Obtaining the boot memory map from windbg

WINDBG
1

I know that I can see the memory map by looking in the registry, but I need it early in the boot process. Is there a way to get this from Windbg?

2

I believe it’s in the loader block somewhere.

mm
On Apr 30, 2016 4:10 PM, wrote:

> I know that I can see the memory map by looking in the registry, but I
> need it early in the boot process. Is there a way to get this from Windbg?
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

3

There’s a global that contains the information. Took me a bit to dig out the
thread where Pavel showed how to walk it in the debugger:

https://www.osronline.com/ShowThread.cfm?link=217946

(As an aside, that would make a good debugger extension.)

-scott
OSR
@OSRDrivers

“Martin O’Brien” wrote in message
news:xxxxx@windbg…

I believe it’s in the loader block somewhere.

mm

On Apr 30, 2016 4:10 PM, wrote:
I know that I can see the memory map by looking in the registry, but I need
it early in the boot process. Is there a way to get this from Windbg?

—
WINDBG is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:>

4

You can get this info by using !mm command from DbgKit
http://www.andreybazhan.com/dbgkit.html

  1. bu nt!MmInitSystem; g
  2. gu; !dbgkit.mm
  3. Go to Physical Ranges tab.

wrote in message news:xxxxx@windbg…

I know that I can see the memory map by looking in the registry, but I need
it early in the boot process. Is there a way to get this from Windbg?

5

Take a look at !mm command from DbgKit
http://www.andreybazhan.com/dbgkit.html
:slight_smile:

“Scott Noone” wrote in message news:xxxxx@windbg…

There’s a global that contains the information. Took me a bit to dig out the
thread where Pavel showed how to walk it in the debugger:

https://www.osronline.com/ShowThread.cfm?link=217946

(As an aside, that would make a good debugger extension.)

-scott
OSR
@OSRDrivers