2.7.5WINDBG 观察分页机制（内核调试出现错误）求解

kkdfa 2015-04-16, 14:44 下午

lkd> !process 0 0

PROCESS 8926b020 SessionId: 0 Cid: 0d0c Peb: 7ffde000 ParentCid: 0344

DirBase: 0acc0480 ObjectTable: e3a623f0 HandleCount: 44.

Image: calc.exe

然后!dd 0acc0480

不像书那样

而出现

Physical memory read at acc0480 failed

If you know the caching attributes used for the memory,

try specifying Coffee [C]

, [uc] or [wc], as in !dd Coffee [C]

<params>.

WARNING: Incorrect use of these flags will cause unpredictable

processor corruption. This may immediately (or at any time in

the future until reboot) result in a system hang, incorrect data

being displayed or other strange crashes and corruption.

格蠹老雷 2015-04-16, 19:01 下午
可能是机器上有安全软件（比如360之类的）阻止了访问

建议装个虚拟机，在干净的环境里试验...

http://advdbg.org/forums/5915/ShowPost.aspx

2.7.5WINDBG 观察分页机制 （内核调试出现错误）求解