Windbg 指令與分析之教學筆記

追朔根源就是微軟的工具, 因此必須閱讀官方手冊:
1. 微軟教學:Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)
2. 微軟教學: ACPI Debugging
3. 微軟教學: Getting Started with WinDbg (Kernel-Mode)
4. 微軟說明:debugger commands

有幾個系列的影片教學, 可以身歷其境的感受一下 windbg的強大, 分別是:
1. 影片教學: WinDbg Basics for Malware Analysis
2. 影片教學: Windows Kernel Programming Tutorials for Beginners

3. 教學 Remote debugging

4. 微軟教學影片: Debugging KMDF Drivers

!load wdfkd.dll   #載入Windows Driver Framework Extensions (Wdfkd.dll), 有更多好用的指令
!chain        #列出所有已加載的debugger extension
!wdfhelp      #ugger extension
!wdfhelp      #幫助說明
!wdflogdump   #顯示 WDF In-flight Recorder log records
!wdfldr       #顯示目前bound to WDF的drivers資訊  
!wdftmffile
!wdfdriverinfo
!wdfhandle
!wdfobject
!wdfdevice
!wdfusbdevice
!wdfopenhandles
!wdfqueue
!wdfreuest

!load wdfkd.dll #載入Windows Driver Framework Extensions (Wdfkd.dll), 有更多好用的指令

!chain #列出所有已加載的debugger extension

!wdfhelp #ugger extension

!wdfhelp #幫助說明

!wdflogdump #顯示 WDF In-flight Recorder log records

!wdfldr #顯示目前bound to WDF的drivers資訊

!wdftmffile

!wdfdriverinfo

!wdfhandle

!wdfobject

!wdfdevice

!wdfusbdevice

!wdfopenhandles

!wdfqueue

!wdfreuest

其他在網路上的先進們分享知識的 Windbg專欄部落格:
1. hgy413的专栏windbg
2. 匠心十年: WinDbg 命令手册

或是特別說明一些其他技巧與步驟, 小軟體工具之類:
1. symbol: WinDbg 設定 symbol file path 的四種方法

先知道格式吧:
srv*{cache path}*{symbol server}

我的寫法填入Windbg GUI下拉的Sympol File Path:
srv*C:\Symbol*https://msdl.microsoft.com/download/symbols

2. symbol: 使用SymChk獲取符號文件
3. PDB: 你可能會想知道的關於 .PDB 檔的一些事
4. break point: WinDBG 技巧：设断点命令详解(bp, bu, bm, ba 以及bl, bc, bd, be)
5. BSOD情況分析: Trace BSOD with WinDbg
6. 如何進安全模式:幾種 Windows 10 進入安全模式的方法
因為有時候無法開機的原因，可能是系統中的某些驅動程式出了問題，或是在載入某些開機時要一起載入的程式，導致無法開機。而當我們選用安全模式啟動時，僅載入開機時最必要的檔案，其它多餘的檔案、驅動程式一律都不載入，因此如果無法進入Windows桌面是這方面問題所導致的，那麼用安全模式就應該可以順利排除問題，讓你可以進入Windows系統桌面。

7.什麼是SysWow64: SysWow64檔夾，是64位Windows用來存放32位元Windows系統檔的地方。
8.win10的快速啟動是什麼:win10電腦的「快速啟動」模式你知多少？
9.基本:9招解決 Windows 系統問題或故障，不用靠別人、自己來搞定

一些有用的工具:

1. 小軟體: BlueScreenview
2. 小軟體: Windows Repair
3. 小軟體: CCleaner
4. 微軟 Process explorer: 類似Windows「工作管理員」的程式，主要功能就是列出目前電腦中正在運行的全部程式以及跟運行中程式相關的全部詳細資料

5. 微軟 Process dump: 命令行工具, 它的主要目的是監控應用程序的CPU異常動向, 並在此異常時生成crash dump文件, 供研發人員和管理員確定問題發生的原因.你還可以把它作為生成dump的工具使用在其他的腳本中.ProcDump與Procexp一樣是Windows平台上的內部調試工具，Procexp採用圖形界面體現系統整體及個別進程的性能信息，而ProcDump則與我們在Unix平台上使用的性能分析工具類似使用CLI命令行界面。

6. 微軟 LiveKD:使用Microsoft內核調試器檢查系統。

Windbg 基本操作指令:

開啟crash dump檔案路徑為 File > Open crash dump
以下指令載入symbols:
.symfix C:\symbols: 設定local端的symbol目錄位置
.reload : 重載一次
.sympath : 顯示目前的symbol path

Windbg一般與幫助指令:

指令: ?
顯示說明基本的各種輸入常規指令

0:000> ?
Open debugger.chm for complete debugger documentation

B[C|D|E][<bps>] - clear/disable/enable breakpoint(s)
BL - list breakpoints
BA <access> <size> <addr> - set processor breakpoint
BP <address> - set soft breakpoint
D[type][<range>] - dump memory
DT [-n|y] [[mod!]name] [[-n|y]fields]
   [address] [-l list] [-a[]|c|i|o|r[#]|v] - dump using type information
DV [<name>] - dump local variables
DX [-r[#]] <expr> - display C++ expression using extension model (e.g.: NatVis)
E[type] <address> [<values>] - enter memory values
G[H|N] [=<address> [<address>...]] - go
K <count> - stacktrace
KP <count> - stacktrace with source arguments
LM[k|l|u|v] - list modules
LN <expr> - list nearest symbols
P [=<addr>] [<value>] - step over
Q - quit
R [[<reg> [= <expr>]]] - view or set registers
S[<opts>] <range> <values> - search memory
SX [{e|d|i|n} [-c "Cmd1"] [-c2 "Cmd2"] [-h] {Exception|Event|*}] - event filter
T [=<address>] [<expr>] - trace into
U [<range>] - unassemble
version - show debuggee and debugger version
X [<*|module>!]<*|symbol> - view symbols
? <expr> - display expression
?? <expr> - display C++ expression
$< <filename> - take input from a command file

Hit Enter...


<expr> unary ops: + - not by wo dwo qwo poi hi low
       binary ops: + - * / mod(%) and(&) xor(^) or(|)
       comparisons: == (=) < > !=
       operands: number in current radix, public symbol, <reg>
<type> : b (byte), w (word), d[s] (doubleword [with symbols]),
         a (ascii), c (dword and Char), u (unicode), l (list)
         f (float), D (double), s|S (ascii/unicode string)
         q (quadword)
<pattern> : [(nt | <dll-name>)!]<var-name> (<var-name> can include ? and *)
<range> : <address> <address>
        : <address> L <count>

User-mode options:
~ - list threads status
~#s - set default thread
| - list processes status
|#s - set default process

x64 options:
DG <selector> - dump selector
<reg> : [r|e]ax, [r|e]bx, [r|e]cx, [r|e]dx, [r|e]si, [r|e]di, [r|e]bp, [r|e]sp, [r|e]ip, [e]fl,
        r8-r15 with b/w/d subregisters
        al, ah, bl, bh, cl, ch, dl, dh, cs, ds, es, fs, gs, ss
        sil, dil, bpl, spl
        dr0, dr1, dr2, dr3, dr6, dr7
        fpcw, fpsw, fptw, st0-st7, mm0-mm7
         xmm0-xmm15
<flag> : iopl, of, df, if, tf, sf, zf, af, pf, cf
<addr> : #<16-bit protect-mode [seg:]address>,
         &<V86-mode [seg:]address>

Open debugger.chm for complete debugger documentation

0:000> ?

Open debugger.chm for complete debugger documentation

B[C|D|E][<bps>] - clear/disable/enable breakpoint(s)

BL - list breakpoints

BA <access> <size> <addr> - set processor breakpoint

BP <address> - set soft breakpoint

D[type][<range>] - dump memory

DT [-n|y] [[mod!]name] [[-n|y]fields]

[address] [-l list] [-a[]|c|i|o|r[#]|v] - dump using type information

DV [<name>] - dump local variables

DX [-r[#]] <expr> - display C++ expression using extension model (e.g.: NatVis)

E[type] <address> [<values>] - enter memory values

G[H|N] [=<address> [<address>...]] - go

K <count> - stacktrace

KP <count> - stacktrace with source arguments

LM[k|l|u|v] - list modules

LN <expr> - list nearest symbols

P [=<addr>] [<value>] - step over

Q - quit

R [[<reg> [= <expr>]]] - view or set registers

S[<opts>] <range> <values> - search memory

SX [{e|d|i|n} [-c "Cmd1"] [-c2 "Cmd2"] [-h] {Exception|Event|*}] - event filter

T [=<address>] [<expr>] - trace into

U [<range>] - unassemble

version - show debuggee and debugger version

X [<*|module>!]<*|symbol> - view symbols

? <expr> - display expression

?? <expr> - display C++ expression

$< <filename> - take input from a command file

Hit Enter...

<expr> unary ops: + - not by wo dwo qwo poi hi low

binary ops: + - * / mod(%) and(&) xor(^) or(|)

comparisons: == (=) < > !=

operands: number in current radix, public symbol, <reg>

<type> : b (byte), w (word), d[s] (doubleword [with symbols]),

a (ascii), c (dword and Char), u (unicode), l (list)

f (float), D (double), s|S (ascii/unicode string)

q (quadword)

<pattern> : [(nt | <dll-name>)!]<var-name> (<var-name> can include ? and *)

: <address> L <count>

User-mode options:

~ - list threads status

~#s - set default thread

| - list processes status

|#s - set default process

x64 options:

