进程内存

ntdll!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x098 ProcessLock      : _EX_PUSH_LOCK
   +0x0a0 CreateTime       : _LARGE_INTEGER
   +0x0a8 ExitTime         : _LARGE_INTEGER
   +0x0b0 RundownProtect   : _EX_RUNDOWN_REF
   +0x0b4 UniqueProcessId  : Ptr32 Void
   +0x0b8 ActiveProcessLinks : _LIST_ENTRY
   +0x0c0 ProcessQuotaUsage : [2] Uint4B
   +0x0c8 ProcessQuotaPeak : [2] Uint4B
   +0x0d0 CommitCharge     : Uint4B
   +0x0d4 QuotaBlock       : Ptr32 _EPROCESS_QUOTA_BLOCK
   +0x0d8 CpuQuotaBlock    : Ptr32 _PS_CPU_QUOTA_BLOCK
   +0x0dc PeakVirtualSize  : Uint4B
   +0x0e0 VirtualSize      : Uint4B
   +0x0e4 SessionProcessLinks : _LIST_ENTRY
   +0x0ec DebugPort        : Ptr32 Void
   +0x0f0 ExceptionPortData : Ptr32 Void
   +0x0f0 ExceptionPortValue : Uint4B
   +0x0f0 ExceptionPortState : Pos 0, 3 Bits
   +0x0f4 ObjectTable      : Ptr32 _HANDLE_TABLE
   +0x0f8 Token            : _EX_FAST_REF
   +0x0fc WorkingSetPage   : Uint4B
   +0x100 AddressCreationLock : _EX_PUSH_LOCK
   +0x104 RotateInProgress : Ptr32 _ETHREAD
   +0x108 ForkInProgress   : Ptr32 _ETHREAD
   +0x10c HardwareTrigger  : Uint4B
   +0x110 PhysicalVadRoot  : Ptr32 _MM_AVL_TABLE
   +0x114 CloneRoot        : Ptr32 Void
   +0x118 NumberOfPrivatePages : Uint4B
   +0x11c NumberOfLockedPages : Uint4B
   +0x120 Win32Process     : Ptr32 Void
   +0x124 Job              : Ptr32 _EJOB
   +0x128 SectionObject    : Ptr32 Void
   +0x12c SectionBaseAddress : Ptr32 Void
   +0x130 Cookie           : Uint4B
   +0x134 Spare8           : Uint4B
   +0x138 WorkingSetWatch  : Ptr32 _PAGEFAULT_HISTORY
   +0x13c Win32WindowStation : Ptr32 Void
   +0x140 InheritedFromUniqueProcessId : Ptr32 Void
   +0x144 LdtInformation   : Ptr32 Void
   +0x148 VdmObjects       : Ptr32 Void
   +0x14c ConsoleHostProcess : Uint4B
   +0x150 DeviceMap        : Ptr32 Void
   +0x154 EtwDataSource    : Ptr32 Void
   +0x158 FreeTebHint      : Ptr32 Void
   +0x160 PageDirectoryPte : Uint8B
   +0x168 Session          : Ptr32 Void
   +0x16c ImageFileName    : [15] UChar
   +0x17b PriorityClass    : UChar
   +0x17c JobLinks         : _LIST_ENTRY
   +0x184 LockedPagesList  : Ptr32 Void
   +0x188 ThreadListHead   : _LIST_ENTRY
   +0x190 SecurityPort     : Ptr32 Void
   +0x194 PaeTop           : Ptr32 Void
   +0x198 ActiveThreads    : Uint4B
   +0x19c ImagePathHash    : Uint4B
   +0x1a0 DefaultHardErrorProcessing : Uint4B
   +0x1a4 LastThreadExitStatus : Int4B
   +0x1a8 Peb              : Ptr32 _PEB
   +0x1ac PrefetchTrace    : _EX_FAST_REF
   +0x1b0 ReadOperationCount : _LARGE_INTEGER
   +0x1b8 WriteOperationCount : _LARGE_INTEGER
   +0x1c0 OtherOperationCount : _LARGE_INTEGER
   +0x1c8 ReadTransferCount : _LARGE_INTEGER
   +0x1d0 WriteTransferCount : _LARGE_INTEGER
   +0x1d8 OtherTransferCount : _LARGE_INTEGER
   +0x1e0 CommitChargeLimit : Uint4B
   +0x1e4 CommitChargePeak : Uint4B
   +0x1e8 AweInfo          : Ptr32 Void
   +0x1ec SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x1f0 Vm               : _MMSUPPORT
   +0x25c MmProcessLinks   : _LIST_ENTRY
   +0x264 HighestUserAddress : Ptr32 Void
   +0x268 ModifiedPageCount : Uint4B
   +0x26c Flags2           : Uint4B
