文章 PAE下的虚拟内存映射 分析 ( http://user.qzone.qq.com/31731705/blog/1323414733 ) 和 PAE下的虚拟内存映射 实践 (http://user.qzone.qq.com/31731705/blog/1323426728 ) 观察了Win7下PAE模式中的内存映射，也谈到了DirBase的特殊性，现在来看看DirBase到底在哪。

 

下面的脚本可以输出进程名称和DirBase的值，
r @$t0 = 0; .printf /D "Address\t\tImageFile\r\n"; !for_each_process " ImageFile; r @$t2 = @#Process + 16c; r @$t0=@$t0+1; .printf /D \"%p\\t\\t%ma\\r\\n\", poi(@$t1), @$t2"; .printf /D "There are total %d items.\r\n", @$t0;

 

使用Excel排序后的输出，
Address  ImageFile 
185000  System
dc922020 smss.exe 
dc922040 csrss.exe
dc922060 csrss.exe
dc922080 svchost.exe
dc9220a0 wininit.exe
dc9220c0 services.exe
dc9220e0 lsass.exe
dc922100 lsm.exe
dc922120 winlogon.exe
dc922140 nvvsvc.exe
dc922160 svchost.exe
dc922180 svchost.exe
dc9221a0 engie.exe
dc9221c0 svchost.exe
dc9221e0 svchost.exe
dc922200 stacsv.exe
dc922220 LiveUpdate360.
dc922260 svchost.exe
dc922280 WUDFHost.exe
dc9222a0 ZhuDongFangYu.
dc9222c0 svchost.exe
dc9222e0 wlanext.exe
dc922300 conhost.exe
dc922320 spoolsv.exe
dc922340 HostControlSer
dc922360 HostStorageSer
dc922380 svchost.exe
dc9223a0 svchost.exe
dc9223c0 svchost.exe
dc9223e0 AEstSrv.exe
dc922400 svchost.exe
dc922420 btwdins.exe
dc922440 dsNcService.ex
dc922460 EvtEng.exe
dc922480 svchost.exe
dc9224a0 sqlservr.exe
dc9224c0 svchost.exe
dc9224e0 svchost.exe
dc922500 RegSrvc.exe
dc922520 snmp.exe
dc922540 sqlwriter.exe
dc922560 txupd.exe
dc922580 TdmService.exe
dc9225a0 TDMEAgent.exe
dc9225c0 PEAgent.exe
dc9225e0 PEAgentMonitor
dc922600 vmnat.exe
dc922620 vmware-convert
dc922640 unsecapp.exe
dc922660 vmware-convert
dc922680 WmiPrvSE.exe
dc9226a0 tomcat6.exe
dc9226c0 vmware-convert
dc9226e0 conhost.exe
dc922700 svchost.exe
dc922720 wlcrasvc.exe
dc922740 WLIDSVC.EXE
dc922760 wlcrdpsystem.e
dc922780 DCPButtonSvc.e
dc9227a0 CcmExec.exe
dc9227c0 WLIDSVCM.EXE
dc9227e0 DCPSysMgrSvc.e
dc922800 vmware-authd.e
dc922820 vmnetdhcp.exe
dc922840 vmware-hostd.e
dc922860 WmiPrvSE.exe
dc922880 conhost.exe
dc9228a0 alg.exe
dc9228c0 hidfind.exe
dc9228e0 svchost.exe
dc922900 svchost.exe
dc922920 WmiPrvSE.exe
dc922940 nvvsvc.exe
dc922980 WmiPrvSE.exe
dc9229a0 ApMsgFwd.exe
dc9229c0 svchost.exe
dc9229e0 LMS.exe
dc922a00 svchost.exe
dc922a20 EmEditor.exe
dc922a40 IAStorDataMgrS
dc922a60 SearchIndexer.
dc922a80 TXPlatform.exe
dc922aa0 UNS.exe
dc922ac0 taskhost.exe
dc922b00 explorer.exe
dc922b20 iexplore.exe
dc922b40 chrome.exe
dc922b60 wlcomm.exe
dc922b80 dwm.exe
dc922ba0 chrome.exe
dc922bc0 RMAgent.exe
dc922c00 livekd.exe
dc922c20 SynTPEnh.exe
dc922c40 sttray.exe
dc922c60 IAStorIcon.exe
dc922c80 BTStackServer.
dc922ca0 rundll32.exe
dc922cc0 TDMEAgent.exe
dc922ce0 conhost.exe
dc922d00 WavXDocMgr.exe
dc922d20 Dell.ControlPo
dc922d40 BcmDeviceAndTa
dc922d60 Apoint.exe
dc922d80 wmdc.exe
dc922dc0 ONENOTEM.EXE
dc922de0 acrotray.exe
dc922e00 communicator.e
dc922e20 TdmNotify.exe
dc922e40 Stormtray.exe
dc922e60 chrome.exe
dc922e80 msnmsgr.exe
dc922ea0 BTTray.exe
dc922ee0 ApntEx.exe
dc922f00 DCPSysMgr.exe
dc922f20 QQ.exe
dc922f40 conhost.exe
dc922f60 OUTLOOK.EXE
dc922f80 360tray.exe
dc922fa0 rundll32.exe
dc922fc0 chrome.exe
dc922fe0 QQExternal.exe
defd1020 OSPPSVC.EXE 
defd1080 DctSer.exe
defd10e0 windbg.exe
defd1100 WmiApSrv.exe
defd1120 YodaoDict.exe
defd1140 chrome.exe
defd1160 WordBook.exe
defd1180 chrome.exe
defd11a0 windbg.exe
defd11e0 audiodg.exe
defd1200 taskeng.exe

