.imgscan (Find Image Headers)

The .imgscan command scans virtual memory for image headers.

.imgscan [Options] 

Parameters

Options

Any of the following options:

/r Range

Specifies the range to search. For more information about the syntax, see Address and Address Range Syntax. If you specify only one address, the debugger searches a range that begins at that address and extends 0x10000 bytes.

/l

Loads module information for any image header that is found.

/v

Displays verbose information.

Environment

Modes

User mode, kernel mode

Targets

Live, crash dump

Platforms

All

 

Remarks

If you do not use the /r parameter, the debugger searches all virtual memory regions.

The .imgscan command displays any image headers that it finds and the header type. Header types include Portable Executable (PE) headers and Microsoft MS-DOS MZ headers.

The following example shows the .imgscan command.

0:000> .imgscan
MZ at 00400000, prot 00000002, type 01000000 - size 2d000
MZ at 77f80000, prot 00000002, type 01000000 - size 7d000
  Name: ntdll.dll
MZ at 7c570000, prot 00000002, type 01000000 - size b8000
  Name: KERNEL32.dll

 

 

Send comments about this topic to Microsoft

Show: