Will this structure be placed in paged pool, or non paged pool?

NTDEV
2

Unless you use a pragma to change it, all statics and globals in a driver
are loaded non-paged.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

wrote in message news:xxxxx@ntdev…

Say I write some code, and compile it into a library.

In libraryfile.cpp:

char Stuff[5] = {0,1,2,3,4};

void blah(void)
{
char a;
// Do some access to Stuff structure, etc here… i.e.,
a = Stuff[1];
}

Then, I link this library into my driver, and run it in kernel mode. In
what memory pool (Paged
/ NonPaged) will the linker put the static array “Stuff”? Can I specify
it to be non paged pool
somehow? Is “blah” safe to call from a DPC? Will a #pragma
code_seg(“CODE”) ensure it?

Also, is there a debugger command that I can use on a memory location that
will tell me whether or
not that memory is pageable or not? In this way during run time, I could
do a quick debugger check
on the Stuff array, and know for sure that it was allocated in non paged
pool?

Thanks!
James

Legal Disclaimer******
“This email may contain confidential and privileged material for the sole
use of the intended recipient. Any unauthorized review, use or distribution
by others is strictly prohibited. If you have received the message in
error, please advise the sender by reply email and delete the message. Thank
you.”
**********************************************************************

3

James,

It is always good practice to use disassembler to examine your driver image
(everyone will agree IDA is the best one). This is a perfect way to look
over resulting layout of your driver to see if your data and code were
placed the way you expected.

Andrey.

wrote in message news:xxxxx@ntdev…

Say I write some code, and compile it into a library.

In libraryfile.cpp:

char Stuff[5] = {0,1,2,3,4};

void blah(void)
{
char a;
// Do some access to Stuff structure, etc here… i.e.,
a = Stuff[1];
}

Then, I link this library into my driver, and run it in kernel mode. In
what memory pool (Paged
/ NonPaged) will the linker put the static array “Stuff”? Can I specify
it to be non paged pool
somehow? Is “blah” safe to call from a DPC? Will a #pragma
code_seg(“CODE”) ensure it?

Also, is there a debugger command that I can use on a memory location that
will tell me whether or
not that memory is pageable or not? In this way during run time, I could
do a quick debugger check
on the Stuff array, and know for sure that it was allocated in non paged
pool?

Thanks!
James

Legal Disclaimer******
“This email may contain confidential and privileged material for the sole
use of the intended recipient. Any unauthorized review, use or distribution
by others is strictly prohibited. If you have received the message in
error, please advise the sender by reply email and delete the message. Thank
you.”
**********************************************************************

4

you can generate .map file to see which section the Stuff is in,
and can use Dumpbin (with /headers) to see the attribute of sections

дÈëÓʼþ news:xxxxx@ntdev…
Say I write some code, and compile it into a library.

In libraryfile.cpp:

char Stuff[5] = {0,1,2,3,4};

void blah(void)
{
char a;
// Do some access to Stuff structure, etc here… i.e.,
a = Stuff[1];
}

Then, I link this library into my driver, and run it in kernel mode. In what
memory pool (Paged / NonPaged) will the linker put the static array “Stuff”?
Can I specify it to be non paged pool somehow? Is “blah” safe to call from a
DPC? Will a #pragma code_seg(“CODE”) ensure it?

Also, is there a debugger command that I can use on a memory location that
will tell me whether or not that memory is pageable or not? In this way
during run time, I could do a quick debugger check on the Stuff array, and
know for sure that it was allocated in non paged pool?

Thanks!
James
Legal Disclaimer******
“This email may contain confidential and privileged material for the sole
use of the intended recipient. Any unauthorized review, use or distribution
by others is strictly prohibited. If you have received the message in error,
please advise the sender by reply email and delete the message. Thank you.”
**********************************************************************

5

Nonpaged, unless you will use #pragma data_seg or #pragma alloc_data

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: xxxxx@conexant.com
To: Windows System Software Devs Interest List
Sent: Saturday, April 30, 2005 5:23 AM
Subject: [ntdev] Will this structure be placed in paged pool, or non paged pool?

Say I write some code, and compile it into a library.

In libraryfile.cpp:

char Stuff[5] = {0,1,2,3,4};

void blah(void)
{
char a;
// Do some access to Stuff structure, etc here… i.e.,
a = Stuff[1];
}

Then, I link this library into my driver, and run it in kernel mode. In what memory pool (Paged / NonPaged) will the linker put the static array “Stuff”? Can I specify it to be non paged pool somehow? Is “blah” safe to call from a DPC? Will a #pragma code_seg(“CODE”) ensure it?

Also, is there a debugger command that I can use on a memory location that will tell me whether or not that memory is pageable or not? In this way during run time, I could do a quick debugger check on the Stuff array, and know for sure that it was allocated in non paged pool?

Thanks!
James

********************** Legal Disclaimer ****************************

“This email may contain confidential and privileged material for the sole use of the intended recipient. Any unauthorized review, use or distribution by others is strictly prohibited. If you have received the message in error, please advise the sender by reply email and delete the message. Thank you.”

**********************************************************************

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

@Andrey
IDA is well and good if you dont have the source. Then you dont have a
choice.

He has his code, and is probably using the usual build tools…
therefore it would be much simpler (and more elegant imo) to using the
compiler switch -FAs to get the assembler output.

@James:
Since we’ve assumed so far that u’r using cl and build, here’s what you
need to add to your SOURCES file to get that flag in:

MSC_CPPFLAGS=/FAs

Once this is done, look for “_DATA SEGMENT”(s)
You should see your data there.

The rule then is every SEGMENT name that begins with the word “PAGE” is
pageable. The rest arent. this goes for code and data alike.

You’d note that if you dont use #pragma’s then data falls in _DATA and
code in _TEXT. Which then means that nothing is pageable.
Which is exactly the reasoning of one of the replies to your post.

Yuvraaj

Andrey Shedel wrote:

James,

It is always good practice to use disassembler to examine your driver image
(everyone will agree IDA is the best one). This is a perfect way to look
over resulting layout of your driver to see if your data and code were
placed the way you expected.

Andrey.

wrote in message news:xxxxx@ntdev…
>
> Say I write some code, and compile it into a library.
>
>
> In libraryfile.cpp:
>
> char Stuff[5] = {0,1,2,3,4};
>
> void blah(void)
> {
> char a;
> // Do some access to Stuff structure, etc here… i.e.,
> a = Stuff[1];
> }
>
>
>
> Then, I link this library into my driver, and run it in kernel mode. In
> what memory pool (Paged
> / NonPaged) will the linker put the static array “Stuff”? Can I specify
> it to be non paged pool
> somehow? Is “blah” safe to call from a DPC? Will a #pragma
> code_seg(“CODE”) ensure it?
>
>
> Also, is there a debugger command that I can use on a memory location that
> will tell me whether or
> not that memory is pageable or not? In this way during run time, I could
> do a quick debugger check
> on the Stuff array, and know for sure that it was allocated in non paged
> pool?
>
> Thanks!
> James
>
>
>
> Legal Disclaimer******
> “This email may contain confidential and privileged material for the sole
> use of the intended recipient. Any unauthorized review, use or distribution
> by others is strictly prohibited. If you have received the message in
> error, please advise the sender by reply email and delete the message. Thank
> you.”
> **********************************************************************
>
>
>
>