I’m trying to evaluate the contents of a call stack in WindDbg using the d* commands. I know that the address to the data I want to dump is at [ebp+8]. However when using this command WinDbg is dumping the data at ebp with an 8 byte offset. I want to dump the data pointed to by ebp+8. I’ve been manually dd ebp then manually typing the address in a subsequent du address.
Is there a way to instruct WinDbg to automatically dereference a pointer when dumping data?
You can use dp* command to display data pointed by pointer at ebp+8. You can also use d*p.