Virtual addresses

If the page table entries get corrupted can windbg still provide correct
information when using virtual addresses (such as in the “dd” command) or
does windbg use the PTE to access virtual addresses?

  • Steve -

Yes, we require the page tables to display virtual addresses. When you do
‘dd’ we just send that address over the wire, the kernel code takes that
address, dereferences it and copies the contents into a buffer that is
sent back to windbg.

Actually, the kernel debugger is like a miniOS inside the kernel. If the
kernel or memory manager get really really hosed, the target machine will
no longer respond. This happens very rarely, but it can happen. Blow
away the page tables for the kernel itself and it’s over for debugging.

-Andre

Windbg uses the PTEs - no other choice, really. So, if the target PTEs get
corrupted, Windbg will display bogus data.


Tom Stonecypher
Principal, iStreamConsulting
http://www.iStreamConsulting.com

“Whitman, Steve” wrote in message news:xxxxx@windbg…
>
> If the page table entries get corrupted can windbg still provide correct
> information when using virtual addresses (such as in the “dd” command) or
> does windbg use the PTE to access virtual addresses?
>
> - Steve -