#postmortem analysis

[binaryhumility-blog]

WinDbg - Find a string in a process's memory

s -a 0x00000000 L?0xffffffff "needle"

The above should search the whole of the 32bit process's valid memory for the string (needle).

This can be used in postmortem mode (looking at a dump), or in live-attach mode.