Input
This program accepts various options of input:
commands:
Commands have the following format: "command[space]arg1,[optional space]arg2,argN".
variables:
Variables optionally start with a $ and can only store one DWORD (QWORD on
x64).
debug registers: All debug registers (all sizes) can be used as
variables.
memory locations: You can read from a memory location by using one of the
following expressions:
[addr] - read a
DWORD/QWORD, depending on the architecture.
@addr - same as
above.
n:[addr] - read n
bytes.
@n:addr - same as
above.
REMARKS:
- n is the amount of bytes to
read, this can be anything smaller then 4 on x32 and smaller then 8 on x64 when
specified, otherwise there will be an error.
- addr is directly interpreted
as a value, when you want to read [addr+1] you should use
brackets:
@(addr+1), @addr+1 will read: [addr]+1.
flags: Debug flags (interpreted as integer) can be used as input. Flags are prefixed with a '!' following the flag name or the bit number their on. Valid flags are: !cf, !pf, !af, !zf, !sf, !tf, !if, !df, !of, !rf, !vm, !ac, !vif, !vip and !id.
numbers: All numbers are interpreted as hex by default. If you want to be sure, you can use the "x" prefix. Decimal numbers can be used by prefixing the number with a "." (.123=7B).
basic calculations : See "Calculations" for more information.
DLL exports: Type 'GetProcAddress' and it will automatically be resolved to the actual address of the function. To explicitly define from which module to load the API, use: "kernel32.dll:GetProcAddress" or "kernel32:GetProcAddress". In a similar way you can resolve ordinals, try "ntdll:1". Another macro allows you to get the loaded base of a module. Try "ntdll:0", "ntdll:base", "ntdll:imagebase" or "ntdll:header".
labels/symbols : user-defined labels and symbols are a valid expressions.
Input for arguments can always be done in any of the above forms, except if stated otherwise.