Is there any way to tell what user mode applications, system services,
etc… are paged in from the actual exe file on disk? and which ones are
paged in from the paging file?
I thought the backing store for code segments is always the exe and that the
backing store for writable data is always the paging file. I can’t remember
where read-only data segments get stored. Why would you care?
=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com
-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Tuesday, August 05, 2003 12:36 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Paged from disk of paging file?
Is there any way to tell what user mode applications, system services,
etc… are paged in from the actual exe file on disk? and which ones are
paged in from the paging file?
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com
Why? just to know more-so then anything else. I always thought that it was
the way you mentioned… just wondering if there was a way to know for
sure during runtime…
Learning is fun.
A file can be mapped either as an executable image or a simple file
mapping. (Internally, there are two corresponding types of kernel-mode
section objects for each file that back all associated views on that
file.) The page protection attributes for image mappings come from flags
in the PE sections of the executable itself. For a simple file mapping,
you can specify your own attributes (read-only, read/write, copy-on-write).
All mapped pages begin life backed by the file itself. Modifications to
pages will be seen by all processes and will change the underlying file
unless the page is deemed copy-on-write. In that case, the system will
back the modified page by the page file instead, meaning that page is no
longer shared by other processes and will not change the file on disk.
xxxxx@yahoo.com wrote:
Is there any way to tell what user mode applications, system services,
etc… are paged in from the actual exe file on disk? and which ones are
paged in from the paging file?
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
- Nick Ryan (MVP for DDK)