hvix64.exe查看虚拟地址对于物理地址数据

最新推荐文章于 2025-05-18 21:08:26 发布

王cb

最新推荐文章于 2025-05-18 21:08:26 发布

阅读量148

点赞数

分类专栏： windows hyper-v 文章标签： windows

始于C#，精于C&C++，醉心于Windows内核与Com组件安全研究

本文链接：https://blog.csdn.net/oShuangYue12/article/details/133926490

版权

windows 同时被 2 个专栏收录

175 篇文章

订阅专栏

hyper-v

16 篇文章

订阅专栏

文章详细展示了在AMD64架构中，使用kerneldebugging工具对虚拟地址ffffe800进行分析，包括查看PageTables（页表）和物理地址映射的过程，解释了虚拟地址如何转换为物理地址。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1: kd> r cr3
cr3=000000010bfd4000
1: kd> r rcx
rcx=ffffe80000001000
1: kd> !vtop 000000010bfd4000 ffffe80000001000
Amd64VtoP: Virt ffffe80000001000, pagedir 000000010bfd4000
Amd64VtoP: PML4E 000000010bfd4e80
Amd64VtoP: PDPE 0000000110c15000
Amd64VtoP: PDE 00000001023cc000
Amd64VtoP: PTE 00000001023d4008
Amd64VtoP: Mapped phys 00000001023d6000
Virtual address ffffe80000001000 translates to physical address 1023d6000.
1: kd> dq ffffe80000001000
ffffe800`00001000  00000000`00000000 00000000`00000000
ffffe800`00001010  00000000`00000000 ffffe800`00001018
ffffe800`00001020  ffffe800`00001018 00000000`00000000
ffffe800`00001030  00000000`00000000 ffffe800`00001038
ffffe800`00001040  ffffe800`00001038 00000000`00000000
ffffe800`00001050  00000000`00000000 ffffe800`00001058
ffffe800`00001060  ffffe800`00001058 00000000`00000000
ffffe800`00001070  00000000`00000000 ffffe800`00001078
1: kd> dq /p 1023d6000
00000001`023d6000  00000000`00000000 00000000`00000000
00000001`023d6010  00000000`00000000 ffffe800`00001018
00000001`023d6020  ffffe800`00001018 00000000`00000000
00000001`023d6030  00000000`00000000 ffffe800`00001038
00000001`023d6040  ffffe800`00001038 00000000`00000000
00000001`023d6050  00000000`00000000 ffffe800`00001058
00000001`023d6060  ffffe800`00001058 00000000`00000000
00000001`023d6070  00000000`00000000 ffffe800`00001078