DG <selector> - dump selector

r8-r15 with b/w/d subregisters

al, ah, bl, bh, cl, ch, dl, dh, cs, ds, es, fs, gs, ss

sil, dil, bpl, spl

dr0, dr1, dr2, dr3, dr6, dr7

fpcw, fpsw, fptw, st0-st7, mm0-mm7

xmm0-xmm15

<flag> : iopl, of, df, if, tf, sf, zf, af, pf, cf

<addr> : #<16-bit protect-mode [seg:]address>,

&<V86-mode [seg:]address>

Open debugger.chm for complete debugger documentation

指令: .help
說明系統指令
第一排還有快速連結個字母開頭的

0:000> .help 
 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z All

. commands:
   .allow_exec_cmds [0|1] - control execution commands
   .allow_image_mapping [0|1] - control on-demand image file mapping
   .apply_dbp [<options>] - add current data breakpoint state to a
                            register context
   .asm [<options>] - set disassembly options
   .asm- [<options>] - clear disassembly options
   .attach <proc> - attach to <proc> at next execution
   .block { <commands> } - brackets a set of commands for nested execution
   .break - break out of the enclosing loop
   .cache [<options>] - virtual memory cache control
   .call <fn>(<arg1>, <arg2>, ...) - run a function in the debuggee
   .catch { <commands> } - catch failures in commands
   .chain - list current extensions
   .clients - list currently active clients
   .continue - continue the enclosing loop
   .copysym [<options>] <path> - copy current symbol files to a directory
   .create <command line> - create a new process
   .createdir [<options>] [<path>] - control process creation options
   .cxr <address> - dump context record at specified address
                    k* after this gives cxr stack
   .dbgdbg - attach a debugger to the current debugger
   .debug_sw_wow [0|1] - allow interaction with software WOW emulation
   .detach - detach from the current process/dump
   .dml_file <file> - output DML content from file
   .dml_flow <start> <addr> - show basic block code flow
   .dml_start [<options>] - navigable overview of debugger activities
   .do { <commands> } (<cond>) - execute <commands> until <cond> is zero
   .drivers - This command was removed -- use 'lm' or .reload -l)
   .dump [<options>] <filename> - create a dump file on the host system
   .dumpcab [<options>] <filename> - create a CAB for an open dump
   .dumpdebug - display detailed information about the dump file
   .dvalloc [<options>] <bytes> - VirtualAlloc memory in the debuggee
   .dvfree [<options>] <offset> <bytes> - VirtualFree memory in the debuggee
   .echo ["<string>"|<string>] - echo string
   .echotime - output debugger time
   .echotimestamps [0|1] - toggle timestamp output on events
   .ecxr - dump context record for current exception
   .excr - dump context record for current exception
   .effmach [<machine>] - change current machine type
   .else { <commands> } - if/then/else conditional execution
   .elsif (<cond>) { <commands> } [<else clauses>] - if/then/else conditional
                                                     execution
   .enable_long_status [0|1] - dump LONG types in default base
   .enable_unicode [0|1] - dump USHORT array/pointers and unicode strings
   .endsrv <id> - disable the given engine server
   .endpsrv - cause the current session's remote server to exit
   .enumtag - enumerate available tagged data
   .eventlog - display log of recent events
   .events - display and select available events
   .eventstr - display any event strings registered by debuggee
   .exepath [<dir>[;...]] - set executable search path
   .exepath+ [<dir>[;...]] - append executable search path
   .expr - control expression evaluator
   .exptr <address> - do .exr and .cxr for EXCEPTION_POINTERS
   .exr <address> - dump exception record at specified address
   .extmatch [<opts>] <pattern> - display all extensions matching pattern
   .extpath <opts> [<dir>[;...]] - set extension search path
   .extpath+ <opts> [<dir>[;...]] - append extension search path
   .f+ - set current stack frame to caller of current frame
   .f- - set current stack frame to callee of current frame
   .fiber <address> - sets context of fiber at address
                      resets context if no address specified
   .fiximports <pattern> - attempts to link imports for images
   .fnent <address> - dump function entry for the given code address
   .fnret <fnaddr> [<retval>] - display formatted return value
   .for ( <init> ; <cond> ; <step> ) { <commands> } - execute <commands> and
                                                      <step> until <cond> is
                                                      zero
   .force_radix_output [0|1] - dump integer types in default base
   .force_system_init [<options>] - force pending systems to initialize if possible
   .force_tb - forcibly allow branch tracing
   .foreach [opts] ( <alias> { <tcmds> } ) { <ecmds> } - execute <ecmds> for
                                                         each token in the
                                                         output of <tcmds>
   .fpo <options> - control override FPO information
   .frame [<frame>] - set current stack frame for locals
   .formats <expr> - displays expression result in many formats
   .help [<options>] - display this help
   .holdmem <options> [range] - hold and compare memory data
   .if (<cond>) { <commands> } [<else clauses>] - if/then/else conditional
                                                  execution
   .ignore_missing_pages [0|1] - control kernel summary dump missing
                                 page error message
   .imgscan <options> - scan memory for PE images
   .jdinfo [/u] <jdi_addr> - interpret AeDebug information
   .kframes <count> - set default stack trace depth
   .lastevent - display the last event that occurred
   .leave - exit the enclosing .catch
   .lines - toggle line symbol loading
   .load <name> - add this extension DLL to the extension chain
   .loadby <name> <mod> - add the extension DLL in the module
                          directory to the extension chain
   .locale [<locale>] - set the current locale
   .logfile - display log status
   .logopen [<file>] - open new log file
   .logappend [<file>] - append to log file
   .logclose - close log file
   .netsyms [0|1] - allow/disallow net symbol paths
   .netuse [<options>] - manage net connections
   .noshell - disable shell commands
   .noversion - disable extension version checking
   .nvlist - display the set of .NATVIS files loaded into the debugger
   .nvload <name> - load a .NATVIS file
   .nvunload <name> - unload a .NATVIS file
   .nvunloadall - unload all .NATVIS files
   .ofilter <pattern> - filter debuggee output against the given pattern
   .opendump <file> - open a dump file
   .outmask <mask> - set bits in the current output mask
   .outmask- <mask> - clear bits in the current output mask
   .pcmd [<options>] - control per-prompt command
   .pop [<options>] - pop state
   .prefer_dml [0|1] - control DML mode default
   .printf "<format>", <args...> - formatted output
   .process [<address>] - sets implicit process
                          resets default if no address specified
   .process_info - display security related information of current process
   .prompt_allow [<options>] - control what information can be displayed
                               at the prompt
   .push [<options>] - push state
   .quit_lock [<options>] - locks session against unexpected quit
   .readmem <file> <range> - read raw memory from a file
   .record_branches [0|1] - controls recording of processor branching
   .reload [<image.ext>[=<address>,<size>]] - reload symbols
   .restart - request a session restart
   .remote <pipename> - start remote.exe server
   .secure [0|1] - disallow operations dangerous for the host
   .scriptlist - display the set of scripts loaded into the debugger
   .scriptload <name> - load a script file
   .scriptproviders - display the set of script providers in the debugger
   .scriptunload <name> - unload a script file
   .send_file <options> - send files to remote server
   .server <options> - start engine server
   .servers - list active remoting servers
   .setdll <name> - debugger will search for extensions in this DLL first
   .settings - manage settings
   .shell [<command>] - execute shell command
   .show_read_failures [<opts>] - control extra read failure output
   .show_sym_failures [<opts>] - control extra symbol failure output
   .sleep <milliseconds> - debugger sleeps for given duration
                           useful for allowing access to a machine that's
                           broken in on an ntsd -d
   .srcfix [<path extra>] - fix source search path
   .srcfix+ [<path extra>] - append fixed source search path
   .srcnoisy [0|1] - control verbose source loading output
   .srcpath [<dir>[;...]] - set source search path
   .srcpath+ [<dir>[;...]] - append source search path
   .step_filter [<opts>] ["<pattern>[;<pattern>...]"] - Set symbol patterns
                                                        to skip when stepping
   .symfix [<localsym>] - fix symbol search path
   .symfix+ [<localsym>] - append fixed symbol search path
   .symopt <flags> - set symbol options
   .symopt+ <flags> - set symbol options
   .symopt- <flags> - clear symbol options
   .sympath [<dir>[;...]] - set symbol search path
   .sympath+ [<dir>[;...]] - append symbol search path
   .thread [<address>] - sets context of thread at address
                         resets default context if no address specified
   .time - displays session time information
   .timezone - display timezone information
   .ttime - displays thread time information
   .tlist - list running processes
   .typeopt <flags> - set/clear type options
   .unload <name> - remove this extension DLL from the list of extension DLLs
   .unloadall - remove all extension DLLs from the list of extensions DLLs
   .wake - wake up a .sleep'ing debugger
   .while (<cond>) { <commands> } - execute <commands> while <cond> is non-zero
   .writemem <file> <range> - write raw memory to a file
   .rrestart - register current session for Application Restart
   .urestart - unregister current session from Application Restart
   .inline - query the state whether debuggers should query inline functions
   .stackprovider - query the state whether debugger should query stack dump providers
   .stkwalk_force_frame_pointer - query or set the state whether debuggers should unwind stack solely based on frame pointer
   .hideinjectedcode [<on|off|help>] - Hide injected calls from stepping in source mode
   .enablepackagedebug <packageFullName> - Enable debugging for UWP application.
   .disablepackagedebug <packageFullName> - Disable debugging for UWP application.
   .suspendpackage <packageFullName> - Suspends a UWP application.
   .resumepackage <packageFullName> - Resumes a UWP application.
   .querypackage <packageFullName> - Displays the state of a UWP application.
   .querypackages - Lists all UWP applications and their state.
   .createpackageapp <packageFullName> <appName> [<arguments>] - Enables debugging and launches a UWP application.
   .terminatepackageapp <packageFullName> - Terminates all processes for UWP application.
   .activatepackagebgtask <packageFullName> <bgTaskId> - Enables debugging and launches a UWP background task.

Use ".hh <command>" or open debugger.chm in the debuggers directory to get
detailed documentation on a command.

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

0:000> .help

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z All

. commands:

.allow_exec_cmds [0|1] - control execution commands

.allow_image_mapping [0|1] - control on-demand image file mapping

.apply_dbp [<options>] - add current data breakpoint state to a

.asm [<options>] - set disassembly options

.asm- [<options>] - clear disassembly options

.attach <proc> - attach to <proc> at next execution

.block { <commands> } - brackets a set of commands for nested execution

.break - break out of the enclosing loop

.cache [<options>] - virtual memory cache control

.call <fn>(<arg1>, <arg2>, ...) - run a function in the debuggee

.catch { <commands> } - catch failures in commands

.chain - list current extensions

.clients - list currently active clients

.continue - continue the enclosing loop

.copysym [<options>] <path> - copy current symbol files to a directory

.create <command line> - create a new process

.createdir [<options>] [<path>] - control process creation options

.cxr <address> - dump context record at specified address

k* after this gives cxr stack

.dbgdbg - attach a debugger to the current debugger

.debug_sw_wow [0|1] - allow interaction with software WOW emulation

.detach - detach from the current process/dump

.dml_file <file> - output DML content from file

.dml_flow <start> <addr> - show basic block code flow

.dml_start [<options>] - navigable overview of debugger activities

.do { <commands> } (<cond>) - execute <commands> until <cond> is zero

.drivers - This command was removed -- use 'lm' or .reload -l)

