Help on pte
d.c
#include <windows.h>
void p;
void abc(int i)
{
int x , y , z;
x = i & 0x00000fff;
y = i & 0x003ff000;
y = y >> 12;
z = i & 0xffC00000;
z = z >> 22;
printf(“high 10 bits=%d:0x%x Middle 10 bits=%d:0x%x first 12 bits=%d:0x%x %08x\n”,z,z,y,y,x,x,i);
}
main()
{
p = VirtualAlloc(0,24,MEM_COMMIT,PAGE_READWRITE);
strcpy(p,“Vijay Mukhi”);
printf(“%08x %s\n”,p,p);
abc((unsigned int)p);
getch();
}
I have written a small program d.exe that uses the function VirtualAlloc to allocate 128 bytes of virtual memory which starts at 0x00340000. This gives me a PDE offset of 0, PTE offset of 0x340 and the byte offset in the actual page of 0. I copy my name Vijay Mukhi to this memory area and wait on a getch(). I then run the following commands in WinDbg.
lkd> !process 0 0 d.exe
PROCESS 89ae5328 SessionId: 0 Cid: 0b80 Peb: 7ffde000 ParentCid: 0a2c
DirBase: 53594000 ObjectTable: e1132168 HandleCount: 7.
Image: d.exe
My PDE starts at 53594000.
lkd> !dd 53594000 L1
#53594000 53944067
My PTE table starts at 53944000 as PDI offset is 0.
lkd> !dd 53944000 + 0x3404 L1
#53944d00 53923067
My physical address where my name is stored is 53923000 and the pfn is 53923 as the PTI offset is 0x340.
lkd> !dc 53923000 L 5
#53923000 616a6956 754d2079 0069686b 00000000 Vijay Mukhi…
#53923010 00000000 …
!dc confirms that we have successfully converted a virtual address into a physical address. Virtual address 340000 maps to 53923000.
lkd> .process 89ae5328
Implicit process is now 89ae5328
To be on the safe side I have made the active process d.exe
Now I try the following combinations of the !pte extension which gives me results that I cannot understand.
lkd> !pte 00340000
VA 00340000
PDE at C0300000 PTE at C0000D00
contains 2EB8A067 contains 00000000
pfn 2eb8a —DA–UWEV
lkd> !pte PTE 53923067
VA 00000000
PDE at C0300000 PTE at C0000000
contains 2EB8A067 contains 00000000
pfn 2eb8a —DA–UWEV
lkd> !pte PTE 53944067
VA 00000000
PDE at C0300000 PTE at C0000000
contains 2EB8A067 contains 00000000
pfn 2eb8a —DA–UWEV
lkd> !pte PTE 53944000
VA 00000000
PDE at C0300000 PTE at C0000000
contains 2EB8A067 contains 00000000
pfn 2eb8a —DA–UWEV
lkd> !pte 53944000 1
VA 53944000
PDE at 53944000 PTE at 53944000
Unable to get PDE 53944000
My question is what values do I give the !pte extension. Is it a virtual address, the physical address of the PTE/PDE. What do the different options mean.
lkd> !pfn 53923
PFN 00053923 at address 81818B48
flink 0000008D blink / share count 00000001 pteaddress C0000D00
reference count 0001 Cached color 0
restore pte 00000080 containing page 053944 Active M
Modified
lkd> !pte c0000d00
VA 00340000
PDE at C0300000 PTE at C0000D00
contains 2EB8A067 contains 00000000
pfn 2eb8a —DA–UWEV
Also as my pfn is 53923, the pfn extension shows me a pte address which if passed to the pte extension gives me the correct virtual address but not the correct pfn. Passing the PDE address c0300000 also does not help.
Any help or pointers to literature would help a lot. Sorry for the long post. Have already posted to the WinDbg list. My apoligies for posting twice. Thank you.
Vijay Mukhi</windows.h>