Skip to content

Commit

Permalink
Update string formatting documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
mrexodia committed Jun 18, 2022
1 parent c752433 commit d38ca41
Showing 1 changed file with 15 additions and 25 deletions.
40 changes: 15 additions & 25 deletions introduction/Formatting.rst
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ String Formatting

This section explains the simple string formatter built into x64dbg.

The basic syntax is ``{?:expression}`` where ``?`` is the optional type of the expression. The default type is ``x``. To output ``{`` or ``}`` in the result, escape them as ``{{`` or ``}}``.
The basic syntax is ``{?:expression}`` where ``?`` is the optional type of the expression. To output ``{`` or ``}`` in the result, escape them as ``{{`` or ``}}``.

-----
Types
Expand All @@ -13,7 +13,7 @@ Types
- ``u`` **u**\ nsigned decimal: ``57329171``
- ``p`` zero prefixed **p**\ ointer: ``0000000410007683``
- ``s`` **s**\ tring pointer: ``this is a string``
- ``x`` he\ **x**: ``3C28A``
- ``x`` he\ **x**: ``3C28A`` (default for integer values)
- ``a`` **a**\ ddress info: ``00401010 <module.EntryPoint>``
- ``i`` **i**\ nstruction text: ``jmp 0x77ac3c87``
- ``f`` single precision floating-point pointer or register: If ``10001234`` is an address of a single precision floating-point number 3.14, ``{f:10001234}`` will print ``3.14``. It can also accept XMM and YMM registers: ``{f:XMM0}`` prints the single precision floating-point number at XMM0 bit 31:0, ``{f:YMM7[7]}`` prints the single precision floating-point number at YMM7 bit 255:224. x87 and AVX-512 registers are currently not supported.
Expand All @@ -25,29 +25,18 @@ Types
Complex Type
------------

``{mem;size@address}`` will print the ``size`` bytes starting at ``address`` in hex.

``{winerror@code}`` will print the name of windows error code(returned with ``GetLastError()``) and the description of it(with ``FormatMessage``). It is similar to ErrLookup utility.

``{ntstatus@code}`` will print the name of NTSTATUS error code and the description of it(with ``FormatMessage``).

``{ascii[;length]@address}`` will print the ASCII string at ``address`` with an optional ``length`` (in bytes).

``{ansi[;length]@address}`` will print the ANSI string at ``address`` with an optional ``length`` (in bytes).

``{utf8[;length]@address}`` will print the UTF-8 string at ``address`` with an optional ``length`` (in bytes).

``{utf16[;length]@address}`` will print the UTF-16 string at ``address`` with an optional ``length`` (in words).

``{disasm@address}`` will print the disassembly at ``address`` (equivalent to ``{i:address}``).

``{modname@address}`` will print the name of the module at ``address``.

``{bswap[;size]@value}`` will byte-swap ``value`` for a specified ``size`` (size of pointer per default).

``{label@address}`` will print the (auto)label at ``address``.

``{comment@address}`` will print the (auto)comment at ``address``.
- ``{mem;size@address}`` will print the ``size`` bytes starting at ``address`` in hex.
- ``{winerror@code}`` will print the name of windows error code(returned with ``GetLastError()``) and the description of it(with ``FormatMessage``). It is similar to ErrLookup utility.
- ``{ntstatus@code}`` will print the name of NTSTATUS error code and the description of it(with ``FormatMessage``).
- ``{ascii[;length]@address}`` will print the ASCII string at ``address`` with an optional ``length`` (in bytes).
- ``{ansi[;length]@address}`` will print the ANSI string at ``address`` with an optional ``length`` (in bytes).
- ``{utf8[;length]@address}`` will print the UTF-8 string at ``address`` with an optional ``length`` (in bytes).
- ``{utf16[;length]@address}`` will print the UTF-16 string at ``address`` with an optional ``length`` (in words).
- ``{disasm@address}`` will print the disassembly at ``address`` (equivalent to ``{i:address}``).
- ``{modname@address}`` will print the name of the module at ``address``.
- ``{bswap[;size]@value}`` will byte-swap ``value`` for a specified ``size`` (size of pointer per default).
- ``{label@address}`` will print the (auto)label at ``address``.
- ``{comment@address}`` will print the (auto)comment at ``address``.

--------
Examples
Expand All @@ -58,6 +47,7 @@ Examples
- ``function type: {mem;1@[ebp]+0xa}`` formats to ``function type: 01``
- ``{x:bswap(rax)}`` where ``rax=0000000078D333E0`` formats to ``E033D37800000000`` because of bswap fun which reverse the hex value
- ``{bswap;4@rax}`` where ``rax=1122334455667788`` formats to ``88776655``
- ``mnemonic: {dis.mnemonic(dis.sel())}`` formats to ``mnemonic: push``

-------
Logging
Expand Down

0 comments on commit d38ca41

Please sign in to comment.