Timeline:
[00:30] - xperf -on PROC_THREAD+LOADER+DISK_IO+DISK_IO_INIT -stackwalk DiskReadInit+DiskWriteInit+DiskFlushInit
[02:00] - WPA
[03:22] - System Configuration
[04:30] - Disk Queue Length - need to use xPerfView
[06:32] - Disk Controllers, Disk Drives and RAID
[11:08] - * The 2nd thing is AHCI which does I/O reordering (forgot to mention it)
[15:45] - xPerfView - Disk I/O "Detail Graph"
[18:30] - WPA - IO Time & Disk Service Time
[22:45] - xPerfView - Disk Queue Length
[25:00] - Summary

Example: "xperf - Collect DiskIO.cmd"

@echo off
echo Press a key when ready to start...
pause

echo .
echo ...Capturing...
echo .

xperf -on PROC_THREAD+LOADER+DISK_IO+DISK_IO_INIT -stackwalk DiskReadInit+DiskWriteInit+DiskFlushInit -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular

echo Press a key when you want to stop...
pause
echo .
echo ...Stopping...
echo .

xperf -stop -d diskio.etl

Resources:
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #29 - WinDbg - ETW Logging
Windows Performance Analysis Developer Center
Windows Performance Toolkit
Channel 9 Videos
NTDebugging Blog Article
PFE Blog Series

Timeline:
[01:05] - xperf -on PROC_THREAD+LOADER+PROFILE+INTERRUPT+DPC+DISPATCHER+CSWITCH -stackwalk Profile+CSwitch+ReadyThread
[01:50] - Synchronization Episodes: #24, #25 & #26
[02:10] - CSwitch (a.k.a. NewThread) and ReadyThread stacks
[03:36] - Aaron's Margosis' VirtMemTest "Hang the UI" example
[05:15] - CPU (Precise)
  NewProcess
  NewThreadId
  NewStack
  ReadyingProcess
  ReadyingThreadId
  ReadyingStack
  Waits(us)
[17:30] - Summary

Example: "xperf - Collect CPUWait.cmd"

@echo off
echo Press a key when ready to start...
pause
echo .
echo ...Capturing...
echo .

xperf -on PROC_THREAD+LOADER+PROFILE+INTERRUPT+DPC+DISPATCHER+CSWITCH -stackwalk Profile+CSwitch+ReadyThread -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular

echo Press a key when you want to stop...
pause
echo .
echo ...Stopping...
echo .

xperf -stop -d cpuwait.etl

Resources:
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #29 - WinDbg - ETW Logging
Windows Performance Analysis Developer Center
Windows Performance Toolkit
Channel 9 Videos
NTDebugging Blog Article
PFE Blog Series

Timeline:
[01:20] - xperf.exe -on PROFILE -StackWalk Profile
[04:40] - xperf.exe -on PROC_THREAD+LOADER+PROFILE -StackWalk Profile
[06:14] - Lots of Views
[08:36] - View CPU by Module
[10:09] - View CPU by Stack
[14:52] - xperf.exe -on PROC_THREAD+LOADER+PROFILE+INTERRUPT+DPC -StackWalk Profile
[20:18] - DPC Timeline
[23:13] - DPC/ISR Per-CPU Analysis
[25:42] - Example of a DPC/ISR Spike
[33:35] - Summary

Example: "xperf - Collect CPU.cmd"

@echo off
echo Press a key when ready to start...
pause
echo .
echo ...Capturing...
echo .

xperf -on PROC_THREAD+LOADER+PROFILE+INTERRUPT+DPC -stackwalk Profile -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular

echo Press a key when you want to stop...
pause
echo .
echo ...Stopping...
echo .

xperf -stop -d cpu.etl

Resources:
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #29 - WinDbg - ETW Logging
Windows Performance Analysis Developer Center
Windows Performance Toolkit
Channel 9 Videos
NTDebugging Blog Article
PFE Blog Series

