I noticed a commonly used workflow is to find the next/last memory access in before or after the current time stamp. While this can be done by pulling all of the accesses, and then find the one that is before or after the current timestamp, it is very repetitive. For example,
dx @$cursession.TTD.Memory(addr1, addr2, "w").Last()
It works, but it is very inefficient because it unnecessarily collects all of the results
We should use PrevMemoryAccess and NextMemoryAccess instead
>>> dx @$curprocess.TTD.NextMemoryAccess("r", 0x7ff7e2242220, 0x1)
@$curprocess.TTD.NextMemoryAccess("r", 0x7ff7e2242220, 0x1) : [UTID 2] Read 0x7ff7e2242220 1 bytes [16:18] -> [29:23B]
Position : 29:23B
OriginalPosition : 16:18
UniqueThreadId : 0x2
Address : 0x7ff7e2242220
Size : 0x1
AccessType : Read