[Autogenerated] let's see what we can learn about the
virtual other translation from the Colonel debugger So I
have my current debugger here, open with the local current debugging session.
One thing we've seen in an earlier course is the process command.
If we've done processes in a very simple process.
00 command.
Just stop that don't really care about all the processes here.
Just want to mention that the deer base you see here,
that's exactly the physical address of the page map.
Level four data structure, that's the singleton one per process that we have.
So this is one of those rare cases where the ______ actually shows
physical addresses rather than mutual addresses.
So this is in fact the physical address.
How can you see what's in there?
So you might recall the normal de family of commands
have been using several times.
So the DB command for example will show us whatever is in
some mutual address that we provide.
However,
the bank dB command will do the same but interpret the
address as a physical address so if I do that,
we can see the memory in this particular physical
address and some addresses later.
The pound sign here on the left indicates this address is actually a
physical address and not via to address which is the default that we see in
most other commands now of course because these PML level four data
structure is really a bunch of 512 8 bite sized chunks we can probably use
a more suitable command which is the cue to show these eight by chunks in
single values So you can try to interpret those based on the information
given in the previous slide and although it's very interesting to try to do
that, I'm not going to do that here.
I'll leave that as an exercise for you.
What I do want to show you is how to perform this translation
by using the kernel debugger itself without having to
explicitly dig into the actual bids.
Okay I cleared the screen here.
What I want to do is to try to translate some kernel address so you can
select anything that we expect to be in physical memory and one of the
things we can select our process objects.
Process objects because process objects are always non payable.
So if I do process process zero or look for something let's
grab really anything doesn't really matter.
Let's search for an explorer process.
It doesn't matter which process we choose.
As long as we take some current address that we know is viable,
it's committed and in this case I also want to make sure that
page fault will not occur here so we'll select something which is
definitely mapped to physical memory.
So here's the process,
this is one process we can select that's going to be good enough and
I don't care about the fact this is a process.
I just want to look at that memory, it's just a bunch of bytes.
So this is what we get at the beginning of this chunk of memory.
So now in order to translate that to virtual memory there are two
commands we can use one of them is the P T command.
Now unfortunately PTE command has some issues and sometimes it
doesn't work and sometimes Microsoft fixes that and then it
doesn't work later on and so on.
And as it hap when I'm recording this course here, the command doesn't work.
This is just a bug on Microsoft's part.
They're implementing the PT command, you might find that on your system.
It works and so you're kind of lucky.
Get lucky at that particular point but it doesn't work on my system here.
And so we'll have to turn to the other option.
And the other option is that command called V two P.
If I look at the V two P command without any parameters
and of course it's all documented.
You can see it requires the PML four address,
the physical address, that's what this thing is trying to tell us.
And then the virtual address in question,
we would like to translate to a physical address and so we need
to get this PML four but PML four for which process because we're
looking at the kernel address here.
The process responsible for kernel addresses is the system process.
So we need to grab the PML four address directory base for the
system process which has an idea of four.
Let me just quickly find that process so we can see what the address of
the deer base is and that's the address right here.
So if you use V two P now provide this address as a context upon
which virtual address translation can take place.
And then of course grab the address I would like to translate.
Which is that particular address as we've seen earlier.
If you do that we get something we get something that
shows us the translation process really.
So you can see the future address we provided and that's
the page directory base we provided.
That's known.
But here's the value in PML for entry that's the entry there.
And if you want to do these things manually you can compare
with the results provided by V two P.
And that points to a page directory entry here and that that's the page
directory pointer entry and that's the page directory entry.
And finally apparently this is actually mapped using a large page
and this is the final address in physical memory.
That's the address we should be looking at to see what's
going on with that virtual address here.
Notice by the way the last three digits are the same
because this never go translated at all.
They're never translated in practice.
So let's see if that in fact shows the same memory.
Let me grab the the address here,
the physical address and use the bank the b command to see
what's going on in that physical address.
And so if you compare that to what we've seen earlier,
let me just dump that here to make it close by by looking at
that address from virtual perspective.
You see this is exactly the same contents.
Notice this line is exactly the same as this one.
debugger is nice enough to highlight these same characters so you can see that.
In fact this is correct.
This is the virtual address and this is the physics.
So this is the future address and this is the physical address.
So this corresponds exactly one to another.
We can see here the translation process here that has happened before our eyes.
So the V two P command does the right thing by digging into those data
structures starting with the page directory as the base and using the
mutual address beats various bits as we've seen in previous slide to dig
into the actual beat there and point to the next structures and so on until
it gets to the final translation.
This case there was the large large page bit was set so the
actual page table wasn't really examined.
There was no page table there.
It was from the page directory directly.
We have a large page here.
Now what happens if you're talking about the user
mode address for user mode address?
The idea would be the same but in this case we would use the deer base
that is provided for that particular process rather than what we're
seeing here which is the system process.
We just use different process so that you try it out yourself by finding
some interesting address or some something that is mapped.
You can use the VM app to figure out what is mapped in a particular process,
and then through the current debugger to see what that
looks like using the V two P command.