Timeline:
[00:00] - UI vs. Command Line
[02:15] - wpr.exe -profiles
[02:48] - wpr.exe -profiledetails <profile>
[05:30] - wpr.exe -start <profile>
[06:06] - wpr.exe -stop result.etl
[09:25] - xperf.exe -help
[09:30] - xperf.exe -providers kg
[12:18] - xperf.exe -providers kf
[16:47] - xperf.exe -on <FLAG+FLAG+...>
[18:17] - xperf.exe -stop -d result.etl
[21:42] - xperf.exe ... -BufferSize <Size in KB>
[25:55] - xperf.exe ... -MinBuffers <Number> -MaxBuffers <Number>
[27:08] - xperf.exe ... -MaxFile <Size in KB>
[27:44] - xperf.exe ... -FileMode Circular
[30:42] - xperf.exe -merge <in-file1> <in-file2> <out-file>
[32:28] - Andrew's Scripts on SkyDrive [link]
[33:15] - xperf.exe -help stackwalk
[35:10] - xperf.exe ... -stackwalk <Stack+Stack+...>

Examples:
wpr.exe -start GeneralProfile
pause
wpr.exe -stop result.etl

xperf.exe -on Base -stackwalk Profile -BufferSize 1024 -MinBuffers 256 -MaxBuffes 256 -MaxFile 256 -FileMode Circular
pause
xperf.exe -stop -d result.etl

Resources:
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #29 - WinDbg - ETW Logging
Windows Performance Analysis Developer Center
Windows Performance Toolkit
Channel 9 Videos
NTDebugging Blog Article
PFE Blog Series

Timeline:
[00:40] - Windows Performance Recorder (UI)
[06:00] - Windows Performance Analyzer
[06:40] - Providers vs. Visualization
[08:00] - (CPU Usage) Sampled vs. Precise
[12:30] - Analysis Pane
[14:11] - * I was thinking of MDI (Multiple Document Interface]
[14:35] - Blue Bar
[15:27] - Gold/Yellow Bar - How to Aggregate
[19:18] - Symbols & SymCache
[28:40] - Column Customization
[31:50] - More next week... and many more weeks to come!

Resources:
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #29 - WinDbg - ETW Logging
Windows Performance Analysis Developer Center
Windows Performance Toolkit
Channel 9 Videos
NTDebugging Blog Article
PFE Blog Series

Timeline:
[00:00] - What is the Windows Performance Toolkit (WPT)?
[06:23] - Articles
[10:33] - Architecture of Event Tracing for Windows (ETW)
[18:30] - Windows Performance Recorder
[21:50] - Default, Resource and Scenario Profiles
[29:07] - More next week... and many more weeks to come!

Timeline:
[01:25] - "Image Tile" bug
[05:00] - Interop Debugging
[06:20] - Debugger Type: Script Only vs. Native/Mixed
[08:17] - JavaScript deployment internals
[11:53] - Attach...
[14:10] - Memory Profiling
[16:58] - JavaScript Memory Analysis (VS2012 Update 1)
[20:18] - Snapshot details
[21:25] - "Root" View

Timeline:
[00:54] - Debugging a JavaScript Windows Store application
[02:30] - Catching Crashes (unhandled exceptions)
[04:25] - WinJS.Utilities.startLog
[05:22] - app.onerror
[09:30] - Stacks
[11:47] - e.detail.error.stack
[14:23] - use strict
[20:25] - www.jslint.com integrated in VS
[22:13] - "Pin" bug
[24:58] - tile vs. title - Lint cannot detect this
[26:50] - Next time... more JavaScript debugging!

Resources:
Maoni's WebLog
PerfView (Download)
Channel 9 - PerfView Tutorial - by Vance Morrison

Timeline:
[00:38] - PerfView overview
[02:52] - (Basic) Collection
[04:39] - GCStats
[10:10] - GC Rollup By Generation
[11:22] - GC Events By Time (>200ms)
[11:31] - LOH Allocation (>200ms)
[12:34] - Gen2
[12:48] - GC Events By Time
[28:40] - Best Approach to Performance Analysis
[31:03] - GC Collect Only
[32:10] - Channel 9 - PerfView Tutorial

Resources:
Maoni's WebLog
Channel9 - CLR 4 Garbage Collector - Inside Background GC
Channel9 - CLR 4.5: Maoni Stephens - Server Background GC
MSDN Magazine - Investigating Memory Issues

Timeline:
[00:45] - Internal and Externals Roots
[05:55] - Start of GC: clr!WKS::GCHeap::GarbageCollectGeneration
[07:00] - !sos.dumpheap <heap start addr> <heap end addr>  (Range)
[07:30] - !sos.gcroot <addr>  (or !sos.gcwhere <addr>)
[09:45] - New Root Types? Dependent Handles (ConditionalWeakTable)
[12:32] - Handle Types
[13:30] - Pinned Handles - Effect on Fragmentation
[15:40] - Large Object Heap's Fragmentation & Coalescence
[17:55] - Pinned Objects
[19:33] - !sos.gchandles
[20:06] - !sos.gchandles -type Pinned
[20:45] - !sos.gchandles -type AsyncPinned

Resources:
Maoni's WebLog
Channel9 - CLR 4 Garbage Collector - Inside Background GC
Channel9 - CLR 4.5: Maoni Stephens - Server Background GC
MSDN Magazine - Investigating Memory Issues

Timeline:
[03:30] - How to approach Performance Analysis
[09:00] - Cadence of Gen 0, 1 and 2 garbage collection
[12:20] - !sos.FindRoots
[14:00] - Stop at Gen 1 GC - !sos.FindRoots -gen 1
[16:09] - End of GC: clr!WKS::GCHeap::RestartEE
[17:10] - Stacks of allocations [CLRProfiler] [PerfView]
[18:39] - Object's Generation - !sos.gcwhere <addr>
[19:28] - Generation Segments - !sos.eeheap -gc
[24:52] - VM Hoarding
[28:24] - Heap Summary - !sos.heapstat

Resources:
Maoni's WebLog
Channel9 - CLR 4 Garbage Collector - Inside Background GC
Channel9 - CLR 4.5: Maoni Stephens - Server Background GC
MSDN Magazine - Investigating Memory Issues

Timeline:
[00:00] - What is a Garbage Collector (GC)?
[02:40] - How has the GC changed?
[06:02] - Memory issues
[08:57] - Stress Log (!sos.dumplog)
[10:08] - Troubleshooting and Performance
[12:20] - Demo App
[14:20] - !sos.eeheap -gc
[18:08] - !sos.dumpheap -stat
[20:38] - !sos.dumpheap -mt <mt> (Method Table)
[21:58] - !sos.dumpobj / !sos.do (Dump Object)
[24:15] - Performance Monitoring (SOS, PerfView, Performance Monitor)
[28:06] - Measure immediately after an action, not at a cadence
[29:45] - x clr!WKS::GCHeap::GcCondemnedGeneration (Current GC being collected)
[31:15] - bp clr!WKS::GCHeap::RestartEE (Break after a GC)
[35:30] - More next week...

** I didn't do a great job explaining Sessions/Window Stations/Desktops -- If you want to know about those concepts in detail, I suggest you watch Sysinternals Primer: Gems instead.

Resources:
Sysinternals Desktops
Sysinternals WinObj
Sysinternals LogonSessions
Aaron Margosis' TSSessions
Sysinternals Administrator's Reference - [Amazon]
Sysinternals Primer: Gems [TechEd EMEA 2012 @13:45]
Malware Hunting with the Sysinternals Tools [TechEd USA 2012 @ 44:30]

Timeline:
[01:05] - Sysinternals Desktops
[04:50] - Sessions, Window Stations and Desktops
[05:13] - Sysinternals WinObj
[05:43] - Sessions
[06:40] - Window Stations
[09:00] - Enumeration (Standard User)
[10:11] - Desktops
[11:38] - Local Security Authority (LSA) - Sessions via Logons *
[12:16] - Enumeration (Elevated User)
[15:20] - psexec -sid cmd.exe
[16:38] - Enumeration (NT Authority\SYSTEM)
[17:15] - Sessions via Logons (NT Authority\SYSTEM)
[18:26] - Media Center Extender example

* You can enumerate sessions directly via the Remote Desktop Services API.

Exercises:

Use Sysinternals LogonSessions to view the logon sessions.
Use Aaron Margosis' TSSessions to view the Sessions/Window Stations/Desktops (and much more).

Session: 0
  WinStation: WinSta0
    Desktop: Default
    Desktop: Disconnect
    Desktop: Winlogon
  WinStation: Service-0x0-3e4$
  WinStation: Service-0x0-3e5$
  WinStation: Service-0x0-3e7$
  WinStation: msswindowstation
     Desktop: mssrestricteddesk
Session: 1
  WinStation: WinSta0
    Desktop: Default
    Desktop: Disconnect
    Desktop: Winlogon
...

Resources:
Sysinternals ZoomIt
Sysinternals Administrator's Reference - [Amazon]

Timeline:
[00:00] - Overview
[01:42] - Windows Magnifier (Win-+)
[03:35] - Ctrl-1 - Static Zoom
[05:30] - Ctrl-2 - Draw
[06:38] - Ctrl-4 - Live Zoom
[08:12] - File Save *
[10:05] - Ctrl-3 - Break Timer

* Zoomed to 480x300 on a 1920x1200 screen, the file sizes are:

• Zoomed - 1920x1200
• Actual - 480x300

Resources:
MCTS Windows Internals
Windows Internals Books
Kernrate
Poolmon
UMDH

Timeline:
[01:42] - Summary of the exam
[03:00] - Windows Internals books
[05:50] - Identifying Architectural Components
[14:17] - Designing Solutions
[21:34] - Monitoring Windows
[29:25] - Analyzing User Mode
[41:39] - Analyzing Kernel Mode
[45:17] - Debugging Windows
[48:32] - Good Luck!

This installment goes over the Event Tracing for Windows (ETW) buffers in a kernel mode dump or live session. The ETW buffers can be extracted from the dump and viewed using the Windows Performance Toolkit (WPT). The buffers give you insight in to what has beem happening recently on the computer.

We use these commands:

• !wmitrace.strdump
• !wmitrace.logsave 0xNN c:\example.etl
• !wmitrace.eventlogdump 0xNN
• !wmitrace.help

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution. This episode shows how install the Windows Performance Toolkit.

Timeline:
[00:00] - Event Tracing for Windows (ETW)
[02:18] - Windows Performance Toolkit (WPT)
[03:48] - !wmitrace.strdump
[04:53] - !wmitrace.logsave 0xNN c:\example.etl
[05:50] - Windows Performance Analyzer (WPA) & xPerfView
[07:57] - _NT_SYMCACHE_PATH
[10:24] - !wmitrace.eventlogdump 0xNN
[12:16] - Used for logging and performance by many teams
[15:35] - Private PDBs are needed to decode some entries
[20:00] - Windows Performance Recorder (wprui.exe)
[20:35] - Disable Paging Executive
[23:40] - WPR adds the NT Kernel Logger
[24:19] - 10min run-through of the data collected with the General, CPU and Disk providers

This installment goes over the Windows Scheduler. We look at Running, Ready and Waiting threads, and talks about the effect of Power Management on scheduling.

We use these commands:

• !running
• !running -t
• !ready
• !dpcs
• !thread <addr> 17
• !thread -1 17   (current thread)

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
Microsoft Data Center Tour

Timeline:
[00:00] - Episode #27's demo issue
[02:47] - Kernel Hangs
[05:18] - !running
[05:48] - Idle Threads & Processor Power Management
[10:10] - !running -t
[13:53] - !ready
[14:15] - Thread State Diagram
[16:45] - Saturated example
[20:48] - Thread Priority Diagram
[22:22] - Balance Set Manager
[25:30] - Waiting Threads
[26:52] - Summary

This installment goes over the cables and configuration steps required to set up kernel mode debugging.