.dump [<options>] <filename> - create a dump file on the host system

.dumpcab [<options>] <filename> - create a CAB for an open dump

.dumpdebug - display detailed information about the dump file

.dvalloc [<options>] <bytes> - VirtualAlloc memory in the debuggee

.dvfree [<options>] <offset> <bytes> - VirtualFree memory in the debuggee

.echo ["<string>"|<string>] - echo string

.echotime - output debugger time

.echotimestamps [0|1] - toggle timestamp output on events

.ecxr - dump context record for current exception

.excr - dump context record for current exception

.effmach [<machine>] - change current machine type

.else { <commands> } - if/then/else conditional execution

.elsif (<cond>) { <commands> } [<else clauses>] - if/then/else conditional

execution

.enable_long_status [0|1] - dump LONG types in default base

.enable_unicode [0|1] - dump USHORT array/pointers and unicode strings

.endsrv <id> - disable the given engine server

.endpsrv - cause the current session's remote server to exit

.enumtag - enumerate available tagged data

.eventlog - display log of recent events

.events - display and select available events

.eventstr - display any event strings registered by debuggee

.exepath [<dir>[;...]] - set executable search path

.exepath+ [<dir>[;...]] - append executable search path

.expr - control expression evaluator

.exptr <address> - do .exr and .cxr for EXCEPTION_POINTERS

.exr <address> - dump exception record at specified address

.extmatch [<opts>] <pattern> - display all extensions matching pattern

.extpath <opts> [<dir>[;...]] - set extension search path

.extpath+ <opts> [<dir>[;...]] - append extension search path

.f+ - set current stack frame to caller of current frame

.f- - set current stack frame to callee of current frame

.fiber <address> - sets context of fiber at address

resets context if no address specified

.fiximports <pattern> - attempts to link imports for images

.fnent <address> - dump function entry for the given code address

.fnret <fnaddr> [<retval>] - display formatted return value

.for ( <init> ; <cond> ; <step> ) { <commands> } - execute <commands> and

<step> until <cond> is

zero

.force_radix_output [0|1] - dump integer types in default base

.force_system_init [<options>] - force pending systems to initialize if possible

.force_tb - forcibly allow branch tracing

.foreach [opts] ( <alias> { <tcmds> } ) { <ecmds> } - execute <ecmds> for

each token in the

output of <tcmds>

.fpo <options> - control override FPO information

.frame [<frame>] - set current stack frame for locals

.formats <expr> - displays expression result in many formats

.help [<options>] - display this help

.holdmem <options> [range] - hold and compare memory data

.if (<cond>) { <commands> } [<else clauses>] - if/then/else conditional

execution

.ignore_missing_pages [0|1] - control kernel summary dump missing

page error message

.imgscan <options> - scan memory for PE images

.jdinfo [/u] <jdi_addr> - interpret AeDebug information

.kframes <count> - set default stack trace depth

.lastevent - display the last event that occurred

.leave - exit the enclosing .catch

.lines - toggle line symbol loading

.load <name> - add this extension DLL to the extension chain

.loadby <name> <mod> - add the extension DLL in the module

directory to the extension chain

.locale [<locale>] - set the current locale

.logfile - display log status

.logopen [<file>] - open new log file

.logappend [<file>] - append to log file

.logclose - close log file

.netsyms [0|1] - allow/disallow net symbol paths

.netuse [<options>] - manage net connections

.noshell - disable shell commands

.noversion - disable extension version checking

.nvlist - display the set of .NATVIS files loaded into the debugger

.nvload <name> - load a .NATVIS file

.nvunload <name> - unload a .NATVIS file

.nvunloadall - unload all .NATVIS files

.ofilter <pattern> - filter debuggee output against the given pattern

.opendump <file> - open a dump file

.outmask <mask> - set bits in the current output mask

.outmask- <mask> - clear bits in the current output mask

.pcmd [<options>] - control per-prompt command

.pop [<options>] - pop state

.prefer_dml [0|1] - control DML mode default

.printf "<format>", <args...> - formatted output

.process [<address>] - sets implicit process

resets default if no address specified

.process_info - display security related information of current process

.prompt_allow [<options>] - control what information can be displayed

at the prompt

.push [<options>] - push state

.quit_lock [<options>] - locks session against unexpected quit

.readmem <file> <range> - read raw memory from a file

.record_branches [0|1] - controls recording of processor branching

.reload [<image.ext>[=<address>,<size>]] - reload symbols

.restart - request a session restart

.remote <pipename> - start remote.exe server

.secure [0|1] - disallow operations dangerous for the host

.scriptlist - display the set of scripts loaded into the debugger

.scriptload <name> - load a script file

.scriptproviders - display the set of script providers in the debugger

.scriptunload <name> - unload a script file

.send_file <options> - send files to remote server

.server <options> - start engine server

.servers - list active remoting servers

.setdll <name> - debugger will search for extensions in this DLL first

.settings - manage settings

.shell [<command>] - execute shell command

.show_read_failures [<opts>] - control extra read failure output

.show_sym_failures [<opts>] - control extra symbol failure output

.sleep <milliseconds> - debugger sleeps for given duration

useful for allowing access to a machine that's

broken in on an ntsd -d

.srcfix [<path extra>] - fix source search path

.srcfix+ [<path extra>] - append fixed source search path

.srcnoisy [0|1] - control verbose source loading output

.srcpath [<dir>[;...]] - set source search path

.srcpath+ [<dir>[;...]] - append source search path

.step_filter [<opts>] ["<pattern>[;<pattern>...]"] - Set symbol patterns

to skip when stepping

.symfix [<localsym>] - fix symbol search path

.symfix+ [<localsym>] - append fixed symbol search path

.symopt <flags> - set symbol options

.symopt+ <flags> - set symbol options

.symopt- <flags> - clear symbol options

.sympath [<dir>[;...]] - set symbol search path

.sympath+ [<dir>[;...]] - append symbol search path

.thread [<address>] - sets context of thread at address

resets default context if no address specified

.time - displays session time information

.timezone - display timezone information

.ttime - displays thread time information

.tlist - list running processes

.typeopt <flags> - set/clear type options

.unload <name> - remove this extension DLL from the list of extension DLLs

.unloadall - remove all extension DLLs from the list of extensions DLLs

.wake - wake up a .sleep'ing debugger

.while (<cond>) { <commands> } - execute <commands> while <cond> is non-zero

.writemem <file> <range> - write raw memory to a file

.rrestart - register current session for Application Restart

.urestart - unregister current session from Application Restart

.inline - query the state whether debuggers should query inline functions

.stackprovider - query the state whether debugger should query stack dump providers

.stkwalk_force_frame_pointer - query or set the state whether debuggers should unwind stack solely based on frame pointer

.hideinjectedcode [<on|off|help>] - Hide injected calls from stepping in source mode

.enablepackagedebug <packageFullName> - Enable debugging for UWP application.

.disablepackagedebug <packageFullName> - Disable debugging for UWP application.

.suspendpackage <packageFullName> - Suspends a UWP application.

.resumepackage <packageFullName> - Resumes a UWP application.

.querypackage <packageFullName> - Displays the state of a UWP application.

.querypackages - Lists all UWP applications and their state.

.createpackageapp <packageFullName> <appName> [<arguments>] - Enables debugging and launches a UWP application.

.terminatepackageapp <packageFullName> - Terminates all processes for UWP application.

.activatepackagebgtask <packageFullName> <bgTaskId> - Enables debugging and launches a UWP background task.

Use ".hh <command>" or open debugger.chm in the debuggers directory to get

detailed documentation on a command.

