Comment Feed for Channel 9 - Defrag Tools: #22 - WinDbg - Memory Kernel Mode http://media.ch9.ms/ch9/128a/6cf46ae7-4ba9-42e7-beca-3e5a3770128a/DefragTools22_220.jpg Channel 9 - Defrag Tools: #22 - WinDbg - Memory Kernel Mode In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer. This installment goes over the commands used to show the memory used in a kernel mode debug session. We cover these commands: !vm !vm 1 !memusage 8 !poolused 2 !poolused 4 !poolfind <tag> !pool <addr> !pool <addr> 2 !pte Make sure you watch Defrag Tools Episode #1 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbols and source code resolution. Resources:Microsoft Windows SDK for Windows 7 and .NET Framework 4 Sysinternals LiveKDSysinternals RAMMap Timeline:[00:45] - Sysinternals LiveKD debug of the machine[01:47] - Virtual Memory summary (!vm 1)[05:10] - Sysinternals LiveKD live kernel dump (livekd.exe -m -o kernel.dmp)[09:30] - Sysinternals RAMMap[11:10] - Memory List summary (!memusage 8)[16:15] - Pool Usage by Non-Paged Pool (!poolused 2)[20:16] - Pool Tags (c:\debuggers\triage\pooltag.txt)[28:06] - Pool Usage by Paged Pool (!poolused 4)[29:27] - Pool issues lead to Bugchecks[34:00] - Find Pool by Address (!pool <addr>)[36:05] - Find Pool by Tag (!poolfind <tag>)[40:30] - Page Table Entry (PTE) and Page Frame Number (PFN) (!pte <addr>)[42:45] - Sometimes it is a physical hardware failure en Tue, 21 May 2013 10:50:12 GMT Tue, 21 May 2013 10:50:12 GMT Rev9 Re: Defrag Tools: #22 - WinDbg - Memory Kernel Mode The video seems to bug out at 31:57.  Is anyone else having this issue or is it just me?

posted by JohnLudlow

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634932657642626477 Tue, 08 Jan 2013 18:16:04 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634932657642626477 JohnLudlow Re: Defrag Tools: #22 - WinDbg - Memory Kernel Mode @JohnLudlow: what's happening with your video exactly? 

posted by golnazal

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634932900411296131 Wed, 09 Jan 2013 01:00:41 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634932900411296131 golnazal Re: Defrag Tools: #22 - WinDbg - Memory Kernel Mode Happy New Year!!! 

Dudes I love this series its totally awesome... I feel you guy's are providing a great learning outlet especially for a beginner like myself. However at times the show gets hi jacked and it never gets back on course. I felt the past two episodes could have been a bit more linear and detailed.

keep up the good work dudes.

posted by dcrearer

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634933022862863135 Wed, 09 Jan 2013 04:24:46 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634933022862863135 dcrearer Re: Defrag Tools: #22 - WinDbg - Memory Kernel Mode @dcrearer:  Send us an email at defragtools@microsoft.com to explain what you exactly mean. We'd really like to hear your feedback in detail.

Since we are making up the content (live) as we go to air, we may get off track from time-to-time. When we do, call us on it and we will revisit the episode.

posted by windev

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634933062989991133 Wed, 09 Jan 2013 05:31:38 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c634933062989991133 windev Re: Defrag Tools: #22 - WinDbg - Memory Kernel Mode
Btw, concerning the 'bad' pages mentioned in !memusage, this value is typically not an accurate representation of actual bad pages. Pavel Lebedinsky, SDET at Microsoft, commented on this at the blog below:

http://analyze-v.com/?p=558#comments

posted by igarvin

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c635006900398829815 Thu, 04 Apr 2013 16:33:59 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-22-WinDbg-Memory-Kernel-Mode#c635006900398829815 igarvin