【问题标题】:Windbg, how to check memory segment permission?Windbg,如何检查内存段权限?
【发布时间】:2013-02-02 21:28:52
【问题描述】:

例如输出堆栈为不可执行,某些堆是可执行/不可执行..

【问题讨论】:

    标签: debugging memory permissions windbg


    【解决方案1】:

    !address!vprot (UM) 扩展显示虚拟内存保护信息。

    0:000> !address 0038f750
    Usage:                  Stack
    Allocation Base:        00290000
    Base Address:           0038d000
    End Address:            00390000
    Region Size:            00003000
    Type:                   00020000    MEM_PRIVATE
    State:                  00001000    MEM_COMMIT
    Protect:                00000004    PAGE_READWRITE
    More info:              ~0k
    
    0:000> !vprot 0038f750
    BaseAddress:       0038f000
    AllocationBase:    00290000
    AllocationProtect: 00000004  PAGE_READWRITE
    RegionSize:        00001000
    State:             00001000  MEM_COMMIT
    Protect:           00000004  PAGE_READWRITE
    Type:              00020000  MEM_PRIVATE
    

    【讨论】:

    • +1。对于执行权限,您需要查看显示 memory protection 的 Protect 字段
    猜你喜欢
    • 2012-06-02
    • 2017-04-07
    • 1970-01-01
    • 2017-09-17
    • 1970-01-01
    • 1970-01-01
    • 2021-07-30
    • 1970-01-01
    • 2021-07-25
    相关资源
    最近更新 更多