指令:.chain
列出所有已加載的調試器擴展 (List Debugger Extensions)

0:000> .chain
Extension DLL search Path:
    C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\arcade;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\pri;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86;C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\;C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files\Java\jdk1.8.0_45\bin;C:\Program Files\nodejs\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\;C:\Users\Jamie\AppData\Local\Microsoft\WindowsApps;
Extension DLL chain:
    dbghelp: image 10.0.14321.1024, API 10.0.6, built Sat Jul 16 09:29:50 2016
        [path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbghelp.dll]
    ext: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:29:44 2016
        [path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\ext.dll]
    exts: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:28:14 2016
        [path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP\exts.dll]
    uext: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:28:11 2016
        [path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\uext.dll]
    ntsdexts: image 10.0.14393.33, API 1.0.0, built Thu Jul 28 13:23:56 2016
        [path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP\ntsdexts.dll]

0:000> .chain

Extension DLL search Path:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\arcade;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\pri;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86;C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\;C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files\Java\jdk1.8.0_45\bin;C:\Program Files\nodejs\;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\;C:\Users\Jamie\AppData\Local\Microsoft\WindowsApps;

Extension DLL chain:

dbghelp: image 10.0.14321.1024, API 10.0.6, built Sat Jul 16 09:29:50 2016

[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbghelp.dll]

ext: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:29:44 2016

[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\ext.dll]

exts: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:28:14 2016

[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP\exts.dll]

uext: image 10.0.14321.1024, API 1.0.0, built Sat Jul 16 09:28:11 2016

[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\uext.dll]

ntsdexts: image 10.0.14393.33, API 1.0.0, built Thu Jul 28 13:23:56 2016

[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\WINXP\ntsdexts.dll]

指令: .extmatch
.extmatch /D /e XXXXX * 顯示由當前加載的與指定模式匹配的擴展DLL導出的擴展命令

0:000> .extmatch /D /e ntsdexts *
!ntsdexts.critsec
!ntsdexts.dp
!ntsdexts.dreg
!ntsdexts.dt
!ntsdexts.gatom
!ntsdexts.handle
!ntsdexts.help
!ntsdexts.hleak
!ntsdexts.htrace
!ntsdexts.locks
!ntsdexts.runaway
!ntsdexts.threadtoken
0:000> .extmatch /D /e uext *
!uext.evlog
!uext.findstack
!uext.handle
!uext.help
!uext.mapped_file
!uext.runaway
!uext.uniqstack
!uext.vadump
!uext.vprot

0:000> .extmatch /D /e ntsdexts *

!ntsdexts.critsec

!ntsdexts.dp

!ntsdexts.dreg

!ntsdexts.dt

!ntsdexts.gatom

!ntsdexts.handle

!ntsdexts.help

!ntsdexts.hleak

!ntsdexts.htrace

!ntsdexts.locks

!ntsdexts.runaway

!ntsdexts.threadtoken

0:000> .extmatch /D /e uext *

!uext.evlog

!uext.findstack

!uext.handle

!uext.help

!uext.mapped_file

!uext.runaway

!uext.uniqstack

!uext.vadump

!uext.vprot

指令:.hh
打開 WinDbg 的幫助文件

指令: .restart
重新啟動被調試的應用程式(Restart Target Application)

指令: version
顯示調試器版本信息和已加載的調試器擴展

指令: vercommand
顯示調試器啟動文件的路徑

0:000> vercommand
command line: '"C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\windbg.exe" '

1 2	0:000> vercommand command line: '"C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\windbg.exe" '

指令: vertarget
顯示目標機器Microsoft Windows操作系统版本資訊

0:000> vertarget
Windows 10 Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
kernel32.dll version: 10.0.14393.2214 (rs1_release_1.180402-1758)
Machine Name:
Debug session time: Tue Dec 10 10:26:46.000 2019 (UTC + 8:00)
System Uptime: 39 days 17:48:11.976
Process Uptime: 39 days 17:45:01.000
  Kernel time: 0 days 0:00:04.000
  User time: 0 days 0:00:02.000

0:000> vertarget

Windows 10 Version 14393 MP (4 procs) Free x64

Product: WinNt, suite: SingleUserTS

kernel32.dll version: 10.0.14393.2214 (rs1_release_1.180402-1758)

Machine Name:

Debug session time: Tue Dec 10 10:26:46.000 2019 (UTC + 8:00)

System Uptime: 39 days 17:48:11.976

Process Uptime: 39 days 17:45:01.000

Kernel time: 0 days 0:00:04.000

User time: 0 days 0:00:02.000

指令: .effmach
顯示目標機器的處理器模資訊
.effmach .
.effmach #
.effmach x86 | amd64 | ia64 | ebc

0:000> .effmach
Effective machine: x64 (AMD64)

1 2	0:000> .effmach Effective machine: x64 (AMD64)

指令: .cls
清理螢幕

指令: .echo
輸出字串 e.g. .echo “Hello World”

指令: .time
顯示系統記錄的各種時間

組合鍵: ctrl+alt+v
能切換詳細模式的打開和關閉
打開詳細模式後，一些顯示命令會產生更詳細的輸出，發送給調試器的每個模塊加載操作都會被顯示出來
並且操作系統每次加載驅動或都DLL也會提示

Windbg 模塊Module加载命令

指令: lm
列出已載入模塊(List Loaded Modules)
lm: List modules
lmv: List module versions
lmvm: List specific module versions
lm m ModuleName

0:000> lm
start             end                 module name
00000000`6a030000 00000000`6a0f9000   msvcr80    (deferred)             
00000001`40000000 00000001`40016000   valWBFPolicyService   (deferred)             
00007ffa`a9110000 00007ffa`a9171000   wevtapi    (deferred)             
00007ffa`aab40000 00007ffa`aab68000   devobj     (deferred)             
00007ffa`aada0000 00007ffa`aadf4000   mintdh     (deferred)             
00007ffa`aae00000 00007ffa`aaeae000   tdh        (deferred)             
00007ffa`ab940000 00007ffa`ab96b000   bcrypt     (deferred)             
00007ffa`abde0000 00007ffa`abdf0000   msasn1     (deferred)             
00007ffa`abdf0000 00007ffa`ac00d000   KERNELBASE   (pdb symbols)          c:\symbols\kernelbase.pdb\C1CB335438FC484B842D02CB20116D3A1\kernelbase.pdb
00007ffa`ac010000 00007ffa`ac190000   gdi32full   (deferred)             
00007ffa`ac190000 00007ffa`ac1ae000   win32u     (deferred)             
00007ffa`ac1b0000 00007ffa`ac1f2000   cfgmgr32   (deferred)             
00007ffa`ac8e0000 00007ffa`acaa9000   crypt32    (deferred)             
00007ffa`acb60000 00007ffa`acc55000   ucrtbase   (deferred)             
00007ffa`acc60000 00007ffa`accfc000   msvcp_win   (deferred)             
00007ffa`acd60000 00007ffa`acdca000   bcryptPrimitives   (deferred)             
00007ffa`ad120000 00007ffa`ad1df000   oleaut32   (deferred)             
00007ffa`ad240000 00007ffa`ad508000   combase    (deferred)             
00007ffa`ad5b0000 00007ffa`ad9d9000   setupapi   (deferred)             
00007ffa`ad9e0000 00007ffa`adb01000   rpcrt4     (deferred)             
00007ffa`adb10000 00007ffa`adb69000   sechost    (deferred)             
00007ffa`adbe0000 00007ffa`adc14000   gdi32      (deferred)             
00007ffa`adc20000 00007ffa`adcbe000   msvcrt     (deferred)             
00007ffa`af330000 00007ffa`af3dc000   kernel32   (deferred)             
00007ffa`af3e0000 00007ffa`af518000   ole32      (deferred)             
00007ffa`af550000 00007ffa`af6b5000   user32     (deferred)             
00007ffa`af6c0000 00007ffa`af762000   advapi32   (deferred)             
00007ffa`af850000 00007ffa`af86c000   imagehlp   (deferred)             
00007ffa`af870000 00007ffa`af878000   psapi      (deferred)             
00007ffa`af8f0000 00007ffa`afac2000   ntdll      (pdb symbols)          c:\symbols\ntdll.pdb\3FED89B476364D33AA918AE74196DAF21\ntdll.pdb

