In a user-level process, your debugger is not acting as a kernel debugger,
unless you should single-step into the kernel. I know I used to do this a
lot in Soft-ICE, but I’ve never tried to do hybrid user/kernel debugging in
WinDbg, so someone else will have to answer this.
Therefore, the kernel symbols are not available when you are in the user
space context.
The concept of “parent process” only barely exists in Windows (this is a
concept in linux, but you have to work at getting it as something in
Windows, look up “process group”. If you have not created a process group,
a process has no parent).
In user space, GetCurrentProcessId() and GetModuleName(NULL,…) will give
you what you need, but I don’t know how to ask those questions from the
debugger. Virtual address space is rarely interesting to examine,but there
are APIs that do it; I’d have to look them up but there are APIs that give
lots of interesting information about pages, including which NUMA node the
memory belongs to (look in the NUMA support APIs). You can find the usage
of some of these in my NUMA Explorer, downloadable from my MVP Tips site
www.flounder.com/mvp_tips.htm (because of the automatic highlighting of
hyperlinks, that may be ambiguous to read; it is mvp_tips.htm, not “mvp
tips.htm”)
joe
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@live.com
Sent: Sunday, November 28, 2010 9:28 PM
To: Kernel Debugging Interest List
Subject: [windbg] Process Internals
hello experts,
I was reading through win internals book and doing the lab side by.
I have created a win32 application which has one parent process
I have attached my exe to windbg and put a break point at one of the
function.
Now i want to analyze the process activity, i used |* to know the number of
processes and it returned one which is expected.
Now i want to read Virtual address space, Thread , pid from “user mode” , is
this possible
can i use
dt nt!_eprocess
or
dt nt!_eprocess
or should i need to analyze these only in kernel mode , if so what are the
steps ?
—
WINDBG is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
–
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.