A WinDbg JS script for locating pointers across memory ranges. Port of ptrfind to Windows.
Lets you search for pointers from any adress range into any other adress range. Very usefull if u have arbitrary read/write primitive and need to pivot into other memory regions like kernel32, stack, or heap.
Supports pointer chains and symbolic searching using aliases instead of ugly memory adresses.
In Windbg: .scriptload <path-to-ptrfind.js>
Use !ptrfind
You can use direct adress ranges or aliases.
Currently supported aliases are: "stack" (currently selected thread), and any module name like "ntdll", "kernel32, ...
Sometimes there is no direct pointer into the target area but there might be chains of pointers. This tool lets you find them aswell.
Just add the "-c" option to specify the maximum chain depth to recursively search for.
