Bewerken

Delen via

!vprot

  • Artikel

The !vprot extension displays virtual memory protection information.

!vprot [Address]

Parameters

Address
Specifies the hexadecimal address whose memory protection status is to be displayed.

DLL

Uext.dll

Additional Information

To view memory protection information for all memory ranges owned by the target process, use !vadump. For information about memory protection, see Microsoft Windows Internals by Mark Russinovich and David Solomon.

Remarks

The !vprot extension command can be used for both live debugging and dump file debugging.

Here is an example:

0:000> !vprot 30c191c
BaseAddress: 030c1000
AllocationBase: 030c0000
AllocationProtect: 00000080 PAGE_EXECUTE_WRITECOPY
RegionSize: 00011000
State: 00001000 MEM_COMMIT
Protect: 00000010 PAGE_EXECUTE
Type: 01000000 MEM_IMAGE

In this display, the AllocationProtect line shows the default protection that the entire region was created with. Note that individual addresses within this region can have their protection altered after memory is allocated (for example, if VirtualProtect is called). The Protect line shows the actual protection for this specific address. The possible protection values are PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_WRITECOPY, PAGE_EXECUTE_WRITECOPY, and PAGE_GUARD.

The State line also applies to the specific virtual address passed to !vprot. The possible state values are MEM_COMMIT, MEM_FREE, and MEM_RESERVE.

The Type line shows the memory type. The possible values are MEM_IMAGE, MEM_MAPPED, and MEM_PRIVATE.