Dumping Physical Addresses Under the Kernel Debugger

ID: Q89279

The information in this article applies to:

Microsoft Win32 Device Driver Kit (DDK) for Windows NT, versions 3.1, 3.5, 3.51

SUMMARY

The addresses used in the dump commands for the Windows NT kernel debugger are virtual addresses. To dump the physical address, use the following command at the debugger prompt:

!dd <address>

To modify the memory at a physical address with the debugger, use the command

!ed <address>

These commands are part of the list of extension commands, which start with a "!".

MORE INFORMATION

For more information on the extension commands, enter "!? at the debugger prompt.

Additional query words: 3.10 3.50 i386kd mipskd

Keywords :
Version :
Platform :
Issue type :