Debugging Tools for Windows |
(仅Windows XP)!xpoolmap扩展命令显示内存池使用的map。
!xpoolmap -?
Windows NT 4.0 | 不可用 |
Windows 2000 | 不可用 |
Windows XP和之后 | Kdexts.dll |
该扩展命令只能用于x86目标机。
!xpoolmap扩展仅在Windows XP上支持。在Windows 2000 和Windows NT 4.0上,使用!kdex2x86.xpool –map。这个扩展命令是OEM支持扩展包(OEM Support Extensions package)的一部分。关于这个包的安装,查看OEM支持扩展(kdex2x86.dll)。
下面是一个部分的例子:
unable to get nt!MmSubsectionTopPage
unable to get nt!MmNonPagedMustSucceed
.....................................................
Status Map of Pool Area Pages
==============================
'O': one page in use ('P': paged out)
'<': start page of contiguous pages in use ('{': paged out)
'>': last page of contiguous pages in use ('}': paged out)
'=': intermediate page of contiguous pages in use ('-': paged out)
'.': one page not used
Non-Paged Pool Area Summary
----------------------------
Maximum Number of Pages = 52691 pages
Number of Pages In Use = 52689 pages (100.0%)
+00000 +08000 +10000 +18000 +20000 +28000 +30000 +38000
81653000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO
81693000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO
816d3000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO
...
86753000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO
86793000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO
867d3000: OOOOOOOOOOOOOOOO OOOOOOOOOOOOOOOO OOOOOOOOOOOO<
f7fba000: .>OOOOOOOOO<==== >O<=><>OOOO<><>O O<=======>OOOO<= >OO<>OOOOOOOOOOO
f7ffa000: OOOO<=><><=><=== >OOOO<>OO<=><>OO OOO<><=>O<=====> <=>OOOOO<>O<==><
f803a000: >O<===><==>OOOOO OOOOOOOOOOOOO<=> OOOOO<=>O<==><>O OOO<>OO<=====><=
f807a000: ><>OOOOO<=>O<=>O <>OOOOOOOO<==>OO <>OOOOOOO<====>O <>OO<><>OOOOO<>O
...
ffafa000: >OOO<>OOOOOOOOOO OOO<==>OOO<>O<>O OO<=======>OOOOO O<===>OOOOOOOOOO
ffb3a000: O<>OO<>OOOOOOOOO O<==>OOOOO<>OO<> OO<=>O<=><>OOOO< >OOOOOOOOOOO<><>
ffb7a000: <==>OO<>OOOOO<=> OOOO<=>O<==><=== ====>OOOO<>OOOOO OOO<>O<>OOO<==><
ffbba000: =>OOO<=====>O<== >OOO<=><=>OOOO<= >OO<=.