   +0x26c JobNotReallyActive : Pos 0, 1 Bit
   +0x26c AccountingFolded : Pos 1, 1 Bit
   +0x26c NewProcessReported : Pos 2, 1 Bit
   +0x26c ExitProcessReported : Pos 3, 1 Bit
   +0x26c ReportCommitChanges : Pos 4, 1 Bit
   +0x26c LastReportMemory : Pos 5, 1 Bit
   +0x26c ReportPhysicalPageChanges : Pos 6, 1 Bit
   +0x26c HandleTableRundown : Pos 7, 1 Bit
   +0x26c NeedsHandleRundown : Pos 8, 1 Bit
   +0x26c RefTraceEnabled  : Pos 9, 1 Bit
   +0x26c NumaAware        : Pos 10, 1 Bit
   +0x26c ProtectedProcess : Pos 11, 1 Bit
   +0x26c DefaultPagePriority : Pos 12, 3 Bits
   +0x26c PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x26c ProcessVerifierTarget : Pos 16, 1 Bit
   +0x26c StackRandomizationDisabled : Pos 17, 1 Bit
   +0x26c AffinityPermanent : Pos 18, 1 Bit
   +0x26c AffinityUpdateEnable : Pos 19, 1 Bit
   +0x26c PropagateNode    : Pos 20, 1 Bit
   +0x26c ExplicitAffinity : Pos 21, 1 Bit
   +0x26c Spare1           : Pos 22, 1 Bit
   +0x26c ForceRelocateImages : Pos 23, 1 Bit
   +0x26c DisallowStrippedImages : Pos 24, 1 Bit
   +0x26c LowVaAccessible  : Pos 25, 1 Bit
   +0x26c RestrictIndirectBranchPrediction : Pos 26, 1 Bit
   +0x26c AddressPolicyFrozen : Pos 27, 1 Bit
   +0x26c MemoryDisambiguationDisable : Pos 28, 1 Bit
   +0x270 Flags            : Uint4B
   +0x270 CreateReported   : Pos 0, 1 Bit
   +0x270 NoDebugInherit   : Pos 1, 1 Bit
   +0x270 ProcessExiting   : Pos 2, 1 Bit
   +0x270 ProcessDelete    : Pos 3, 1 Bit
   +0x270 Wow64SplitPages  : Pos 4, 1 Bit
   +0x270 VmDeleted        : Pos 5, 1 Bit
   +0x270 OutswapEnabled   : Pos 6, 1 Bit
   +0x270 Outswapped       : Pos 7, 1 Bit
   +0x270 ForkFailed       : Pos 8, 1 Bit
   +0x270 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x270 AddressSpaceInitialized : Pos 10, 2 Bits
   +0x270 SetTimerResolution : Pos 12, 1 Bit
   +0x270 BreakOnTermination : Pos 13, 1 Bit
   +0x270 DeprioritizeViews : Pos 14, 1 Bit
   +0x270 WriteWatch       : Pos 15, 1 Bit
   +0x270 ProcessInSession : Pos 16, 1 Bit
   +0x270 OverrideAddressSpace : Pos 17, 1 Bit
   +0x270 HasAddressSpace  : Pos 18, 1 Bit
   +0x270 LaunchPrefetched : Pos 19, 1 Bit
   +0x270 InjectInpageErrors : Pos 20, 1 Bit
   +0x270 VmTopDown        : Pos 21, 1 Bit
   +0x270 ImageNotifyDone  : Pos 22, 1 Bit
   +0x270 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x270 VdmAllowed       : Pos 24, 1 Bit
   +0x270 CrossSessionCreate : Pos 25, 1 Bit
   +0x270 ProcessInserted  : Pos 26, 1 Bit
   +0x270 DefaultIoPriority : Pos 27, 3 Bits
   +0x270 ProcessSelfDelete : Pos 30, 1 Bit
   +0x270 SetTimerResolutionLink : Pos 31, 1 Bit
   +0x274 ExitStatus       : Int4B
   +0x278 VadRoot          : _MM_AVL_TABLE  //搜索二叉树 线性地址
   +0x298 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x2a8 TimerResolutionLink : _LIST_ENTRY
   +0x2b0 RequestedTimerResolution : Uint4B
   +0x2b4 ActiveThreadsHighWatermark : Uint4B
   +0x2b8 SmallestTimerResolution : Uint4B
   +0x2bc TimerResolutionStackRecord : Ptr32 _PO_DIAG_STACK_RECORD
   +0x2c0 SequenceNumber   : Uint8B
   +0x2c8 CreateInterruptTime : Uint8B
   +0x2d0 CreateUnbiasedInterruptTime : Uint8B
   +0x2d8 SecurityDomain   : Uint8B

