Monday, June 17, 2013

Windbg script to dump components of 64 bit virtual address

$$ http://blogs.msdn.com/b/ntdebugging/archive/2010/06/22/part-3-understanding-pte-non-pae-and-x64.aspx
$$
$$ $$>a$$
$$ Dumping different components of Virtual Address on x64 machine
$$
.block {
  $$ Original Virtual address
  r $t0 = ${$arg1}
 
  $$ Physical Page Offset of 12 bits
  r $t1 = @$t0 & 0xfff
 
  $$ Page Table Offset of 9 bits
  r $t2 = @$t0 >> 0n12
  r $t2 = @$t2 & 0x1ff
 
  $$ Page Directory Offset of 9 bits
  r $t3 = @$t0 >> 0n21
  r $t3 = @$t3 & 0x1ff
 
  $$ Page Directory Pointer Offset of 9 bits
  r $t4 = @$t0 >> 0n30
  r $t4 = @$t4 & 0x1ff
 
  $$ Page Map Level 4 Offset of 9 bits
  r $t5 = @$t0 >> 0n39
  r $t5 = @$t5 & 0x1ff
 
  .printf "!pte\n"
  !pte @$t0
 
  .printf "\n"
  .formats @$t0
 
  .printf "\n\n"
  $$ for decimal use %d and for hex use %x
  .printf "VA:0x%p = PageMapLevel4Offset:0n%d PageDirectoryPointerOffset:0n%d PageDirectoryOffset:0n%d PageTableOffset:0n%d PhysicalPageOffset:0n%d\n\n", @$t0, @$t5, @$t4, @$t3, @$t2, @$t1
  .printf "VA:0x%p = PageMapLevel4Offset:0x%lx PageDirectoryPointerOffset:0x%lx PageDirectoryOffset:0x%lx PageTableOffset:0x%lx PhysicalPageOffset:0x%lx\n\n", @$t0, @$t5, @$t4, @$t3, @$t2, @$t1
   
  $$ to dump values at cr3 + PageMapLevel4Offset
  .printf "Values of PML4 offset\n"
  !dq @cr3 + (@$t5 * @@(sizeof(nt!_HARDWARE_PTE))) L1
}