Comments on: Reading Notebook: 17-August-09 http://www.softwaregeneralist.com/2009/08/17/reading-notebook-17-august-09/ Connecting Software with Engineering, Science, Religion, Philosophy and Politics Tue, 07 Feb 2012 23:42:37 +0000 http://wordpress.org/?v=2.5 By: Dmitry Vostokov http://www.softwaregeneralist.com/2009/08/17/reading-notebook-17-august-09/#comment-180 Dmitry Vostokov Wed, 19 Aug 2009 23:02:31 +0000 http://www.softwaregeneralist.com/?p=69#comment-180 Thanks for shortcuts! Will try next time Dmitry Thanks for shortcuts! Will try next time
Dmitry

]]> By: Alex Ionescu http://www.softwaregeneralist.com/2009/08/17/reading-notebook-17-august-09/#comment-176 Alex Ionescu Tue, 18 Aug 2009 14:53:13 +0000 http://www.softwaregeneralist.com/?p=69#comment-176 You can use !object to get the object header address in a more portable way, and/or use C++-style @@sizeof(OBJECT_HEADER) instead of hardcoding the 38 or 18 value for x64/x86. Also !ustr will give you nicer output for a UNICODE_STRING, assuming the structure isn't corrupted (which is a bigger problem!) -- Best regards, Alex Ionescu You can use !object to get the object header address in a more portable way, and/or use C++-style @@sizeof(OBJECT_HEADER) instead of hardcoding the 38 or 18 value for x64/x86.

Also !ustr will give you nicer output for a UNICODE_STRING, assuming the structure isn’t corrupted (which is a bigger problem!)

–
Best regards,
Alex Ionescu

]]>