Share via

.S (Memory Search)

  • Article

Searches through memory to find a specific byte pattern.

.S [ -A | -D | -Q | -U | -W ] StartAddress [EndAddress | LByteCount] Pattern

Arguments

  • StartAddress
    Required. Specifies the starting address of the memory area to search.

  • EndAddress
    Optional. Specifies the end address of the memory area to search. The range from StartAddress to EndAddress cannot be greater than 256 MB in length. Either EndAddress or LByteCount must be specified.

  • LByteCount
    Optional. Specifies the number of bytes to search. For example, you would type L400 to search 400 bytes. Either EndAddress or LByteCount must be specified.

  • Pattern
    Required. Specifies one or more values to search for. These values match the type of value specified by the switch.

    Enclose a WORD, DWORD, or QWORD pattern in single quotation marks.

    Enclose a string pattern in double quotation marks.

Switches

  • -A
    Optional. Specifies that the memory type to search for is an ASCII string.

  • -D
    Optional. Specifies that the memory type to search for is a DWORD (32 bits).

  • -Q
    Optional. Specifies that the memory type to search for is a QWORD (64 bits).

  • -U
    Optional. Specifies that the memory type to search for is a Unicode string.

  • -W
    Optional. Specifies that the memory type to search for is a WORD (16 bits).

Remarks

If no switch is specified, the command will search for byte values.

Example

The following example searches for the string MyString in the range 0x400000 to 0x400200.

.s -A 0x400000 0x400200 "MyString"

The following example searches for DWORD 0x12345678 at the location 4198416 (decimal), and searches for 200 bytes.

.s -D 4198416 L200 0x12345678

The following example searches for byte 18 (decimal) in the range 0x401000 to 0x402000.

.s 0x401000 0x402000 18

See Also

Other Resources

NTSD Command Support