3

On a x64 Windows 7 I want to get the limits of non paged pool. I know that _KDDEBUGGER_DATA64 structure has this information (fields like MmNonPagedPoolStart and MmNonPagedPoolEnd). On x86 systems this structure was obtained from KPCR.KdVersionBlock, but looking with WinDbg at KPCR's on x64 systems, KdVersionBlock seems to always be null.

Is there a way of getting this structure? Or another way of getting what I want? Maybe I'm not looking in the right place.

1

nt!KdDebuggerDatablock used to be a public global symbol in NT

lkd> x/v nt!KdDebuggerDataBlock
pub global 80545b60             0 nt!KdDebuggerDataBlock = <no type information> 

dpS nt!KdDebuggerDataBlock lxxxx should fetch the NonPagedPoolStart

lkd> !grep -i -c "dpS nt!KdDebuggerDataBlock la5" -e "pool"
 8055b5a0 nt!ExpPagedPoolDescriptor
 8054ab2c nt!ExpNumberOfPagedPools
 nt!MmMaximumNonPagedPoolInBytes
 80553cb8 nt!MmNonPagedPoolStart

This should get the complete structure

lkd> .printf "%ma\t%08x\n" , nt!KdDebuggerDataBlock+10,poi(nt!KdDebuggerDataBlock+14)
KDBG    00000290
lkd> .for (r $t0=0 ; @$t0 <poi(nt!KdDebuggerDataBlock + 14) ; r $t0 = @$t0+4) { .printf "%08x\t%08x\t%y\n", (nt!KdDebuggerDataBlock + @$t0) ,poi(nt!KdDebuggerDataBlock + @$t0) ,poi(nt!KdDebuggerDataBlock + @$t0) }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.