I know that windbg command "d esp" display the content that esp points. But, what range of it? How does it get the end?
The d
command displays memory. If you don't enter a range the default is 128 bytes. Most of the d
commands use a default of 128 bytes, but e.g. the df
uses 64 bytes.
So d esp
essentially means display 128 bytes of memory starting from the address held in esp
.