I want to see where all the physical memory is mapped into virtual memory in a memory.dmp or in WinDbg on Win2003. For example, virtual 0xB1000000-0xB1FFFFFF is mapped to physical memory such and such. Is there a way of doing that without having to go through the PTEs individually? If no way in WinDbg, how about some tool (I already looked at SysInternals but the only similar tool is only for Vista).
Thanks!
if you want a vmmap for the whole process
(ie say starting from 0x10000 env block to _kuser_shared) you would
need to tweak this script a bit
this at its present form will get you the vadroot level 0 startvpn to endvpn
.foreach /pS 1 /ps 100 (place {!process 0 0 ${$arg1}} ) {r $t0 = place}
.foreach /pS 0n11 /ps 100 (place {!process 0 0 ${$arg1}} ) {r $t1 = place}
r $t2 = @@c++( ( ( nt!_EPROCESS *) @$t0) -> VadRoot )
r $t3 = @@C++( ( ( nt!_MMVAD *) @$t2) -> StartingVpn )
r $t4 = @@C++( ( ( nt!_MMVAD *) @$t2) -> EndingVpn )
.printf “_EPROCESS\t=\t%p\nDirbase\t=\t%p\nVadRoot\t=\t%p\nStartingVpn\t=\t%p\nEndingVpn\t=\t%p\n
for ${$arg1}\n” , @$t0,@$t1,@$t2,@$t3,@$t4
.for (r $t5 = @$t3; $t5 <= @$t4; r $t5 = $t5+1)
{
aS /x va @$t5*0x1000
aS /x pfn @$t1>>0n12
.block {
!vtop pfn va
}
ad *
}
usage
copy paste it to script.txt
$$>a< script.txt .exe
results should be something like this
kd> $$>a< .\scripts\fallvtopinexe.txt msgbox.exe
_EPROCESS = ffae4030
Dirbase = 07f65000
VadRoot = 811ff350
StartingVpn = 00000400
EndingVpn = 00000403
for msgbox.exe
X86VtoP: Virt 00400000, pagedir 7f65000
X86VtoP: PDE 7f65004 - 05350067
X86VtoP: PTE 5350000 - 04ee4005
X86VtoP: Mapped phys 4ee4000
Virtual address 400000 translates to physical address 4ee4000.
X86VtoP: Virt 00401000, pagedir 7f65000
X86VtoP: PDE 7f65004 - 05350067
X86VtoP: PTE 5350004 - 07d2c005
X86VtoP: Mapped phys 7d2c000
Virtual address 401000 translates to physical address 7d2c000.
X86VtoP: Virt 00402000, pagedir 7f65000
X86VtoP: PDE 7f65004 - 05350067
X86VtoP: PTE 5350008 - 05865005
X86VtoP: Mapped phys 5865000
Virtual address 402000 translates to physical address 5865000.
X86VtoP: Virt 00403000, pagedir 7f65000
X86VtoP: PDE 7f65004 - 05350067
X86VtoP: PTE 535000c - 07cad205
X86VtoP: Mapped phys 7cad000
Virtual address 403000 translates to physical address 7cad000.
kd> .process /p /r ffae4030
Implicit process is now ffae4030
.cache forcedecodeuser done
Loading User Symbols
…
kd> db 403000 l10
00403000 49 63 7a 65 6c 69 6f 6e-27 73 20 74 75 74 6f 72 Iczelion’s tutor
kd> !db 7cad000 l10
*** ERROR: Module load completed but symbols could not be loaded for msgbox.exe
# 7cad000 49 63 7a 65 6c 69 6f 6e-27 73 20 74 75 74 6f 72 Iczelion’s tutor
On 10/24/12, Taed Wynnell wrote:
> I want to see where all the physical memory is mapped into virtual memory in
> a memory.dmp or in WinDbg on Win2003. For example, virtual
> 0xB1000000-0xB1FFFFFF is mapped to physical memory such and such. Is there
> a way of doing that without having to go through the PTEs individually? If
> no way in WinDbg, how about some tool (I already looked at SysInternals but
> the only similar tool is only for Vista).
>
> Thanks!
>
>
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer