Entries:
Comments:
Posts:

Loading User Information from Channel 9

Something went wrong getting user information from Channel 9

Latest Achievement:

Loading User Information from MSDN

Something went wrong getting user information from MSDN

Visual Studio Achievements

Latest Achievement:

Loading Visual Studio Achievements

Something went wrong getting the Visual Studio Achievements

Defrag Tools: #21 - WinDbg - Memory User Mode

Download

Right click “Save as…”

In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.

This installment goes over the commands used to show the memory used in a user mode debug session. We cover these commands:

  • !address -summary
  • !address <addr>
  • !vprot <addr>
  • !mapped_file <addr>

Make sure you watch Defrag Tools Episode #1 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution.

Resources:
Microsoft Windows SDK for Windows 7 and .NET Framework 4
Sysinternals VMMap
Performance and Memory Consumption Under WOW64
MEMORY_BASIC_INFORMATION structure
Memory Protection Constants

Timeline:
[00:50] - Live Debug of Notepad
[01:10] - VMMap of Notepad
[02:08] -
Virtual Address Space summary (!address -summary)
[04:30] - 'Large Address Space Aware' increases the VA space from 2GB to 4GB

[08:11] - Memory Mapped Files
[10:11] - Memory Type, State and Protection (inc. Guard Pages)
[21:22] - Allocation Base vs. Base Address (!address <addr>)
[26:52] - Virtual Protection shows the Alloc. Base Protection (!vprot <addr>)
[29:14] - Mapped Files (!mapped_file <addr>)

Tag:

Follow the Discussion

  • I love this series. I know they're all about the tools, but don't be afraid to go on a slight tangent to cover some topic that isn't necessarily well understood. You guys seem to know where these points are and you do a great job of explaining briefly, but in some cases I don't think it'd hurt to expound on it.

  • AndresAndres

    Richard, you really need to stop drinking sodas before a session like this, you are burping all the time, it is really irritating.

Remove this comment

Remove this thread

close

Comments Closed

Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation, please create a new thread in our Forums,
or Contact Us and let us know.