Windbg-.foreach Loop input (WinDbg script)

. foreach

The. foreach keyword parses the output of one or more commands and takes each value in that output as input to another or more commands

. foreach [Options] ( Variable { incommands }) { outcommands }

. foreach [Options] /s ( Variable "instring" ) { C15>outcommands }

. foreach [Options] /F ( Variable "InFile" ) { Outcommands }

Options
Can be any combination of the following options:
/ps Initialskipnumber
Causes some symbols at the beginning to be skipped. Initialskipnumber Specifies the number of output keywords that are not passed to outcommands .
/ps Skipnumber
Some symbols are skipped each time a command is executed. Each time a symbol is passed to outcommands , the number ofSkipnumber is ignored

We first search for the address with the character T:

1. 0:000> S-[1]a 0029eeec L1000 "T"
2. 0x0029eefb
3. 0x0029ef03
4. 0x0029ef0b
5. 0x0029ef15
6. 0x0029f034
7. 0x0029f06a
8. 0x0029f07a
9. 0x0029f08a
10. 0x0029f09e
11. 0x0029f356
12. 0x0029f7f0
13. 0x0029f989
14. 0x0029fa50

And then we use. foreach to get them da out.

2. 0:000>. foreach (place{s-[1]a 0029eeec L1000 "T"}) {da ${place}}
4. ^ Syntax error in '. foreach (place{s-[1]a 0029eeec L1000 "T"}) {da ${place}} '
6. 0:000>. foreach (Place {s-[1]a 0029eeec L1000 "T"}) {da ${place}}
8. 0029EEFB "Tencent\tsvulfw\tsvulfw.dat"
10. 0029ef03 "Tsvulfw\tsvulfw.dat"
12. 0029ef0b "TSVulFW.DAT"
14. 0029ef15 "T"
16. 0029f034 "T"
18. 0029f06a "T"
20. 0029f07a "T"
22. 0029f08a "T"
24. 0029f09e "T"
26. 0029f356 "Txsigndemo"
28. 0029f7f0 "T.)"
30. 0029f989 "Ti.."
32. 0029fa50 "T.)"

Note that there must be spaces between place and {!

Now from the third start, every other one shows one:

1. 0:000> Foreach/ps3/ps1 (Place {s-[1]a 0029eeec L1000 "T"}) {da ${place}}
2. 0029ef15 "T"
3. 0029f06a "T"
4. 0029f08a "T"
5. 0029f356 "Txsigndemo"
6. 0029f989 "Ti.."

InFile
Used with/ f . Specifies the text file to parse, and the result is passed to outcommands . The file name InFile must be enclosed in quotation marks we create a 2.txt in the C-disk with the contents:

1. 0x0029eefb
2. 0x0029ef03
3. 0x0029ef0b
4. 0x0029ef15
5. 0x0029f034
6. 0x0029f06a
7. 0x0029f07a
8. 0x0029f08a
9. 0x0029f09e
10. 0x0029f356
11. 0x0029f7f0
12. 0x0029f989
13. 0x0029fa50

To run the command:

1. 0:000> foreach/f (Place "C:\2.txt") {da ${place}}
2. 0029EEFB "Tencent\tsvulfw\tsvulfw.dat"
3. 0029ef03 "Tsvulfw\tsvulfw.dat"
4. 0029ef0b "TSVulFW.DAT"
5. 0029ef15 "T"
6. 0029f034 "T"
7. 0029f06a "T"
8. 0029f07a "T"
9. 0029f08a "T"
10. 0029f09e "T"
11. 0029f356 "Txsigndemo"
12. 0029f7f0 "T.)"
13. 0029f989 "Ti.."
14. 0029fa50 "T.)"

When incommands 's output,instring string, or InFile are parsed, any number of spaces, tab characters, or carriage returns will be treated as a single delimiter. The text is separated into small fragments that are used to replace the Variable in the outcommands

Used with/ s . Specifies a string to parse, and the result is passed to outcommands

1. 0:000> foreach/s (Place "0029ef03;0029ef0b") {da ${place}}
2. 0029ef03 "Tsvulfw\tsvulfw.dat"
3. ^ Syntax error in ' da 0029ef03;0029ef0b '
4. 0:000> foreach/s (place "0029ef03 0029ef0b") {da ${place}}
5. 0029ef03 "Tsvulfw\tsvulfw.dat"
6. 0029ef0b "TSVulFW.DAT"

So, just put the space, tab as a delimiter, not a semicolon! This principle applies to string and file

Windbg-.foreach Loop input (WinDbg script)