How Javascript strings are encoded in Chrome?

I am analyzing via WinDbg the memory address space of Chrome. Like I did with other processes, I need to extract all the strings that are currently allocated in memory.

To do that I am using WinDbg as a non-invasive debugger and the command

s -u 0x0 L?0xffffffff "string"

if unicode, and

s -a 0x0 L?0xffffffff "string"

if asci.

However, it looks like I miss all the strings that are allocated as javascript string objects. This makes me think that in V8 (the chrome engine) the encoding is different, and thus开发者_Python百科 the byte representation of my search string is different too.

Any idea on how does it work? I've been diving into the V8 documentation for a while, but without any result so far :(

---

Strings in V8 are not always stored as a sequence of characters, they can also be stored as ConsString, Lisp-like. You can check the actual C++ structures used in V8 sources.