Paging-in pages out of a remote machine when debugging with WinDbg

WINDBG
1

Hello.

I have found the following problem when debugging with WinDbg.

I have a mapped file over a remote machine, through LanManager.

The mapping works as expected but when I try to access the data I get an exception.

This only happens under WinDbg. If I let the program run freely it works as expected.

The code that crashes looks like the following (note that the size of the mapped area is not zero):

ptr = MapViewOfFile( hFile, FILE_MAP_READ, 0, 0, 0);

if(ptr)

{

try

C = ptr[0]; <– EXCEPTION!!!

except

UnmapViewOfFile( ptr);

}

I can use a ‘step over’ command in the debugger or I can place a breakpoint on the next line and use the Go command. I get an exception anyway.

However if I let it run freely I don’t get any exception.

Does paging-in work when working with remote files under WinDbg ?

Note: if I try the same code under SoftICE it works.

Inaki.

2

Iñaki Castillo wrote:

Hello.

I have found the following problem when debugging with WinDbg.

I have a mapped file over a remote machine, through LanManager.

The mapping works as expected but when I try to access the data I get
an exception.

This only happens under WinDbg. If I let the program run freely it
works as expected.

The code that crashes looks like the following (note that the size of
the mapped area is not zero):

ptr = MapViewOfFile( hFile, FILE_MAP_READ, 0, 0, 0);

if(ptr)

{

try

C = ptr[0]; ß EXCEPTION!!!

except

UnmapViewOfFile( ptr);

}

I can use a ‘step over’ command in the debugger or I can place a
breakpoint on the next line and use the Go command. I get an exception
anyway.

Right. It’s a “first chance” exception, right? Perfectly normal. If
you let it continue, it will handle the page fault and everything will
continue happily.

You can disable trapping of first chance exceptions, if this bothers you.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

in WinDbg ‘sxd’ (among some other ‘sx’ possibilities).

I would guess that you’re not seeing this in SoftICE due to ‘SET FAULTS
OFF.’

Good luck,

mm

Tim Roberts wrote:

Iñaki Castillo wrote:
>
>
>
> Hello.
>
> I have found the following problem when debugging with WinDbg.
>
>
>
> I have a mapped file over a remote machine, through LanManager.
>
> The mapping works as expected but when I try to access the data I get
> an exception.
>
> This only happens under WinDbg. If I let the program run freely it
> works as expected.
>
>
>
> The code that crashes looks like the following (note that the size of
> the mapped area is not zero):
>
>
>
> ptr = MapViewOfFile( hFile, FILE_MAP_READ, 0, 0, 0);
>
> if(ptr)
>
> {
>
>
>
> try
>
> C = ptr[0]; ß EXCEPTION!!!
>
> except
>
>
>
> UnmapViewOfFile( ptr);
> }
>
>
>
> I can use a ‘step over’ command in the debugger or I can place a
> breakpoint on the next line and use the Go command. I get an exception
> anyway.
>

Right. It’s a “first chance” exception, right? Perfectly normal. If
you let it continue, it will handle the page fault and everything will
continue happily.

You can disable trapping of first chance exceptions, if this bothers you.

4

As far as I can tell, this does not work that way.

If you are stepping on WinDbg (with F10) and reach a block of memory, say an array, that is paged out, you can step over it and the pages is read-in transparently. You don’t see any exception. Of course the exception is taking place but you do not see it in WinDbg.

If you are watching the buffer you are trying to read in a watch window you will see the usual unknown data ‘???..’ before you read the page, because it is paged out, but it will change automatically to the right data when you actually read the buffer in your code. No exception is seen between the moment you press F10 over the instruction that actually reads the data and the data appearing in the watch window.

That is the expected behavior in a debugger because the debugger should not report a page fault for every access you do to paged data.

Please note that the behavior I am talking about happens ONLY for mapped files that point to a redirector file system. I does not happen for local mapped files.

And no, if you let it run, the read does not take place.

Inaki.

-----Mensaje original-----
De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Tim Roberts
Enviado el: jueves, 24 de enero de 2008 19:13
Para: Kernel Debugging Interest List
Asunto: Re: [windbg] Paging-in pages out of a remote machine when debugging with WinDbg

I?aki Castillo wrote:

Hello.

I have found the following problem when debugging with WinDbg.

I have a mapped file over a remote machine, through LanManager.

The mapping works as expected but when I try to access the data I get
an exception.

This only happens under WinDbg. If I let the program run freely it
works as expected.

The code that crashes looks like the following (note that the size of
the mapped area is not zero):

ptr = MapViewOfFile( hFile, FILE_MAP_READ, 0, 0, 0);

if(ptr)

{

try

C = ptr[0]; ? EXCEPTION!!!

except

UnmapViewOfFile( ptr);

}

I can use a ‘step over’ command in the debugger or I can place a
breakpoint on the next line and use the Go command. I get an exception
anyway.

Right. It’s a “first chance” exception, right? Perfectly normal. If
you let it continue, it will handle the page fault and everything will
continue happily.

You can disable trapping of first chance exceptions, if this bothers you.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

You are currently subscribed to windbg as: xxxxx@pandasecurity.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

> If you are stepping on WinDbg (with F10) and reach a block of

memory, say an array, that is paged out, you can step over it
and the pages is read-in transparently. You don’t see any
exception. Of course the exception is taking place but you do
not see it in WinDbg.

What is the exception that you see in windbg? Can you copy and paste
the output of “.exr -1” ?

–
This posting is provided “AS IS” with no warranties, and confers no
rights.