특정 모듈이 어떤 문자열을 가지고 있는지 확인하고 싶은 경우가 있다.
예를 들면, 어떤 기능을 하는 것인지, 어느 회사에서 만든 모듈인지 확인하고 싶은 경우처럼 말이다.
먼저 특정 모듈의 주소를 확인한다.
이 예제에서는 Beep.sys를 확인해 본다.
kd> lm
start end module name
804d9000 806e4000 nt (pdb symbols)
806e4000 80704d00 hal (deferred)
...
f7afa000 f7afbf00 Fs_Rec (deferred)
f7afc000 f7afd080 Beep (deferred)
...
이 모듈에 포함된 ASCII 형태의 문자열을 다음과 같이 확인할 수 있다.
kd> s -sa f7afc000 f7afd080
f7afc04d "!This program cannot be run in D"
f7afc06d "OS mode."
f7afc0b8 "Rich"
f7afc1c8 ".text"
f7afc1ef "h.rdata"
f7afc217 "HINIT"
f7afc240 ".rsrc"
f7afc267 "B.reloc"
f7afc30f "N@Q"
f7afc323 "F%P"
f7afc331 "F%P"
f7afc357 "QQSVW"
f7afc3a3 "t)3"
f7afc3f6 "_^3"
f7afc470 "p(W"
f7afc4cd "NHu%W"
f7afc524 "p(W"
f7afc5bb "tQRP"
f7afc608 "p(j"
f7afc672 "SWhR"
f7afc697 "PjXW"
f7afc6b1 "p(Ph"
f7afc6cc "@SP"
f7afc6d3 "F4P"
f7afc6f0 "G4 "
f7afc6f7 "G8j"
f7afc717 "^_["
f7afc780 "tin"
f7afc790 "@in"
f7afc7c0 "ngW"
f7afc80c "RSDS"
f7afc815 "9LN"
f7afc824 "beep.pdb"
f7afc922 "IofCompleteRequest"
f7afc938 "IoReleaseCancelSpinLock"
f7afc952 "KeRemoveEntryDeviceQueue"
f7afc96e "KeRemoveDeviceQueue"
f7afc984 "IoAcquireCancelSpinLock"
f7afc99e "IoStartPacket"
f7afc9ae "MmLockPagableDataSection"
f7afc9ca "KeCancelTimer"
f7afc9da "MmUnlockPagableImageSection"
f7afc9f8 "IoStartNextPacket"
f7afca0c "KeSetTimer"
f7afca1a "_allmul"
f7afca24 "IoDeleteDevice"
f7afca36 "KeInitializeEvent"
f7afca4a "KeInitializeTimer"
f7afca5e "KeInitializeDpc"
f7afca70 "IoCreateDevice"
f7afca82 "RtlInitUnicodeString"
f7afca98 "ntoskrnl.exe"
f7afcaa8 "HalMakeBeep"
f7afcab6 "KfLowerIrql"
f7afcac4 "KfRaiseIrql"
f7afcad2 "ExReleaseFastMutex"
f7afcae8 "ExAcquireFastMutex"
f7afcafc "HAL.dll"
f7afcf89 "3(363K3`3f3"
f7afcf9f "3I4V4`4z4"
f7afcfb9 "505@5U5"
f7afcfcb "676I6u6"
f7afcfe9 "7 7"
이 모듈에 포함된 UNICODE 형식의 문자열은 다음과 같이 확인할 수 있다.
kd> s -su f7afc000 f7afd080
f7afc044 "됀촉렡䰁"
f7afc04e "桔獩瀠潲牧浡挠湡潮"
...
f7afcad2 "硅敒敬獡䙥獡䵴瑵硥"
f7afcae8 "硅捁畱物䙥獡䵴瑵硥"
f7afcbe6 "VS_VERSION_INFO"
f7afcc42 "StringFileInfo"
f7afcc66 "040904B0"
f7afcc7e "CompanyName"
f7afcc98 "Microsoft Corporation"
f7afccca "FileDescription"
f7afccec "BEEP Driver"
f7afcd0a "FileVersion"
f7afcd24 "5.1.2600.0 (XPClient.010817-1148"
f7afcd64 ")"
f7afcd6e "InternalName"
f7afcd88 "beep.sys"
f7afcda2 "LegalCopyright"
f7afcdc0 "© Microsoft Corporation. All rig"
f7afce00 "hts reserved."
f7afce22 "OriginalFilename"
f7afce44 "beep.sys"
f7afce5e "ProductName"
f7afce78 "Microsoft® Windows® Operating Sy"
f7afceb8 "stem"
f7afceca "ProductVersion"
f7afcee8 "5.1.2600.0"
f7afcf06 "VarFileInfo"
f7afcf26 "Translation"
문자열들을 보면 대충 어떤 모듈인지 파악할 수 있다.