((ntdll!_MM_AVL_TABLE *)0xffffffff85fb59b0)                 : 0xffffffff85fb59b0 [Type: _MM_AVL_TABLE *]
    [+0x000] BalancedRoot     [Type: _MMADDRESS_NODE]
    [+0x014 ( 4: 0)] DepthOfTree      : 0x8 [Type: unsigned long]
    [+0x014 ( 7: 5)] Unused           : 0x0 [Type: unsigned long]
    [+0x014 (31: 8)] NumberGenericTableElements : 0x4a [Type: unsigned long]
    [+0x018] NodeHint         : 0x875e9dc8 [Type: void *]
    [+0x01c] NodeFreeHint     : 0x0 [Type: void *]

((ntdll!_MMADDRESS_NODE *)0xffffffff85fb59b0)                 : 0xffffffff85fb59b0 [Type: _MMADDRESS_NODE *]
    [+0x000] u1               [Type: <unnamed-tag>]
    [+0x004] LeftChild        : 0x0 [Type: _MMADDRESS_NODE *]
    [+0x008] RightChild       : 0x875e9dc8 [Type: _MMADDRESS_NODE *]
    [+0x00c] StartingVpn      : 0x0 [Type: unsigned long]
    [+0x010] EndingVpn        : 0x0 [Type: unsigned long]

(*((ntdll!_MMADDRESS_NODE *)0x875e9dc8))                 [Type: _MMADDRESS_NODE]
    [+0x000] u1               [Type: <unnamed-tag>]
ReadVirtual: 875e9dcc not properly sign extended
    [+0x004] LeftChild        : 0x85ea9570 [Type: _MMADDRESS_NODE *]
    [+0x008] RightChild       : 0x8790a4e8 [Type: _MMADDRESS_NODE *]
    [+0x00c] StartingVpn      : 0x1490 [Type: unsigned long]
    [+0x010] EndingVpn        : 0x156e [Type: unsigned long]
nt!_MMVAD
   +0x000 u1               : <unnamed-tag>
   +0x004 LeftChild        : (null)
   +0x008 RightChild       : 0x875e9dc8 _MMVAD
   +0x00c StartingVpn      : 0
   +0x010 EndingVpn        : 0
   +0x014 u                : <unnamed-tag>
   +0x018 PushLock         : _EX_PUSH_LOCK
   +0x01c u5               : <unnamed-tag>
   +0x020 u2               : <unnamed-tag>
   +0x024 Subsection       : 0x95eb26e4 _SUBSECTION
   +0x024 MappedSubsection : 0x95eb26e4 _MSUBSECTION
   +0x028 FirstPrototypePte : 0x95eb26e4 _MMPTE
   +0x02c LastContiguousPte : (null)
   +0x030 ViewLinks        : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x038 VadsProcess      : (null)
nt!_MMVAD_FLAGS(_MMVAD+14)
   +0x000 CommitCharge     : 0y0000100010000000111 (0x4407)
   +0x000 NoChange         : 0y0
   +0x000 VadType          : 0y000
   +0x000 MemCommit        : 0y0
   +0x000 Protection       : 0y00000 (0)
   +0x000 Spare            : 0y00
   +0x000 PrivateMemory    : 0y0

