Name

function::kernel_string_quoted — Retrieves and quotes string from kernel memory

Synopsis

    kernel_string_quoted:string(addr:long)

Arguments

addr

the kernel memory address to retrieve the string from

Description

Returns the null terminated C string from a given kernel memory address where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Note that the string will be surrounded by double quotes. If the kernel memory data is not accessible at the given address, the address itself is returned as a string, without double quotes.