0:000> lm

start end module name

00000000`6a030000 00000000`6a0f9000 msvcr80 (deferred)

00000001`40000000 00000001`40016000 valWBFPolicyService (deferred)

00007ffa`a9110000 00007ffa`a9171000 wevtapi (deferred)

00007ffa`aab40000 00007ffa`aab68000 devobj (deferred)

00007ffa`aada0000 00007ffa`aadf4000 mintdh (deferred)

00007ffa`aae00000 00007ffa`aaeae000 tdh (deferred)

00007ffa`ab940000 00007ffa`ab96b000 bcrypt (deferred)

00007ffa`abde0000 00007ffa`abdf0000 msasn1 (deferred)

00007ffa`abdf0000 00007ffa`ac00d000 KERNELBASE (pdb symbols) c:\symbols\kernelbase.pdb\C1CB335438FC484B842D02CB20116D3A1\kernelbase.pdb

00007ffa`ac010000 00007ffa`ac190000 gdi32full (deferred)

00007ffa`ac190000 00007ffa`ac1ae000 win32u (deferred)

00007ffa`ac1b0000 00007ffa`ac1f2000 cfgmgr32 (deferred)

00007ffa`ac8e0000 00007ffa`acaa9000 crypt32 (deferred)

00007ffa`acb60000 00007ffa`acc55000 ucrtbase (deferred)

00007ffa`acc60000 00007ffa`accfc000 msvcp_win (deferred)

00007ffa`acd60000 00007ffa`acdca000 bcryptPrimitives (deferred)

00007ffa`ad120000 00007ffa`ad1df000 oleaut32 (deferred)

00007ffa`ad240000 00007ffa`ad508000 combase (deferred)

00007ffa`ad5b0000 00007ffa`ad9d9000 setupapi (deferred)

00007ffa`ad9e0000 00007ffa`adb01000 rpcrt4 (deferred)

00007ffa`adb10000 00007ffa`adb69000 sechost (deferred)

00007ffa`adbe0000 00007ffa`adc14000 gdi32 (deferred)

00007ffa`adc20000 00007ffa`adcbe000 msvcrt (deferred)

00007ffa`af330000 00007ffa`af3dc000 kernel32 (deferred)

00007ffa`af3e0000 00007ffa`af518000 ole32 (deferred)

00007ffa`af550000 00007ffa`af6b5000 user32 (deferred)

00007ffa`af6c0000 00007ffa`af762000 advapi32 (deferred)

00007ffa`af850000 00007ffa`af86c000 imagehlp (deferred)

00007ffa`af870000 00007ffa`af878000 psapi (deferred)

00007ffa`af8f0000 00007ffa`afac2000 ntdll (pdb symbols) c:\symbols\ntdll.pdb\3FED89B476364D33AA918AE74196DAF21\ntdll.pdb

指令: !dlls
列出所有加載的模塊和加載數量

0:000> !dlls 
This is Win8 with the loader DAG.

0x00592920: C:\WINDOWS\system32\valWBFPolicyService.exe
      Base   0x140000000  EntryPoint  0x140007710  Size        0x00016000    DdagNode     0x00592a50
      Flags  0x000022cc  TlsIndex    0x00000000  LoadCount   0xffffffff    NodeRefCount 0x00000000
             <unknown>
             LDRP_LOAD_NOTIFICATIONS_SENT
             LDRP_IMAGE_DLL

0x00592790: C:\WINDOWS\SYSTEM32\ntdll.dll
      Base   0x7ffaaf8f0000  EntryPoint  0x00000000  Size        0x001d2000    DdagNode     0x005928c0
      Flags  0x0000a2c4  TlsIndex    0x00000000  LoadCount   0xffffffff    NodeRefCount 0x00000000
             <unknown>
             LDRP_IMAGE_DLL

0x00592db0: C:\WINDOWS\System32\KERNEL32.DLL
      Base   0x7ffaaf330000  EntryPoint  0x7ffaaf338400  Size        0x000ac000    DdagNode     0x00592ee0
      Flags  0x000ca2cc  TlsIndex    0x00000000  LoadCount   0xffffffff    NodeRefCount 0x00000000
             <unknown>
             LDRP_LOAD_NOTIFICATIONS_SENT
             LDRP_IMAGE_DLL
             LDRP_DONT_CALL_FOR_THREADS
             LDRP_PROCESS_ATTACH_CALLED
...

0:000> !dlls

This is Win8 with the loader DAG.

0x00592920: C:\WINDOWS\system32\valWBFPolicyService.exe

Base 0x140000000 EntryPoint 0x140007710 Size 0x00016000 DdagNode 0x00592a50

Flags 0x000022cc TlsIndex 0x00000000 LoadCount 0xffffffff NodeRefCount 0x00000000

LDRP_LOAD_NOTIFICATIONS_SENT

LDRP_IMAGE_DLL

0x00592790: C:\WINDOWS\SYSTEM32\ntdll.dll

Base 0x7ffaaf8f0000 EntryPoint 0x00000000 Size 0x001d2000 DdagNode 0x005928c0

Flags 0x0000a2c4 TlsIndex 0x00000000 LoadCount 0xffffffff NodeRefCount 0x00000000

LDRP_IMAGE_DLL

0x00592db0: C:\WINDOWS\System32\KERNEL32.DLL

Base 0x7ffaaf330000 EntryPoint 0x7ffaaf338400 Size 0x000ac000 DdagNode 0x00592ee0

Flags 0x000ca2cc TlsIndex 0x00000000 LoadCount 0xffffffff NodeRefCount 0x00000000

LDRP_LOAD_NOTIFICATIONS_SENT

LDRP_IMAGE_DLL

LDRP_DONT_CALL_FOR_THREADS

LDRP_PROCESS_ATTACH_CALLED

...

指令: !lmi
显示模块的详细信息，包括加载符号信息
!lmi Module

0:000> !lmi kernel32
Loaded Module Info: [kernel32] 
         Module: kernel32
   Base Address: 00007ffaaf330000
     Image Name: kernel32.dll
   Machine Type: 34404 (X64)
     Time Stamp: 5ac2f8e6 Tue Apr  3 11:45:42 2018
           Size: ac000
       CheckSum: b4571
Characteristics: 2022  
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    25, 84b40,   83140 RSDS - GUID: {996833D4-6FC4-412D-A9DE-305E863A2B34}
               Age: 1, Pdb: kernel32.pdb
                   ??   4ec, 84b68,   83168 [Data not mapped]
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: PDB      - Symbols loaded successfully from image header.
                 c:\symbols\kernel32.pdb\996833D46FC4412DA9DE305E863A2B341\kernel32.pdb
    Load Report: public symbols , not source indexed 
                 c:\symbols\kernel32.pdb\996833D46FC4412DA9DE305E863A2B341\kernel32.pdb

0:000> !lmi kernel32

Loaded Module Info: [kernel32]

Module: kernel32

Base Address: 00007ffaaf330000

Image Name: kernel32.dll

Machine Type: 34404 (X64)

Time Stamp: 5ac2f8e6 Tue Apr 3 11:45:42 2018

Size: ac000

CheckSum: b4571

Characteristics: 2022

Debug Data Dirs: Type Size VA Pointer

CODEVIEW 25, 84b40, 83140 RSDS - GUID: {996833D4-6FC4-412D-A9DE-305E863A2B34}

Age: 1, Pdb: kernel32.pdb

?? 4ec, 84b68, 83168 [Data not mapped]

Image Type: MEMORY - Image read successfully from loaded memory.

