Home > OS >  How to display current value of a specific variable which is located in particular _KTHREAD object?
How to display current value of a specific variable which is located in particular _KTHREAD object?

Time:12-30

OK so the following command (see below) displays all variable names and their type information of the structure _KTHREAD in Windbg. But if I have the address of a specific _KTHREAD object how can I display the value of a particular variable located in this struct ?

lkd> dt _KTHREAD

I then tried the following command in Windbg with a known address of a_KTHREAD object. Is this command correct ?

lkd> dt _KTHREAD FFFFA80000050000 WaitPrcb

CodePudding user response:

Just add the address

dt _KTHREAD 0x12345

or if the address is in a register

dt _KTHREAD @eax

  • Related