zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-20 03:23:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.2.x] docs: add chapter 4.2 and 4.3

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@87344 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\strangedev_cp 2014-02-24 13:41:27 +00:00 committed by Mikhail I. Izmestev
parent f534abc330
commit d66d297ea9
1 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/en/documentation.txt
View File

@ -19,6 +19,9 @@
** [3.6 Creating crash dumps|#managedebugging-creatingcrashdumps]
* [4. Working with memory and registers|#memoryandregisters]
** [4.1 Access to the general purpose registers|#memoryandregisters-generalpurpose]
** [4.2 Access to model-specific registers (MSR)|#memoryandregisters-accesstomodelspecificregisters]
** [4.3 Normalization of virtual addresses|#memoryandregisters-normalizationofvirtualaddresses]
{anchor:memoryandregisters-accesstomodelspecificregisters}
{anchor:introduction}
! 1. Introduction
{anchor:introduction-generalinformation}
@ -306,3 +309,27 @@ print r/10*234
}}
Note: the current implementation of pykd supports only integer registers. Working with FPU, MMX or SSE registers is not supported.
[←Table of contents|#tableofcontents]
! 4.2 Access to model-specific registers (MSR)
Model-specific registers are accessed through the function *rdmsr(msrNumber)*:
{{
>>> print findSymbol(rdmsr(0x176))
nt!KiFastCallEntry
}}
[←Table of contents|#tableofcontents]
{anchor:memoryandregisters-normalizationofvirtualaddresses}
! 4.3 Normalization of virtual addresses
All functions return virtual addresses in a so-called normalized form which is a 64 bit integer. For 32 bit platforms the address will be extended to 64 bit. The operation in C is
{{
ULONG64 addr64 = (ULONG64)(LONG)addr;
}}
Thus addresses will be converted as follows:
0x00100000 -> 0x00000000 00100000
0x80100000 -> 0xFFFFFFFF 80100000
This should be considered when doing arithmetic operations on addresses returned by pykd. To avoid possible errors in comparisons, it's recommended to use the function *addr64()*:
{{
import pykd
nt = pykd.module("nt")
if nt > addr64( 0x80000000 ):
print "nt module is in highest address space"
}}
[←Table of contents|#tableofcontents]