OK so the following command (see below) displays all variable names and their type information of the structure _KTHREAD in Windbg. But if I have the address of a specific _KTHREAD object how can I display the value of a particular variable located in this struct ?
lkd> dt _KTHREAD
I then tried the following command in Windbg with a known address of a_KTHREAD object. Is this command correct ?
lkd> dt _KTHREAD FFFFA80000050000 WaitPrcb
CodePudding user response:
Just add the address
dt _KTHREAD 0x12345
or if the address is in a register
dt _KTHREAD @eax