You then need three additional pieces of information for your system. This exposes the three parts of the virtual address: Bits 22 to 31 are the page directory index. This virtual address is a combination of three fields. formats (Show Number Formats) command: kd>. Using 0x0012F980 again as the virtual address, you first need to convert it to binary, either by hand or by using the. This example is taken from an x86 system that does not have Physical Address Extension (PAE) enabled.
Memory structures vary in size, depending on the processor and the hardware configuration. A description of this process will shed light on some of the details of the virtual memory architecture. Converting Addresses By HandĪlthough the !ptov and pte extensions supply the fastest way to convert virtual addresses to physical addresses, this conversion can be done manually as well. This is the same result obtained by the earlier method. The result, 0x09DE9000, is the physical address of the beginning of the page. Multiply the page frame number by 0x1000 (for example, shift it left 12 bits). The number 0x9DE9 is the page frame number (PFN) of this PTE. Look in the last row of the right column. The left column describes the page directory entry (PDE) for this address the right column describes its page table entry (PTE): kd> !pte 12f980
This displays information in two columns. Use the !pte extension with the virtual address as its argument. Set the process context to the desired process: kd> !process 0 0 Here is the procedure you would use with the !pte extension to determine the corresponding physical address:Ĭonverting a virtual address to a physical address using !pte Address Conversion Using !pteĪgain, assume you are investigating the virtual address 0x0012F980 belonging to the MyApp.exe process. '.w>.w.G.w.īecause the results are the same, this indicates that the physical address 0x09DE9980 does indeed correspond to the virtual address 0x0012F980. The !d\* extension displays memory at a specified physical address: kd> !dc 9de9980 You can verify that this computation was done correctly by displaying the memory at each address. The second number shown on the final line is the physical address of the beginning of the physical page.Īdd the byte index to the address of the beginning of the page: 0x09DE9000 + 0x980 = 0x09DE9980. The second parameter of !vtop should be the virtual address in question: kd> !vtop 98fd 12f980 The first parameter of this extension should be the page frame number. In this example, the directory base is 0x098FD000, so the page frame number is 0x098FD. This is simply the directory base without the three trailing hexadecimal zeros. PROCESS ff779190 SessionId: 0 Cid: 04fc Peb: 7ffdf000 ParentCid: 0394ĭirBase: 098fd000 ObjectTable: e1646b30 TableSize: 8.ĭetermine the page frame number of the directory base. Thus, the virtual address 0x0012F980 has a byte index of 0x980.ĭetermine the directory base of the address by using the !process extension: kd> !process 0 0 This number is equal to the lowest 12 bits of the virtual address.
If necessary, set the current base with the N 16 command.ĭetermine the byte index of the address. Make sure that you are working in hexadecimal. Here is the procedure you would use with the !vtop extension to determine the corresponding physical address.Ĭonverting a virtual address to a physical address using !vtop Suppose you are debugging a target computer on which the MyApp.exe process is running and you want to investigate the virtual address 0x0012F980. There are two ways to convert a virtual address to a physical address: by using the !vtop extension, and by using the !pte extension.įor an overview of virtual address in Windows, see Virtual address spaces.
However, there are times that having the physical address can be useful. Most debugger commands use virtual addresses, not physical addresses, as their input and output.
0 kommentar(er)
