Windows Internals covering windows server 2008 and windows vista- P15

Windows Internals covering windows server 2008 and windows vista- P15: In this chapter, we’ll introduce the key Microsoft Windows operating system concepts andterms we’ll be using throughout this book, such as the Windows API, processes, threads, virtualmemory, kernel mode and user mode, objects, handles, security, and the registry.
Nội dung trích xuất từ tài liệu:
Windows Internals covering windows server 2008 and windows vista- P15 segment thread) if available virtual address space has dropped below 128 MB. (Reclaiming can also be satisfied if initial nonpaged pool has been freed.) EXPERIMENT: Determining the Virtual address Type for an address Each time the kernel virtual address space allocator obtains virtual memory ranges for use by a certain type of virtual address, it updates the MiSystemVaType array, which contains the virtual address type for the newly allocated range. By taking any given kernel address and calculating its PDE index from the beginning of system space, you can dump the appropriate byte field in this array to obtain the virtual address type. For example, the following commands will display the virtual address types for Win32k.sys, the process object for WinDbg, the handle table for WinDbg, the kernel, a file system cache segment, and hyperspace: 1. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((win32k - 2. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 3. _MI_SYSTEM_VA_TYPE MiVaSessionGlobalSpace (11) 4. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((864753b0 5. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 6. _MI_SYSTEM_VA_TYPE MiVaNonPagedPool (5) 7. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((8b2001d0 8. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 9. _MI_SYSTEM_VA_TYPE MiVaPagedPool (6) 10. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((nt - 11. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 12. _MI_SYSTEM_VA_TYPE MiVaBootLoaded (3) 13. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((0xb3c8000 0- 14. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 15. _MI_SYSTEM_VA_TYPE MiVaSystemCache (8) 16. lkd> ?? nt!_MI_SYSTEM_VA_TYPE (((char*)@@(nt!MiSystemVaType))[@@((c0400000 17. poi(nt!MmSystemRangeStart))/(1000*1000/@@(sizeof(nt!MMPTE)) ))]) 18. _MI_SYSTEM_VA_TYPE MiVaProcessSpace (2) In addition to better proportioning and better management of virtual addresses dedicated to different kernel memory consumers, the dynamic virtual address allocator also has advantages when it comes to memory footprint reduction. Instead of having to manually preallocate static page table entries and page tables, paging-related structures are allocated on demand. On both 32-bit and 64-bit systems, this reduces boot-time memory usage because unused addresses won’t have their page tables allocated. It also means that on 64-bit systems, the large address space regions that are reserved don’t need to have their page tables mapped in memory, which allows them to have arbitrarily large limits, especially on systems that have little physical RAM to back the resulting paging structures. 690Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. EXPERIMENT: Querying System Virtual address usage You can look at the current usage and peak usage of each system virtual address type by using the kernel debugger. For each system virtual address type described in Table 9-9, the MiSystemVaTypeCount, MiSystemVaTypeCountFailures, and MiSystemVaTypeCountPeak arrays in the kernel contain the sizes, count failures, and peak sizes for each type. Here’s how you can dump the usage for the system, followed by the peak usage (you can use a similar technique for the failure counts): 1. lkd> dd /c 1 MiSystemVaTypeCount l c 2. 81f4f880 00000000 3. 81f4f884 00000028 4. 81f4f888 00000008 5. 81f4f88c 0000000c 6. 81f4f890 0000000b 7. 81f4f894 0000001a 8. 81f4f898 0000002f 9. 81f4f89c 00000000 10. 81f4f8a0 000001b6 11. 81f4f8a4 00000030 12. 81f4f8a8 00000002 13. 81f4f8ac 00000006 14. lkd> dd /c 1 MiSystemVaTypeCountPeak l c 15. 81f4f840 00000000 16. 81f4f8 ...