StartingVpn      EndingVpn        线性地址的 区间  4KB对齐   后面加000

!vad vadroot

 !vad 0xffffffff85fb59b0
VAD   Level     Start       End Commit
000001c8: Unable to get nt!_FILE_OBJECT.FileName.Buffer
85fb59b0  0         0         0  17415 Mapped       NO_ACCESS          (null)
862fb0a0  5        10        1f      0 Mapped       READWRITE          Pagefile section, shared commit 0x10
87439530  6        20        20      1 Private      READWRITE          
8631db30  4        30       12f      7 Private      READWRITE          
8776fa10  5       130       133      0 Mapped       READONLY           Pagefile section, shared commit 0x4
85f30a68  3       140       141      0 Mapped       READONLY           Pagefile section, shared commit 0x2
87827c48  6       150       150      1 Private      READWRITE          
87577100  5       160       1c6      0 Mapped       READONLY           \Windows\System32\locale.nls
876c2eb0  4       1d0       1d0      1 Private      READWRITE          
87628108  6       1e0       1e0      0 Mapped       READWRITE          Pagefile section, shared commit 0x1
877280f0  5       1f0       1f1      0 Mapped       READONLY           Pagefile section, shared commit 0x2
86f22bc0  7       200       205      0 Mapped       READONLY           Pagefile section, shared commit 0x6
874e6458  6       210       210      1 Private      READWRITE          
8771a990  7       220       220      0 Mapped       READWRITE          Pagefile section, shared commit 0x1
85ea9570  2       230       32f     55 Private      READWRITE          
860a5130  5       340       3bf      1 Private      READWRITE          
8606ec20  6       3c0       3c2      3 Mapped       WRITECOPY          \Windows\System32\zh-CN\user32.dll.mui
87872138  4       3d0       3df      3 Private      READWRITE          
86318a00  5       3e0       3e0      1 Mapped       WRITECOPY          \Windows\System32\en-US\imageres.dll.mui
862b7838  6       3f0       3f0      0 Mapped       READWRITE          Pagefile section, shared commit 0x1
87612c48  3       400       488     25 Mapped  Exe  EXECUTE_WRITECOPY  \Users\acer\Desktop\Dbgview.exe
87880660  6       490       557      0 Mapped       READONLY           Pagefile section, shared commit 0x5
8777d948  5       560       5a9     74 Mapped       WRITECOPY          \Windows\System32\zh-CN\KernelBase.dll.mui
87514dd8  4       5e0       5e7      8 Private      READWRITE          
878c2870  6       610       61f      3 Private      READWRITE          
877d2548  5       640       67f      1 Private      READWRITE          
876cc848  7       680       780      0 Mapped       READONLY           Pagefile section, shared commit 0x101
87156378  6       790      138f      0 Mapped       READONLY           Pagefile section, shared commit 0x25
873db460  7      1390      148f      3 Private      READWRITE          
875e9dc8  1      1490      156e      0 Mapped       READONLY           Pagefile section, shared commit 0xdf
85fd49f8  7      15b0      15ef     27 Private      READWRITE          
86315878  6      1670      16af     62 Private      READWRITE          
8778dd08  7      16b0      1fdf      0 Mapped       READONLY           \Windows\Fonts\StaticCache.dat
860a4cb8  5      1fe0      22ae      0 Mapped       READONLY           \Windows\Globalization\Sorting\SortDefault.nls
876bfa40  7      22b0      3604      0 Mapped       READONLY           \Windows\System32\imageres.dll
875f33d0  6      3610      39f4      0 Mapped       READONLY           Pagefile section, shared commit 0x3e5
85f5a518  7      3a00      3aff      3 Private      READWRITE          
8606a938  4     71750     71761      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\mpr.dll
8790d6a0  7     74560     7459f      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\uxtheme.dll
85c4f8e8  6     746b0     7484d      4 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
87495f08  7     75a00     75a0b      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\cryptbase.dll
87803648  5     75b30     75b7a      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\KernelBase.dll
87393d80  7     75e50     75e62      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\dwmapi.dll
860231c8  6     75e90     75f2c      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\usp10.dll
8631d4c0  7     75f30     75f35      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\nsi.dll
8632c2e8  3     761c0     76294      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\kernel32.dll
8780cfb8  7     762a0     76368      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\user32.dll
876cc6c0  6     76370     76411      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\rpcrt4.dll
87764300  5     76480     770cb      9 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\shell32.dll
8779d2c0  7     772e0     773ac      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\msctf.dll
875d4f08  6     773b0     773fd      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\gdi32.dll
87825ed8  7     77400     77409      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\lpk.dll
85f26928  4     77460     77494      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ws2_32.dll
877d24b8  6     774b0     774ce      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\imm32.dll
86078938  5     77550     775e0      3 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\oleaut32.dll
874922d0  6     77600     776a0      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\advapi32.dll
8790a4e8  2     77830     778db      8 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\msvcrt.dll
87710098  5     778e0     77936      2 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\shlwapi.dll
878a5600  4     77940     77958      4 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\sechost.dll
874cc6d8  6     77960     77abe      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ole32.dll
8606e838  5     77c60     77cda      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\comdlg32.dll
878daeb8  3     77d10     77e51     10 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ntdll.dll
8650eda0  5     77f70     77f70      0 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\apisetschema.dll
86336470  6     7f6f0     7f7ef      0 Mapped       READONLY           Pagefile section, shared commit 0x5
877376a8  4     7ffa0     7ffd2      0 Mapped       READONLY           Pagefile section, shared commit 0x33
875f8008  6     7ffd7     7ffd7      1 Private      READWRITE          
85fd46e0  5     7ffdd     7ffdd      1 Private      READWRITE          
87685568  6     7ffde     7ffde      1 Private      READWRITE          
8775c058  7     7ffdf     7ffdf      1 Private      READWRITE

