.m (Memory)

.m[struct][link] [expression [L count]]
 

Displays information about memory and memory objects.

struct

Command option. Can be one of the following:

Option	Description
a	Display arena record.
C	Display context descriptor
d	Display page directory entry
e	Toggle stopping in the debugger for memory manager errors
f	With no arguments, dump page fault log. With arguments, set to log faults in a specific range (syntax: .MF <address> L<lengh in bytes>).
Fb	Toggle stopping for eached logged page fault.
Ff	Toggle logging page faults to debug terminal.
G	Display pager descriptor
h [handle]	Displays heap information for the given handle or global information if no handle is given.
Hs [handle]	Dump statistics about a given heap.
Hw	Toggle paranoid VMM32 heap checking.
Hx [handle]	Check for corruption on given heap defaults to VMM32 fixed heap.
I	Displays instanced data regions.
M [address [l page-count]]	Force memory present. The address defaults to last page faulted upon (contents of cr2 register)
n	Force all unlocked memory not present
r	Display arena header
s	Dump memory manager statistics
t	Displays page table entry
u	Toggles computing checksums for page-outs and page-ins
w	Dumps allocators of all committed pages.
X	Displays all memory structures for an address.
Y	Displays valid physical memory ranges.

If no letter is given, the command displays all the structures associated with a given linear address.

link

Direction to walk structures if dumping more than one. Can be b to walk backward or f to walk forward. If link is not given, the default is to walk adjacent entries.

expression

An expression identifying the structure to display. Can be a linear address, handle, array index, or other value as specified by the struct parameter.

count

Number of structures to display if the specified structures are linked.

The default address for the .m and .mx commands is the contents of the cr2 register (the last page fault) and for the other commands it is the first structure in the list. For example, .m displays information about the page that most recently faulted.

A word of caution about the .mm, .mhx, and .mhs commands. If you invoke these commands at the wrong time, you can crash your system. The only time it can be guaranteed safe is if you are currently executing ring 3 code. At other times we may be in the middle of another file system or memory manager operation.