How to view the memory of a process? #5931
Closed
danielniccoli
started this conversation in
General
Replies: 2 comments 5 replies
-
|
Hey Daniel, Looks like the program is running. If you hit the pause button in the Objects window, do you get anything more. Does look like a bit of a bug in dbgmodel insofar as we should probably be reporting something more helpful. Does dbgeng behave the same for your target? Also, is running your target from start in the Debugger an option or do you have to attach? D |
Beta Was this translation helpful? Give feedback.
5 replies
-
|
Attaching was the only way I got it working somewhat. Starting the process immediately froze the process (noita.exe). After reading your comment and trying again, I was unable to attach or start the process with both, dbgmodel and dbgeng. Below is some data from trying to attach it to dbgeng/GADP. I don't understand why it is so complicated. I was using Cheat Engine until now and there it's just a click of a button to attach. But having to switch back and forth between Cheat Engine and Ghidra to get the memory addresses for the functions I want to inspect is time consuming. Which is why I'd like to do all of that just in Ghidra. Debug ConsoleInterpreterdbgeng.dll Agent |
Beta Was this translation helpful? Give feedback.
-
|
There are a couple of reasons NOT to use the GADP version - one major one being it's considerably harder to debug. For starters, I would stick to the IN-VM dbgeng version. I might also use ghidraDebug, instead of ghidraRun, so you can see error messages that might not be making it to the DebugConsole. Will try to grab a copy of noita.exe tomorrow to see if I can replicate your issues. |
Beta Was this translation helpful? Give feedback.
-
|
Follow up question: have you tried debugging this in windbg proper? |
Beta Was this translation helpful? Give feedback.
-
ghidra-noita-debug_1.mp4 |
Beta Was this translation helpful? Give feedback.
-
|
Here's how I do it in Cheat Engine. Super simple and no problems. cheatengine-noita-debug_1.mp4I have not yet tried Windbg. I'll download and try. |
Beta Was this translation helpful? Give feedback.
-
|
Ah, the videos were very helpful! (Apologies - I read this on my phone before and didn't see the videos.) I think you basically did almost everything right in that first video....going over what you did: At this point, you probably should have cleared the filter, although clearly that wasn't obvious. When applied to a tree, the filter shows only those open nodes in the tree that match the filter. At a guess, the node you needed didn't open and therefore wasn't visible. If you clear the filter, you should still have noita.exe under "Available" but also the active target under Sessions[0].Processes. You should also have Threads, Modules, etc. under that node. The "Available" nodes, as in most windows debuggers, are basically just a list of processes running on the machine - they don't actually represent the targets under debug. (A little confusing, I know, but we're following the windbg conventions.) Once you have that node, you need to make sure the target is stopped, either by selecting the target node in Objects and hitting the (hopefully enabled) pause button or by hitting the pause button in the Interpreter. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
How can I see the memory of a process that I attached the debugger to?
After attaching Ghidra Debugger to noita.exe I was expecting to see the value in the Listing view.
Beta Was this translation helpful? Give feedback.
All reactions