tailieunhanh - Windows Internals covering windows server 2008 and windows vista- P15

Windows Internals covering windows server 2008 and windows vista- P15: In this chapter, we’ll introduce the key Microsoft Windows operating system concepts and terms we’ll be using throughout this book, such as the Windows API, processes, threads, virtual memory, kernel mode and user mode, objects, handles, security, and the registry. | segment thread if available virtual address space has dropped below 128 MB. Reclaiming can also be satisfied if initial nonpaged pool has been freed. EXPERIMENT Determining the Virtual address Type for an address Each time the kernel virtual address space allocator obtains virtual memory ranges for use by a certain type of virtual address it updates the MiSystemVaType array which contains the virtual address type for the newly allocated range. By taking any given kernel address and calculating its PDE index from the beginning of system space you can dump the appropriate byte field in this array to obtain the virtual address type. For example the following commands will display the virtual address types for the process object for WinDbg the handle table for WinDbg the kernel a file system cache segment and hyperspace 1. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ win32k - 2. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 3. _MI_SYSTEM_VA_TYPE MiVaSessionGlobalSpace 11 4. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ 864753b0 5. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 6. _MI_SYSTEM_VA_TYPE MiVaNonPagedPool 5 7. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ 8b2001d0 8. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 9. _MI_SYSTEM_VA_TYPE MiVaPagedPool 6 10. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ nt - 11. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 12. _MI_SYSTEM_VA_TYPE MiVaBootLoaded 3 13. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ 0xb3c8000 0 - 14. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 15. _MI_SYSTEM_VA_TYPE MiVaSystemCache 8 16. lkd nt _MI_SYSTEM_VA_TYPE char @@ nt MiSystemVaType @@ c0400000 17. poi nt MmSystemRangeStart 1000 1000 @@ sizeof nt MMPTE 18. _MI_SYSTEM_VA_TYPE MiVaProcessSpace 2 In addition to better proportioning and better management of virtual addresses dedicated to different kernel memory consumers the dynamic virtual address

TỪ KHÓA LIÊN QUAN
crossorigin="anonymous">
Đã phát hiện trình chặn quảng cáo AdBlock
Trang web này phụ thuộc vào doanh thu từ số lần hiển thị quảng cáo để tồn tại. Vui lòng tắt trình chặn quảng cáo của bạn hoặc tạm dừng tính năng chặn quảng cáo cho trang web này.