Private     通过 VirtualAlloc/Ex   
Mapped   通过CreateMapping  共享文件 共享物理页

new-malloc-heapalloc->从已经分配好的内存 取出一块  堆栈 全局变量
LoadLibray -- 属性写拷贝  PTE的、R/W位 为0 引起缺页异常 检查VAD的属性 为写拷贝 创建一个新的物理页

物理内存 10-10-12 分页 最多识别 4GB
              2-9-9-12分页 最多识别64GB
MmNumberOfPhysicalPages * 4 =物理内存

_MMPFN* MmPfnDatabase

_MMPFN 页帧
nt!_MMPFN       size 1c
   +0x000 u1               : <unnamed-tag>
   +0x004 u2               : <unnamed-tag>
   +0x008 PteAddress       : Ptr32 _MMPTE
   +0x008 VolatilePteAddress : Ptr32 Void
   +0x008 Lock             : Int4B
   +0x008 PteLong          : Uint4B
   +0x00c u3               : <unnamed-tag>
   +0x010 OriginalPte      : _MMPTE
   +0x010 AweReferenceCount : Int4B
   +0x018 u4               : <unnamed-tag>

坏链 MmBadPagelistHead
零化链表 MmZeroedPagelistHead
空闲链表 MmFreePagelistHead
备用链表 MmStandbyPageListHead
MmModifiedPageListHead
MmModifiedNoWritePageListHead
 !vtop 19001e0（CR3） 7c80aedb(虚拟地址)
虚拟内存 Pagefile.sys    物理内存写入到文件中P置0 修改偏移地址为pagefile.sys中的偏移 当被访问时产生 缺页异常 --把pte重新装到物理内存 修改P位为1 偏移地址修改为物理地址