Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


how windbg read physical address in !d* commands ?

ysys Member - All Emails Posts: 104
edited February 2019 in WINDBG

Hi dear all,
We know in paging mode , all memory access must be translated by the paging table , so , I think to read a physical address , windbg will map the physical address to a linear address in paging table then read from the linear address . Is this description right ? many thanks!!!

Comments

  • raj_rraj_r Member - All Emails Posts: 983
    via Email
    kd> du /c 100 ( windbg + 67d0)
    00f867d0 "Software\Microsoft\Windbg\Workspaces\%s"
    kd> !vtop 0 00f867d0


    X86VtoP: Virt 0000000000f867d0, pagedir 000000007e28d640
    X86VtoP: PAE PDPE 000000007e28d640 - 0000000052e97801
    X86VtoP: PAE PDE 0000000052e97038 - 0000000057ba6867
    X86VtoP: PAE PTE 0000000057ba6c30 - 000000003182b025
    X86VtoP: PAE Mapped phys 000000003182b7d0
    Virtual address f867d0 translates to physical address 3182b7d0.


    kd> !du 3182b7d0 l30
    #3182b7d0 "Software\Microsoft\Windbg\Workspaces\%s"
  • ysys Member - All Emails Posts: 104

    I'm trying to read the PML4 table at the very early stage of Win10 booting as follow
    kd> r @cr3
    cr3=00000000001aa002
    kd> !dq 1aa000
    Physical memory read at 1aa000 failed
    If you know the caching attributes used for the memory,
    try specifying [c], [uc] or [wc], as in !dd [c] .
    WARNING: Incorrect use of these flags will cause unpredictable
    processor corruption. This may immediately (or at any time in
    the future until reboot) result in a system hang, incorrect data
    being displayed or other strange crashes and corruption.

    does this mean physical address 1aa000 is not mapped ?

  • raj_rraj_r Member - All Emails Posts: 983
    via Email
    i dont think you can read cr3 with !dq

    cr3 should contain Directory Base

    ie EPROCESS Pcb.DirectoryTableBase

    without the trailing three bytes it represents the PageFrameNumber

    ie 0000xxx1aa is the PageFrame Number in your post

    you can use that in !vtop command to get the physical page

    like !vtop pfn va

    when you have broken in windbg you cant expect cr3 to point to current
    process DirectoryTableBase (the cr3 which you printed might point to
    System Process (pid 0)



    kd> r cr3
    cr3=00185000

    kd> ?? @$proc->Pcb.DirectoryTableBase
    unsigned long 0xd08b000

    kd> ?? (char *)@$proc->ImageFileName
    char * 0x840ed19c
    "explorer.exe"

    @masm(0x83f30368))->Pcb.DirectoryTableBase
    unsigned long 0x185000


    @masm(0x83f30368))->ImageFileName
    char * 0x83f304d4
    "System"
  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,605
    via Email
    ys wrote:
    > We know in paging mode , all memory access must be translated by the paging table , so , I think to read a physical , windbg will map the physical address to a linear address in paging table then read from the linear address . Is this description right ?

    Correct.  EVERY address that an x86 processor uses is a virtual
    address.  The ONLY way to play with a physical address is to create a
    page table entry and use the associated virtual address. Note that, in
    the windbg case, those physical addresses usually have other virtual
    mappings that already exist.  This is why windbg wants you to specify
    the caching mode.  Caching is done with virtual addresses, and it's
    problematic to have two virtual-to-physical mappings to the same address
    with different cache attributes.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 30 Nov 2020 LIVE ONLINE
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Developing Minifilters Early 2021 LIVE ONLINE