memory-mapped file Commit Charge (Windbg)
hi,
tried use windbg in live kernel debugger mode (lkd) view details file memory mapped application (dynamips-wxp-exe)
lkd> !process 898627e0 1 process 898627e0 sessionid: 0 cid: 14f8 peb: 7ffde000 parentcid: 15c8 dirbase: 0b4007a0 objecttable: e7360110 handlecount: 330. image: dynamips-wxp.exe vadroot 893c16f0 vads 125 clone 0 private 34357. modified 28923. locked 0. devicemap e61b5c90 token e7432940 elapsedtime 00:21:50.042 usertime 00:06:26.046 kerneltime 00:00:01.421 quotapoolusage[pagedpool] 346764 quotapoolusage[nonpagedpool] 13896 working set sizes (now,min,max) (39378, 50, 345) (157512kb, 200kb, 1380kb) peakworkingsetsize 39378 virtualsize 597 mb peakvirtualsize 635 mb pagefaultcount 68497 memorypriority background basepriority 8 commitcharge 68385 lkd> .process /p 898627e0 implicit process 898627e0 lkd> !vad ..... 89a56240 (10) 69a50 71a4f 65536 mapped execute_writecopy \documents , settings\20144620\desktop\ccie\gns3 lab\ospf\working\c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost ..... lkd> !vad 89a56240 1 vad @ 89a56240 start vpn 69a50 end vpn 71a4f control area 896b8ad0 firstprotopte e5e3e000 lastpte e5e4dff8 commit charge 10000 (65536.) secured.flink 0 blink 0 banked/extend 0 file offset 0 viewshare copyonwrite execute_writecopy controlarea @ 896b8ad0 segment e116d588 flink 00000000 blink 00000000 section ref 1 pfn ref 8000 mapped views 1 user ref 2 waitfordel 0 flush count 0 file object 898bc580 modwritecount 0 system views 0 flags (9008080) file waspurged haduserreference accessed \documents , settings\20144620\desktop\ccie\gns3 lab\ospf\working\c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost segment @ e116d588 type nt!_mapped_file_segment not found
here can see file c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost memory mapped in user virtual memory range 0x69a50000 - 0x71a4f000 (131kb)
memory mapping attribute protection execute_writecopy. lkd show commit charge of 262144 kb (65536 pages of 4kb each)
why ? can expert me ?
hi,
for windows debugging questions, please ask in http://social.msdn.microsoft.com/forums/en-us/windbg/threads
thanks.
regards,
miya
miya yao
technet community support
Windows Server > Windows Server General Forum
Comments
Post a Comment