Questions tagged [pages]
The pages tag has no usage guidance.
5 questions
1
vote
0
answers
281
views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
- 305
1
vote
0
answers
38
views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
- 305
0
votes
2
answers
284
views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
- 305
0
votes
2
answers
821
views
Reading the process memory yields different results
I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
user1743
4
votes
1
answer
2k
views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
user1743