Share via

X64 Deep Dive Presentation from the 2010 Global Engineering Conference

  • Article

We just hosted our annual Global Engineer Conference for members of the Escalation Team at Microsoft. It’s always great to meet up with our peers from other regions and see folks like Mark Russinovich. During the conference we had the opportunity to listen to our friend and independent consultant from CodeMachine.com, T.Roy. This year he presented a deck on x64 debugging which I think you’ll find useful. Enjoy!

x64 Deep Dive, presented at Microsoft GEC 2010

https://www.codemachine.com/presentations/GES2010.TRoy.Slides.pdf

In case you missed his presentations from past Microsoft sessions over the years here is a list of links.

Writing Debugger Extension, presented at Microsoft GEC 2007

https://www.codemachine.com/presentations/GES2007.TRoy.Slides.pdf

Supporting Support, presented at Microsoft GEC 2009

https://www.codemachine.com/presentations/GES2009.TRoy.Slides.pdf

Cheers,

Ronsto

Comments

  • Anonymous
    February 20, 2010
    A-ha. Since you've published these links, could you (or someone else) possible say what did T.Roy mean in the "x64 Deep Dive" on the slide page 6 by saying "Cannot contain data that require 128 bit atomic instruction to access"? IIRC the only limitation instruction like 'cmpxchg16b' has is that the data has to be aligned on oword boundary. Thanks.

  • Anonymous
    March 16, 2010
    There are certain data structures in the Windows Kernel (like Interlocked SLists) that require 128-bit compare exchange instructions (cmpxchg16b) for manipulation. Since early versions of x64 CPUs did not support these instructions, the kernel performs these manipulations with 64-bit compare exchange instructions. It does so by restricting the number of valid bits in the addresses that point to these structures. This limits the address range within which these structures can be placed, to the highest 8TB of Kernel Virtual Address Space. This is what the slide refers to.