Searching for “All Referenced Text Strings” in WinDBG

Question

In Olly Dbg, there is an option to search for "All Referenced Text Strings." Is there a way to do something similar in WinDBG?

So far, I have tried the following:

s -[l4]sa 0x0 L?0xFFFFFFFF

This, however, returns a ton of garbage. Any ideas on how to reduce this to a more manageable list of strings (and maybe where they are referenced?) the way Olly does?

Answer 1

You might have a look at this book and try the suggested tips and tricks..

There are wonderful WinDbg commands dpu (UNICODE strings) and dpa (ASCII strings) and other d** equivalents like dpp....