1

REing a binary and while its running (using Windbg by the way) my (call)stack gets mangled. So I start to perform a stack trace [https://msdn.microsoft.com/en-us/library/windows/hardware/ff552143(v=vs.85).aspx].

However, when I'm verifying various symbols/functions in the target, various instructions are paged out so I cant tell if the previous instruction was a ret or a call above it, e.g.

kd> u fe682ae4-2 l1      //  paged out (all zeroes) unknown
rdr!_RdrSectionInfo+0x2a:
fe682ae2 0000             add     [eax],al

I know how to reload symbols via !vad extension [https://msdn.microsoft.com/en-us/library/windows/hardware/ff552153(v=vs.85).aspx]. However, that requires me to use (live)kd.

Is there an easier way to ensure the target application doesn't get paged out, short of disabling the pagefile?

I've searched Google, OSRonline, Woodmann, etc. and haven't found anything helpful.

3
  1. The prompt shown is kd> so you are debugging a live kernel.
  2. If memory could not be accessed windbg will show ? Not 0000
    maybe you actually have 0000 in the address.

Did you try doing .pagein ?

Did you try viewing the physical address !vtop 0 <virtualaddress> ?

Here is sample of unaccessible memory:

.fnent notepad!
SaveFile (01004eae) notepad!SaveFile | (01005179) notepad!LoadFile   
OffStart: 00004eae    
ProcSize: 0x2c6 kd>     
? 4eae+140+notepad = 01004fee     
kd> db notepad!SaveFile+0x140 l20    
01004fee a0 90 00 01 ff 35 54 90-00 01 ff 75 08 e8 70 cf .....5T....u..p.    
01004ffe ff ff ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ..?????????????? 

Notice the question marks ???? because the next page at boundary 1005000 is inaccessible.

kd> .pagein /p 8114bc38 1005000 
You need to continue execution (press 'g' <enter>) for the pagein to be brought in.      
When the debugger breaks in again, the page will be present.
kd> g
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
804e35a2 cc              int     3
kd> db 1004ff0 
01004ff0  00 01 ff 35 54 90 00 01-ff 75 08 e8 70 cf ff ff  ...5T....u..p...
01005000  83 f8 02 0f 84 a9 00 00-00 33 ff 53 ff 75 10 57  .........3.S.u.W
01005010  ff 75 f8 ff 35 80 a4 00-01 e8 7b fb ff ff eb 78  .u..5.....{....x
| improve this answer | |
  • Thanks for helping blabb! I'm using windbg and not kd. I took the example output of the unassemble command from the MSDN article about stacktracing (whose author was using kd). In that article it stated a series of '0x00' means its likely paged out. So I can't use !vtop in windbg. .fnent returns 'no function entry for [virt addr]' However, .pagein appears to be in play. How may I find out the address of the EPROCESS block/address of the process that owns the memory for .pagein's /p [EPROC addr] argument? Im using windbg, so !PROCESS is out of play – grepNstepN Aug 10 '15 at 13:16
  • i would suggest you to post actual sequences i do not understand why you cannot use !vtop is windbg windbg is just a gui for kd again why you cannot use windbg for !process ?? do you mean you are debugging an user mode executable (then this whole question doesn't make sense clarify your request to provide any meaningful answer – blabb Aug 10 '15 at 19:35
  • When I started debugging this with ring3 debugger, I didn't have the /DEBUG option set in my BCD. Im in just plain windbg and not kd. I cant restart my machine for it to allow kernel debugging. '!vtop', '!process' etc. throw 'no export process found' because they're extensions for the ring0 debugger 'kd'. You'll get the same error if you open windbg (no kernel debugging), attach to a process and attempt to run said extensions. – grepNstepN Aug 10 '15 at 20:25
  • To invasively inspect the process' state I'd have to loosely follow [osronline.com/article.cfm?article=576], which wont work with local kd [stackoverflow.com/questions/8738579/… have to wait a week until I get home to attach a remote debugger :(. Thanks anyway blabb – grepNstepN Aug 10 '15 at 20:26
  • 1
    if you do not have /debug switch enabled and you want to do Local kernel debugging use livekd from sysinternals it accepts all the windbg commands but is also able to do local kernel debugging when /debug is not enabled in bcd – blabb Aug 11 '15 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.