memory-mapped file Commit Charge (Windbg)


hi,

tried use windbg in live kernel debugger mode (lkd) view details file memory mapped application (dynamips-wxp-exe)

lkd> !process 898627e0 1  process 898627e0  sessionid: 0  cid: 14f8    peb: 7ffde000  parentcid: 15c8      dirbase: 0b4007a0  objecttable: e7360110  handlecount: 330.      image: dynamips-wxp.exe      vadroot 893c16f0 vads 125 clone 0 private 34357. modified 28923. locked 0.      devicemap e61b5c90      token                             e7432940      elapsedtime                       00:21:50.042      usertime                          00:06:26.046      kerneltime                        00:00:01.421      quotapoolusage[pagedpool]         346764      quotapoolusage[nonpagedpool]      13896      working set sizes (now,min,max)  (39378, 50, 345) (157512kb, 200kb, 1380kb)      peakworkingsetsize                39378      virtualsize                       597 mb      peakvirtualsize                   635 mb      pagefaultcount                    68497      memorypriority                    background      basepriority                      8      commitcharge                      68385    lkd> .process /p 898627e0  implicit process 898627e0      lkd> !vad  .....    89a56240 (10)      69a50    71a4f      65536 mapped       execute_writecopy  \documents , settings\20144620\desktop\ccie\gns3 lab\ospf\working\c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost  .....      lkd> !vad 89a56240 1    vad @ 89a56240      start vpn        69a50  end vpn    71a4f  control area  896b8ad0    firstprotopte e5e3e000  lastpte e5e4dff8  commit charge    10000 (65536.)    secured.flink        0  blink          0  banked/extend        0    file offset          0          viewshare copyonwrite execute_writecopy    controlarea  @ 896b8ad0    segment      e116d588  flink      00000000  blink        00000000    section ref         1  pfn ref        8000  mapped views        1    user ref            2  waitfordel        0  flush count         0    file object  898bc580  modwritecount     0  system views        0      flags (9008080) file waspurged haduserreference accessed          \documents , settings\20144620\desktop\ccie\gns3 lab\ospf\working\c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost    segment @ e116d588  type nt!_mapped_file_segment not found 

here can see file c3725-adventerprisek9-mz.124-21a.bin-127.0.0.1.ghost memory mapped in user virtual memory range 0x69a50000 - 0x71a4f000 (131kb)

memory mapping attribute protection execute_writecopy. lkd show commit charge of 262144 kb (65536 pages of 4kb each)

why ? can expert me ?

hi,

for windows debugging questions, please ask in http://social.msdn.microsoft.com/forums/en-us/windbg/threads

thanks.

regards,
miya


miya yao

technet community support



Windows Server  >  Windows Server General Forum



Comments

Popular posts from this blog

Edit Group Policy

Hyper-V VM not reaching OS 'Logon' screen

DNS question...