 

从输出结果看，DirBase的地址分成3块，
1. 185000 System
这个进程始终是特别的，用了一个4K的page存放页目录。
0: kd> !vtop 0 80185000 
X86VtoP: Virt 80185000, pagedir defd11a0
X86VtoP: PAE PDPE defd11b0 - 0000000029b6c801
X86VtoP: PAE PDE 29b6c000 - 0000000000191063
X86VtoP: PAE PTE 191c28 - 0000000000185123
X86VtoP: PAE Mapped phys 185000
Virtual address 80185000 translates to physical address 185000.
0: kd> !pte 80185000 
                    VA 80185000
PDE at C0602000            PTE at C0400C28
contains 0000000000191063  contains 0000000000185123
pfn 191       ---DA--KWEV   pfn 185       -G--A--KWEV

 

2. dc922020 smss.exe
SMSS进程是Windows中第1个真正意义上的进程，它和后续进程的页目录被保存在一个2M的Large Page上。(PAE模式下Large Page是2M）
0: kd> !vtop 0 8a722020 
X86VtoP: Virt 8a722020, pagedir defd11a0
X86VtoP: PAE PDPE defd11b0 - 0000000029b6c801
X86VtoP: PAE PDE 29b6c298 - 00000000dc8009e3
X86VtoP: PAE Large page mapped phys dc922020
Virtual address 8a722020 translates to physical address dc922020.
0: kd> !pte 8a722020 
                    VA 8a722020
PDE at C0602298            PTE at C0453910
contains 00000000DC8009E3  contains 0000000000000000
pfn dc800     -GLDA--KWEV   LARGE PAGE pfn dc922   
根据页的大小，计算页的起始地址，
0: kd> !vtop 0 8a600000 
X86VtoP: Virt 8a600000, pagedir defd11a0
X86VtoP: PAE PDPE defd11b0 - 0000000029b6c801
X86VtoP: PAE PDE 29b6c298 - 00000000dc8009e3
X86VtoP: PAE Large page mapped phys dc800000
Virtual address 8a600000 translates to physical address dc800000.
0: kd> !pte 8a600000 
                    VA 8a600000
PDE at C0602298            PTE at C0453000
contains 00000000DC8009E3  contains 0000000000000000
pfn dc800     -GLDA--KWEV   LARGE PAGE pfn dc800    

通过上面的结果得知，0x8a600000是页边界，而DirBase则从8a722020开始，结合上面的进程列表，推测Win7使用近4K（从dc922020到dc923000，实际上是4K少20个字节，0xfe0大小)的空间来保存进程的页目录，因此这页最多可以保存fe0/20=7f(0n127)个进程。上面的进程列表中，DirBase中间的不连续处我猜测是一些曾经运行但已经终止的进程使用过的。

 

3. defd1020 OSPPSVC.EXE
超过了127个进程怎么办？再使用一个Page呗。
0: kd> !pte 881d1020 
                    VA 881d1020
PDE at C0602200            PTE at C0440E88
contains 00000000DEE009E3  contains 0000000000000000
pfn dee00     -GLDA--KWEV   LARGE PAGE pfn defd1    
0: kd> !vtop 0 881d1020 
X86VtoP: Virt 881d1020, pagedir defd11a0
X86VtoP: PAE PDPE defd11b0 - 0000000029b6c801
X86VtoP: PAE PDE 29b6c200 - 00000000dee009e3
X86VtoP: PAE Large page mapped phys defd1020
Virtual address 881d1020 translates to physical address defd1020.
还是一个Large Page，观察页的起始地址，
0: kd> !vtop 0 88000000 
X86VtoP: Virt 88000000, pagedir defd11a0
X86VtoP: PAE PDPE defd11b0 - 0000000029b6c801
X86VtoP: PAE PDE 29b6c200 - 00000000dee009e3
X86VtoP: PAE Large page mapped phys dee00000
Virtual address 88000000 translates to physical address dee00000.
0: kd> !pte 88000000 
                    VA 88000000
PDE at C0602200            PTE at C0440000
contains 00000000DEE009E3  contains 0000000000000000
pfn dee00     -GLDA--KWEV   LARGE PAGE pfn dee00    
页边界在88000000，而DirBase是从881d1020开始，根据上个Page 8a600000的观察结果，这页应该是使用881d1020到881d2000的空间保存页目录。

 

最后的总结：System是特别的，测试过几次，System进程的DirBase总是在80185000这个4K的页。其它的进程的DirBase都被保存在一个2M大小的Large page中，进程多的情况下，可能会有多个这样的Large Page。Large Page一般由操作系统来使用，一方面减少开销（不需要PTE了），一方面减少了处理器在Page中的切换提高性能。通常Large Page也是常驻物理内存的。MSDN（http://msdn.microsoft.com/en-us/library/windows/desktop/aa366720(v=vs.85).aspx ）上这样描述

•The memory is always read/write and nonpageable (always resident in physical memory). ，

 

最后，附上一张PAE模式下Large Page中地址映射的过程图：