WdbgExts Memory Access

This topic provides a brief overview of how memory access can be performed using the WdbgExts API. For an overview of memory access in the debugger engine, see Memory in the Debugger Engine Overview section of this documentation.

Virtual Memory

The virtual memory of the target can be read by using the ReadMemory function and written using the WriteMemory function. Pointers in the target's memory can be read and written by using the ReadPointer, ReadPtr, and WritePointer functions.

To search the virtual memory for a pattern of bytes, use the SearchMemory function.

The TranslateVirtualToPhysical function can be used to convert a virtual memory address to a physical memory address.

The Disasm function can be used to disassemble a single assembly instruction on the target.

To check the low 4 GB of memory for corruption when using physical address extension (PAE), use the Ioctl operation IG_LOWMEM_CHECK.

Physical Memory

Physical memory can only be directly accessed in kernel-mode debugging.

The physical memory on the target can be read by using the ReadPhysical and ReadPhysicalWithFlags functions, and written by using the WritePhysical and WritePhysicalWithFlags functions.

To search the physical memory for pointers to locations within a specified range, use the Ioctl operation IG_POINTER_SEARCH_PHYSICAL.

Other Data Spaces

In kernel-mode debugging, it is possible to read and write data to a variety of data spaces in addition to the main memory. The following data spaces can be accessed:

Control-Space Memory

The functions ReadControlSpace, ReadControlSpace64, ReadTypedControlSpace32, and ReadTypedControlSpace64 will read data from a control space. The WriteControlSpace function will write data to a control space.

I/O Memory

The functions ReadIoSpace, ReadIoSpace64, ReadIoSpace64, ReadIoSpaceEx64 will read data from system I/O memory and bus I/O memory. The functions WriteIoSpace, WriteIoSpace64, WriteIoSpaceEx, and WriteIoSpaceEx64 will write data to system I/O memory and bus I/O memory.

Model Specific Register (MSR)

The functions ReadMsr and WriteMsr read and write MSRs.

System Bus

The Ioctl operations IG_GET_BUS_DATA and IG_SET_BUS_DATA read and write system bus data.

Additional Information

For a more powerful memory access API, see Memory Access in the Using the Debugger Engine API section of this documentation.