如何从 WinDBG 中的转储评估 RtlDecodePointer？

Question

我有一个用户模式 ​​Windows 程序的故障转储，我想模拟 RtlDecodePointer()，即解码一些用 RtlEncodePointer() 编码的指针。我怎么做？

Answer 1

我能够编写以下 WinDBG 表达式：

r $t0 = 86aaaa40`0007ff77 // put value to decoded here
r $t1 = dwo(ntdll!`RtlpGetCookieValue'::`2'::CookieValue)
r $t2 = @$t1 & 3f
r $t3 = (@$t0 >> (0x40 - @$t2)) | (@$t0 << @$t2)
.printf "Decoded pointer: %p
", @$t3 ^ @$t1

或者，作为单行：

r $t0 = 86aaaa40`0007ff77 // put value to decoded here
r $t1 = dwo(ntdll!`RtlpGetCookieValue'::`2'::CookieValue); r $t2 = @$t1 & 3f; r $t3 = (@$t0 >> (0x40 - @$t2)) | (@$t0 << @$t2); .printf "Decoded pointer: %p
", @$t3 ^ @$t1

即使在没有完整内存的小型转储上，这也能很好地工作。