We use these BCDEdit commands:

• bcdedit
• bcdedit /dbgsettings
• bcdedit /dbgsettings 1394 channel:42
• bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
• bcdedit /debug on
• bcdedit /debug off

In the debug session, we use these commands:

• .crash
• .dump /f
• lm
• !lmi
• .reload /f
• !drvobj
• !drvobj <module> 2
• bl
• bc *
• be <N>
• bd <N>
• bp <function>
• bm <wildcard>
• x <wildcard>
• g

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!

Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker

This installment goes over the commands used to diagnose Semaphores, Mutexes and (Waitable) Timers in a user mode application. For timers, we delve deep in to the kernel to gather more information about them. We use these commands:

• !handle
• !handle <handle> <mask>
• !object <name>
• !object <addr>
• !timer
• !timer <addr>
• ub @rip
• dt nt!_KTHREAD <addr>

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
Synchronization Functions
Semaphore Objects
Mutex Objects
Waitable Timer Objects
Sysinternals LiveKD
Sysinternals WinObj
Windows 7 and Windows Server 2008 R2 Kernel Changes (Timer Coalescing)

Timeline:
[02:47] - Demo Apps [SkyDrive]
[03:08] - Semaphores
[09:32] - Mutexes
[15:32] - Waitable Timers
[15:58] - Clock Resolution
[17:05] - Timer Coalescing
[19:45] - Timer demo application
[25:05] - LiveKD makes a kernel dump
[26:37] - Object Manager - !object
[29:40] - DPC Timers - !timer
[35:22] - !timer <addr>
[35:52] - Waiting Threads - !thread <addr> 17
[37:08] - Wait Start TickCount
[38:55] - Kernel Wait Routines
[41:12] - Dump Type of Kernel Thread - dt nt!_KTHREAD <addr>
[42:00] - Running, Ready and Waiting states
[44:54] - Wakable Timers
[47:22] - powercfg.exe /waketimers
[49:18] - 'Century' DPC Timer Routine
[50:43] - Post in the forums and email us at defragtools@microsoft.com!

This installment goes over the commands used to diagnose an Event hang in a user mode application. We talk about single and multiple event hangs, automatic and manual events, waitable object handles and common design patterns that you will encounter. We use these commands:

• ~*k
• ~*kv
• ~
• ~~[TID]s
• dp <addr>
• !handle
• !handle <handle> <mask>
• .dumpdebug
• !uniqstack
• !findstack <text>

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
Synchronization Functions
Sysinternals WinObj

Timeline:
[00:00] - Event objects
[03:56] - Waitable objects and Design Patterns
[08:00] - Handles
[10:52] - x64/x86/ARM calling conventions and 32/64bit addressing
[14:10] - WaitForSingleObject with a single Auto-Reset Event
[14:55] - !handle
[16:02] - .dumpdebug -- MiniDumpWithHandleData
[16:36] - !handle <handle> <mask>
[19:48] - Sysinternals WinObj
[24:14] - WaitForMultipleObjects with multiple Thread Handles
[30:00] - Work and Quit Event Design Pattern
[33:45] - WaitForMultipleObjects with multiple Event Handles
[38:52] - Windows Explorer example
[44:50] - Process Explorer also shows Handles (Ctrl-H)

This installment goes over the commands used to diagnose a Critical Section hang in a user mode application. We start with an overview of the four synchronization primitives and then delve deep in to temporary hangs, orphaned Critical Sections and deadlocks. We use these commands:

• ~*k
• ~*kv
• ~
• ~~[TID]s
• !cs
• !cs <pointer>
• !locks

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution.

