I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It works fine on RwEverything. Any ideas?

  • So you have a KD session to a target computer when you do that? For example I get the same with just -m but the [uc] works perfectly fine for me. Using a kdnet connection to a Windows 10 VM.
    – 0xC0000022L
    Commented Apr 21, 2021 at 11:09
  • @0xC0000022L I have a WinDbg connection to a VirtualBox VM over a pipe connected to a virtual COM1 port, and I also tested all variations of the commands using kd -kl on my local machine, neither work. On my local machine however, RwEverything works fine for this purpose -- but I like to understand why it's not working Commented Apr 21, 2021 at 11:16
  • @0xC0000022L That's weird, it worked on remote KD but not remote WinDbg Commented Apr 21, 2021 at 11:31
  • But your target does have 4 GiB of "physical" memory, right?
    – 0xC0000022L
    Commented Apr 21, 2021 at 11:32
  • 1
    Yes it has 8GiB, but this range maps to virtual flash so that's irrelevant. It does work on WinDbg, I made a mistake (I did !db [uc] 00000000`fffffff0 which didn't work at that time because I was on bootmgr (so it couldnt read past 4GiB). I tried it again on WinDbg with !db [uc] 00000000`ffffff00 and it worked). This however does not work on kd -kl no matter what, which is a shame because I'm more interested in my own hardware -- RwEverything is what I have to use Commented Apr 21, 2021 at 11:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.