Symbol Type: PDB - Symbols loaded successfully from image header.

c:\symbols\kernel32.pdb\996833D46FC4412DA9DE305E863A2B341\kernel32.pdb

Load Report: public symbols , not source indexed

c:\symbols\kernel32.pdb\996833D46FC4412DA9DE305E863A2B341\kernel32.pdb

Windbg 符号Symbol加载命令

指令 ld
加載指定模塊的符號 (Load Symbols), 注意藥此symbol的module是已經載入, 若未載入就先lm該module吧 (範例參考:lm ld x)
ld * 加載所有模塊的符號

0:000> ld *
Symbols already loaded for msvcr80
Symbols already loaded for valWBFPolicyService
Symbols already loaded for wevtapi
Symbols already loaded for devobj
Symbols already loaded for mintdh
Symbols already loaded for tdh
Symbols already loaded for bcrypt
Symbols already loaded for msasn1
Symbols already loaded for KERNELBASE
Symbols already loaded for gdi32full
Symbols already loaded for win32u
Symbols already loaded for cfgmgr32
Symbols already loaded for crypt32
Symbols already loaded for ucrtbase
Symbols already loaded for msvcp_win
Symbols already loaded for bcryptPrimitives
Symbols already loaded for oleaut32
Symbols already loaded for combase
Symbols already loaded for setupapi
Symbols already loaded for rpcrt4
Symbols already loaded for sechost
Symbols already loaded for gdi32
Symbols already loaded for msvcrt
Symbols already loaded for kernel32
Symbols already loaded for ole32
Symbols already loaded for user32
Symbols already loaded for advapi32
Symbols already loaded for imagehlp
Symbols already loaded for psapi
Symbols already loaded for ntdll

0:000> ld *

Symbols already loaded for msvcr80

Symbols already loaded for valWBFPolicyService

Symbols already loaded for wevtapi

Symbols already loaded for devobj

Symbols already loaded for mintdh

Symbols already loaded for tdh

Symbols already loaded for bcrypt

Symbols already loaded for msasn1

Symbols already loaded for KERNELBASE

Symbols already loaded for gdi32full

Symbols already loaded for win32u

Symbols already loaded for cfgmgr32

Symbols already loaded for crypt32

Symbols already loaded for ucrtbase

Symbols already loaded for msvcp_win

Symbols already loaded for bcryptPrimitives

Symbols already loaded for oleaut32

Symbols already loaded for combase

Symbols already loaded for setupapi

Symbols already loaded for rpcrt4

Symbols already loaded for sechost

Symbols already loaded for gdi32

Symbols already loaded for msvcrt

Symbols already loaded for kernel32

Symbols already loaded for ole32

Symbols already loaded for user32

Symbols already loaded for advapi32

Symbols already loaded for imagehlp

Symbols already loaded for psapi

Symbols already loaded for ntdll

指令 x
搜尋匹配的符号資訊(Examine Symbols)
x [Options] ModuleName!SymbolName 以!為界module與symbol
用法:
x *! 列出所有模块Module

0:000> x *!
start             end                 module name
00000000`6a030000 00000000`6a0f9000   msvcr80    (deferred)             
00000001`40000000 00000001`40016000   valWBFPolicyService   (deferred)             
00007ffa`a9110000 00007ffa`a9171000   wevtapi    (deferred)             
00007ffa`aab40000 00007ffa`aab68000   devobj     (deferred)             
00007ffa`aada0000 00007ffa`aadf4000   mintdh     (deferred)             
00007ffa`aae00000 00007ffa`aaeae000   tdh        (deferred)             
00007ffa`ab940000 00007ffa`ab96b000   bcrypt     (deferred)             
00007ffa`abde0000 00007ffa`abdf0000   msasn1     (deferred)             
00007ffa`abdf0000 00007ffa`ac00d000   KERNELBASE   (pdb symbols)          c:\symbols\kernelbase.pdb\C1CB335438FC484B842D02CB20116D3A1\kernelbase.pdb
00007ffa`ac010000 00007ffa`ac190000   gdi32full   (deferred)             
00007ffa`ac190000 00007ffa`ac1ae000   win32u     (deferred)             
00007ffa`ac1b0000 00007ffa`ac1f2000   cfgmgr32   (deferred)             
00007ffa`ac8e0000 00007ffa`acaa9000   crypt32    (deferred)             
00007ffa`acb60000 00007ffa`acc55000   ucrtbase   (deferred)             
00007ffa`acc60000 00007ffa`accfc000   msvcp_win   (deferred)             
00007ffa`acd60000 00007ffa`acdca000   bcryptPrimitives   (deferred)             
00007ffa`ad120000 00007ffa`ad1df000   oleaut32   (deferred)             
00007ffa`ad240000 00007ffa`ad508000   combase    (deferred)             
00007ffa`ad5b0000 00007ffa`ad9d9000   setupapi   (deferred)             
00007ffa`ad9e0000 00007ffa`adb01000   rpcrt4     (deferred)             
00007ffa`adb10000 00007ffa`adb69000   sechost    (deferred)             
00007ffa`adbe0000 00007ffa`adc14000   gdi32      (deferred)             
00007ffa`adc20000 00007ffa`adcbe000   msvcrt     (deferred)             
00007ffa`af330000 00007ffa`af3dc000   kernel32   (deferred)             
00007ffa`af3e0000 00007ffa`af518000   ole32      (deferred)             
00007ffa`af550000 00007ffa`af6b5000   user32     (deferred)             
00007ffa`af6c0000 00007ffa`af762000   advapi32   (deferred)             
00007ffa`af850000 00007ffa`af86c000   imagehlp   (deferred)             
00007ffa`af870000 00007ffa`af878000   psapi      (deferred)             
00007ffa`af8f0000 00007ffa`afac2000   ntdll      (pdb symbols)          c:\symbols\ntdll.pdb\3FED89B476364D33AA918AE74196DAF21\ntdll.pdb

0:000> x *!

start end module name

00000000`6a030000 00000000`6a0f9000 msvcr80 (deferred)

00000001`40000000 00000001`40016000 valWBFPolicyService (deferred)

00007ffa`a9110000 00007ffa`a9171000 wevtapi (deferred)

00007ffa`aab40000 00007ffa`aab68000 devobj (deferred)

00007ffa`aada0000 00007ffa`aadf4000 mintdh (deferred)

00007ffa`aae00000 00007ffa`aaeae000 tdh (deferred)

00007ffa`ab940000 00007ffa`ab96b000 bcrypt (deferred)

00007ffa`abde0000 00007ffa`abdf0000 msasn1 (deferred)

00007ffa`abdf0000 00007ffa`ac00d000 KERNELBASE (pdb symbols) c:\symbols\kernelbase.pdb\C1CB335438FC484B842D02CB20116D3A1\kernelbase.pdb