Resources:
Critical Section Objects

Timeline:
[01:00] - Hang types - CPU Looping, Temporary Hangs and Permanent Hangs
[02:00] - Synchronization Objects - Event, Semaphore, Mutex, Critical Section
[06:54] - Critical Sections
[11:45] - Debugging a Hang
[28:08] - Debugging an Orphan
[32:40] - Debugging a Deadlock

Resources:
Windows Software Development Kit (SDK) for Windows 8
Sysinternals
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!

Timeline:
[00:00] - Table tablets and 4K screens at CES 2013
[02:30] - Time to upgrade our tools to the Windows 8\Windows RT versions!
[03:20] - www.sysinternals.com
[05:34] - Win7SP1 and Win8RTM folders
[06:16] - Bing: "Windows 8 SDK"
[06:53] - Bing: "Debugging Tools for Windows"
[07:25] - New web installer does installation or download.
[10:02] - MSI files are in the ..\Windows Kits\8.0\StandaloneSDK\Installers
[13:00] - Sync your 'My' folder with SkyDrive so it is always available!
[13:30] - Install the Debugging Tools for Windows to gather the files for xcopy deployment
[15:33] - Visual Studio 2012 builds PDBs with Inline Frame information
[17:23] - Visual Studio 2012 builds PDBs with Local Variable information
[18:55] - Windows 8 supports Network and USB3 kernel debugging
[21:10] - Visual Studio 2012 now supports both the VS and DbgEng debugger engines
[21:40] - Keep posting questions and sending email to defragtools@microsoft.com!

CES 2013:
Microsoft PixelSense
The Hobbit - Production Diary #4 - Film shot at 5K 48fps 3D

This installment goes over the commands used to show the memory used in a kernel mode debug session. We cover these commands:

• !vm
• !vm 1
• !memusage 8
• !poolused 2
• !poolused 4
• !poolfind <tag>
• !pool <addr>
• !pool <addr> 2
• !pte

Make sure you watch Defrag Tools Episode #1 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution.

Resources:
Microsoft Windows SDK for Windows 7 and .NET Framework 4
Sysinternals LiveKD
Sysinternals RAMMap

Timeline:
[00:45] - Sysinternals LiveKD debug of the machine
[01:47] - Virtual Memory summary (!vm 1)
[05:10] - Sysinternals LiveKD live kernel dump (livekd.exe -m -o kernel.dmp)
[09:30] - Sysinternals RAMMap
[11:10] - Memory List summary (!memusage 8)
[16:15] - Pool Usage by Non-Paged Pool (!poolused 2)
[20:16] - Pool Tags (c:\debuggers\triage\pooltag.txt)
[28:06] - Pool Usage by Paged Pool (!poolused 4)
[29:27] - Pool issues lead to Bugchecks
[34:00] - Find Pool by Address (!pool <addr>)
[36:05] - Find Pool by Tag (!poolfind <tag>)
[40:30] - Page Table Entry (PTE) and Page Frame Number (PFN) (!pte <addr>)
[42:45] - Sometimes it is a physical hardware failure

This installment goes over the commands used to show the memory used in a user mode debug session. We cover these commands:

• !address -summary
• !address <addr>
• !vprot <addr>
• !mapped_file <addr>

Make sure you watch Defrag Tools Episode #1 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution.

Resources:
Microsoft Windows SDK for Windows 7 and .NET Framework 4
Sysinternals VMMap
Performance and Memory Consumption Under WOW64
MEMORY_BASIC_INFORMATION structure
Memory Protection Constants

Timeline:
[00:50] - Live Debug of Notepad
[01:10] - VMMap of Notepad
[02:08] - Virtual Address Space summary (!address -summary)
[04:30] - 'Large Address Space Aware' increases the VA space from 2GB to 4GB
[08:11] - Memory Mapped Files
[10:11] - Memory Type, State and Protection (inc. Guard Pages)
[21:22] - Allocation Base vs. Base Address (!address <addr>)
[26:52] - Virtual Protection shows the Alloc. Base Protection (!vprot <addr>)
[29:14] - Mapped Files (!mapped_file <addr>)