Defrag Tools: #21 - WinDbg - Memory User Mode
- Posted: Jan 01, 2013 at 12:46 AM
- 58,818 Views
- 2 Comments
In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.
This installment goes over the commands used to show the memory used in a user mode debug session. We cover these commands:
- !address -summary
- !address <addr>
- !vprot <addr>
- !mapped_file <addr>
Make sure you watch Defrag Tools Episode #1 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution.
Resources:
Microsoft Windows SDK for Windows 7 and .NET Framework 4
Sysinternals VMMap
Performance and Memory Consumption Under WOW64
MEMORY_BASIC_INFORMATION structure
Memory Protection Constants
Timeline:
[00:50] - Live Debug of Notepad
[01:10] - VMMap of Notepad
[02:08] - Virtual Address Space summary (!address -summary)
[04:30] - 'Large Address Space Aware' increases the VA space from 2GB to 4GB
[08:11] - Memory Mapped Files
[10:11] - Memory Type, State and Protection (inc. Guard Pages)
[21:22] - Allocation Base vs. Base Address (!address <addr>)
[26:52] - Virtual Protection shows the Alloc. Base Protection (!vprot <addr>)
[29:14] - Mapped Files (!mapped_file <addr>)
Comment on the Post
Already have a Channel 9 account? Please sign in
More episodes in this show
-
Defrag Tools: #20 - WinDbg - Basic Commands
-
Defrag Tools: #21 - WinDbg - Memory User Mode
-
Defrag Tools: #22 - WinDbg - Memory Kernel Mode
Follow the Discussion
Oops, something didn't work.
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.sign up for email notifications?
I love this series. I know they're all about the tools, but don't be afraid to go on a slight tangent to cover some topic that isn't necessarily well understood. You guys seem to know where these points are and you do a great job of explaining briefly, but in some cases I don't think it'd hurt to expound on it.
Richard, you really need to stop drinking sodas before a session like this, you are burping all the time, it is really irritating.
Remove this comment
Remove this thread
close