2013年3月12日 星期二

WinDbg_!address 說明文件


The following filter values specify memory regions by the way that the target process is using them.
Filter value Memory regions displayed
VAR Busy regions. These regions include all virtual allocation blocks, the SBH heap, memory from custom allocators, and all other regions of the address space that fall into no other classification.
Free Free memory. This includes all memory that has not been reserved.
Image Memory that is mapped to a file that is part of an executable image.
Stack Memory used for thread stacks.
Teb Memory used for thread environment blocks (TEBs).
Peb Memory used for the process environment block (PEB).
Heap Memory used for heaps.
PageHeap The memory region used for the full-page heap.
CSR CSR shared memory.
Actx Memory used for activation context data.
NLS Memory used for National Language Support (NLS) tables.
FileMap Memory used for memory-mapped files. This filter is applicable only during live debugging.



The following filter values specify memory regions by the memory type.
Filter value Memory regions displayed
MEM_IMAGE Memory that is mapped to a file that is part of an executable image.
MEM_MAPPED Memory that is mapped to a file that is not part of an executable image. This includes memory that is mapped to the paging file.
MEM_PRIVATE Private memory. This memory is not shared by any other process, and it is not mapped to any file.

The following filter values specify memory regions by the state of the memory.
Filter value Memory regions displayed
MEM_COMMIT Committed memory.
MEM_FREE Free memory. This includes all memory that has not been reserved.
MEM_RESERVE Reserved memory.

The following filter values specify memory regions by the protection applied to the memory.
Filter value Memory regions displayed
PAGE_NOACCESS Memory that cannot be accessed.
PAGE_READONLY Memory that is readable, but not writable and not executable.
PAGE_READWRITE Memory that is readable and writable, but not executable.
PAGE_WRITECOPY Memory that has copy-on-write behavior.
PAGE_EXECUTE Memory that is executable, but not readable and not writeable.
PAGE_EXECUTE_READ Memory that is executable and readable, but not writable.
PAGE_EXECUTE_READWRITE Memory that is executable, readable, and writable.
PAGE_EXECUTE_WRITECOPY Memory that is executable and has copy-on-write behavior.
PAGE_GUARD Memroy that acts as a guard page.
PAGE_NOCACHE Memory that is not cached.
PAGE_WRITECOMBINE Memory that has write-combine access enabled.