberland <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:lonnie@biofuelstechnologyinc.com"
target="_blank">lonnie@biofuelstechnologyinc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="margin:0 0 0 .8ex;border-left:1px
#ccc solid;padding-left:1ex">
<div dir="ltr">Greetings All,
<div><br>
</div>
<div>I am getting a feel for the
VirtualBox debugger (dbg) in that I
need to be able to look through an
active guest memory.</div>
<div><br>
</div>
<div>Can someone please tell me the best
approach to looking through a guest
memory with dbg?<br clear="all">
<div>
<div>
<div dir="ltr">
<div dir="ltr">
<div><br>
</div>
Kind Regards and have a great
day,<br>
Lonnie<br>
<br>
< CONFIDENTIALITY NOTICE
> The information contained
in this communication is
confidential and is intended
only for the use of the
recipient named above, and may
be legally privileged and
exempt from disclosure under
applicable law. If the reader
of this message is not the
intended recipient, please
resend to sender and delete
the original from your
computer system. You are
hereby notified that any
dissemination, distribution or
copying of this communication
is strictly prohibited.
Opinions, conclusions and
other information in this
message that do not relate to
our official business should
be understood as neither given
nor endorsed.</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
vbox-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</a>
<a class="moz-txt-link-freetext" href="https://www.virtualbox.org/mailman/listinfo/vbox-dev">https://www.virtualbox.org/mailman/listinfo/vbox-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>