Special Command: Using ??, @@c++() and poi() with C/C++ Expressions

I really like using C/C++ expressions from WinDbg. It’s a natural way to extract information from C and C++ applications if you know these programming languages; therefore, I think it’s useful to share how to do this.

First, let’s talk about poi().

poi() is used to get pointer-sized data. Think about the * operator for C and C++.

For example:

 

Therefore, poi is the best operator to use if you want pointer-sized data.

The double question mark ( ?? ) command evaluates and displays the value of an expression according to the C++ expression rules.

Now, let me show you how to get a pointer value using poi() and ?? .

The single question mark ( ? ) is used to evaluate expressions.

Tip: By using ?, you can easily convert a number from hexadecimal to decimal or vice versa. Remember to use the prefix 0x for hexadecimal and 0n for decimal.

Examples:

Finally, we have the C++ expression parser - @@c++() - that supports all forms of C++ expression syntax, such as:

- Numbers in C++ expressions

- Characters and strings in C++ expressions

- Symbols in C++ expressions. (see WinDbg documentation for details)

- Operators in C++ expressions

- Registers and pseudo-registers in C++ expressions

- Macros in C++ expressions

Examples:

 

For more information, you may want to read the Magic Pointers article.

Here you can see scripts that use the ?? , @@c++() or poi() commands.