!pte

The !pte extension displays the page table entry (PTE) and page directory entry (PDE) for the specified address.

Syntax

!pte VirtualAddress 
!pte PTE 
!pte LiteralAddress 1 

Parameters

VirtualAddress
Specifies the virtual address whose page table is desired.

PTE
Specifies the address of an actual PTE.

LiteralAddress **** 1
Specifies the address of an actual PTE or PDE.

DLL

Kdexts.dll

Additional Information

For information about page tables, page directories, and an explanation of the status bits, see Microsoft Windows Internals, by Mark Russinovich and David Solomon.

Remarks

If one parameter is supplied and this parameter is an address in the region of memory where the page tables are stored, the debugger treats this as the PTE parameter. This parameter is taken as the actual address of the desired PTE, and the debugger will display this PTE and the corresponding PDE.

If one parameter is supplied and this parameter is not an address in this region, the debugger treats this as the VirtualAddress parameter. The PTE and PDE that hold the mapping for this address are displayed.

If two parameters are supplied and the second parameter is 1 (or any other small number), the debugger treats the first parameter as LiteralAddress. This address is interpreted as the actual address of a PTE and also as the actual address of a PDE, and the corresponding (and possibly invalid) data will be shown.

(x86 or x64 target computer only) If two parameters are supplied and the second parameter is greater than the first, the debugger treats the two parameters as StartAddress and EndAddress. The command then displays the PTEs for each page in the specified memory range.

For a list of all system PTEs, use the !sysptes extension.

Here is an example from an x86 target computer:

kd> !pte 801544f4
801544F4  - PDE at C0300800        PTE at C0200550
          contains 0003B163      contains 00154121
        pfn 3b G-DA--KWV    pfn 154 G--A--KRV

The first line of this example restates the virtual address being investigated. It then gives the virtual address of the PDE and the PTE, which contain information about the virtual-physical mapping of this address.

The second line gives the actual contents of the PDE and the PTE.

The third line takes these contents and analyzes them, breaking them into the page frame number (PFN) and the status bits.

See the !pfn extension or the Converting Virtual Addresses to Physical Addresses section for information about how to interpret and use the PFN.

On an x86 or x64 target computer, the status bits for the PDE and the PTE are shown in the following table. The !pte display indicates these bits with capital letters or dashes, and adds additional information as well.

Bit	Display when set	Display when clear	Meaning
0x200	C	-	Copy on write.
0x100	G	-	Global.
0x80	L	-	Large page. This only occurs in PDEs, never in PTEs.
0x40	D	-	Dirty.
0x20	A	-	Accessed.
0x10	N	-	Cache disabled.
0x8	T	-	Write-through.
0x4	U	K	Owner (user mode or kernel mode).
0x2	W	R	Writeable or read-only. Only on multiprocessor computers and any computer running Windows Vista or later.
0x1	V		Valid.
	E	-	Executable page. For platforms that do not support a hardware execute/noexecute bit, including many x86 systems, the E is always displayed.