Question

Doing some debugging in windbg, and I’d like to be able to go through each heap allocation of a given size and then do some analysis on that (just dd for now). Problem is !heap doesnt throw out stuff very cleanly.

I know I can skip the first X or every Y tokens with .foreach flags, but can’t seem to get this to work.

Basically looking to do something like this:

.foreach (ADDR {!heap -flt s <size of allocation>}) {dd ADDR}

Is there a way, short of outputing to a file, doing some awking and then feeding it back in?

Answer 1

AFAIK I don’t think the !heap command has a short option to use in the .foreach. You could probably try using .shell command to grep the output

HTH