00007ffa`ac010000 00007ffa`ac190000 gdi32full (deferred)

00007ffa`ac190000 00007ffa`ac1ae000 win32u (deferred)

00007ffa`ac1b0000 00007ffa`ac1f2000 cfgmgr32 (deferred)

00007ffa`ac8e0000 00007ffa`acaa9000 crypt32 (deferred)

00007ffa`acb60000 00007ffa`acc55000 ucrtbase (deferred)

00007ffa`acc60000 00007ffa`accfc000 msvcp_win (deferred)

00007ffa`acd60000 00007ffa`acdca000 bcryptPrimitives (deferred)

00007ffa`ad120000 00007ffa`ad1df000 oleaut32 (deferred)

00007ffa`ad240000 00007ffa`ad508000 combase (deferred)

00007ffa`ad5b0000 00007ffa`ad9d9000 setupapi (deferred)

00007ffa`ad9e0000 00007ffa`adb01000 rpcrt4 (deferred)

00007ffa`adb10000 00007ffa`adb69000 sechost (deferred)

00007ffa`adbe0000 00007ffa`adc14000 gdi32 (deferred)

00007ffa`adc20000 00007ffa`adcbe000 msvcrt (deferred)

00007ffa`af330000 00007ffa`af3dc000 kernel32 (deferred)

00007ffa`af3e0000 00007ffa`af518000 ole32 (deferred)

00007ffa`af550000 00007ffa`af6b5000 user32 (deferred)

00007ffa`af6c0000 00007ffa`af762000 advapi32 (deferred)

00007ffa`af850000 00007ffa`af86c000 imagehlp (deferred)

00007ffa`af870000 00007ffa`af878000 psapi (deferred)

00007ffa`af8f0000 00007ffa`afac2000 ntdll (pdb symbols) c:\symbols\ntdll.pdb\3FED89B476364D33AA918AE74196DAF21\ntdll.pdb

x ntdll!a* 列出 ntdll 模块底下所有a開頭的symbol

0:000> x ntdll!ap*
00007ffa`af9648b4 ntdll!AppModelPolicy_GetPolicy (void)
00007ffa`af917250 ntdll!ApiSetQueryApiSetPresence (void)
00007ffa`afa0d3b0 ntdll!AppModelLibraryLoadFailureSystemBinary = <no type information>
00007ffa`afa0d420 ntdll!AppModelLibraryLoadFailureApplicationBinary = <no type information>
00007ffa`af91767c ntdll!ApiSetResolveToHost (<no parameter info>)
00007ffa`afa0d450 ntdll!AppModelRuntimeProviderId = <no type information>
00007ffa`afa0d3e0 ntdll!AppModelGenericLibraryLoadFailureNoTermination = <no type information>
00007ffa`af9177a0 ntdll!ApiSetpSearchForApiSet (<no parameter info>)
00007ffa`afa0d390 ntdll!AppModelLibraryLoadFailureNgenBinary = <no type information>
00007ffa`af916b68 ntdll!ApiSetpSearchForApiSetHost (<no parameter info>)

0:000> x ntdll!ap*

00007ffa`af9648b4 ntdll!AppModelPolicy_GetPolicy (void)

00007ffa`af917250 ntdll!ApiSetQueryApiSetPresence (void)

00007ffa`afa0d3b0 ntdll!AppModelLibraryLoadFailureSystemBinary = <no type information>

00007ffa`afa0d420 ntdll!AppModelLibraryLoadFailureApplicationBinary = <no type information>

00007ffa`af91767c ntdll!ApiSetResolveToHost (<no parameter info>)

00007ffa`afa0d450 ntdll!AppModelRuntimeProviderId = <no type information>

00007ffa`afa0d3e0 ntdll!AppModelGenericLibraryLoadFailureNoTermination = <no type information>

00007ffa`af9177a0 ntdll!ApiSetpSearchForApiSet (<no parameter info>)

00007ffa`afa0d390 ntdll!AppModelLibraryLoadFailureNgenBinary = <no type information>

00007ffa`af916b68 ntdll!ApiSetpSearchForApiSetHost (<no parameter info>)

指令!sym
獲取符號加載狀態
!sym noisy 讓調試器顯示符號搜索詳細信息
!sym quiet 默認項，不顯示符號搜索信息

指令.sympath
顯示和設置符號搜索路徑
.sympath+ 增加符號搜索路徑
.sympath+ C:\Symbols

指令.symfix
設置符號庫路徑
.sym+ DownstreamStore 添加符號庫路徑

指令 .reload
重新加載符號信息

Windbg 異常分析指令:

指令: dump
.dump d:/test.dump
也就是說可以透過windbg來產生dump檔案
e.g.
產生完整Kernel Mode Dump :
.dump /f C:\memory.dmp

產生 user mode Dump:
.dump /m C:\memory.dmp

產生 User mode + 其他資訊:
.dump /mfh C:\memory.dmp

指令: !analyze
!analyze -v
顯示當前異常的詳細信息
e.g. !analyze –v d:\test.dump

!analyze -hang
診斷線程調用棧上是否有任何線程阻塞了其他線程

!analyze -f
查看異常分析信息，儘管調試器並未診斷出異常

指令: .lastevent
显示最近一次发生的异常或事件

指令: .load wow64exts
指令: !wow64exts.sw
從64位模式切換到了32位

指令: !locks
顯示目前 locks 鎖

指令: !qlocks
顯示目前 spinlock鎖

Windbg 關於memory的指令

指令dt (Display Type)
dt ntdll!*IMAGE* :查找有什麼Headers
以下例子是 notepad在memory查找出PE header的位址, 然後透過dt指令就可以查到定義的結構內容:

指令: .Dvalloc
讓 Windows 以分配到目標進程的更多memory。

指令: r
显示或修改寄存器、浮点寄存器、标志位、伪寄存器和预定义别名。直接用r，会显示当前线程的寄存器状态

指令: d*
显示给定范围memory的内容。
da ASCII 字符
db 字节值和ASCII字符

指令: e*
e命令和d命令非常相似，一個讀取一個寫入編輯
ea ASCII 字符串(不以NULL结尾)。
eb 字节值。

0:000> .dvalloc 100
Allocated 1000 bytes starting at 00080000
0:000> ea 00080000 "i am ansi "
0:000> db 00080000 
00080000  69 20 61 6d 20 61 6e 73-69 20 00 00 00 00 00 00  i am ansi ......

0:000> .dvalloc 100

Allocated 1000 bytes starting at 00080000

0:000> ea 00080000 "i am ansi "

0:000> db 00080000

00080000 69 20 61 6d 20 61 6e 73-69 20 00 00 00 00 00 00 i am ansi ......

指令u* :
命令显示指定的内存中的程序代码的反汇编。如果要反汇编某一个地址，直接用u命令加地址
ub 指示要反汇编的区域是向后计算的。
uf 命令显示内存中指定函数的反汇编代码。

指令x:
命令显示所有上下文中匹配指定模板的符号。可用字符通配符

指令: s (Search Memory)
搜索内存查找指定模板

指令: dt:
命令显示局部变量、全局变量或数据类型的信息。它也可以仅显示数据类型。即结构和联合(union)的信息
dt最方便处是查找结构体，查找结构体一定要使用dt，不要使用x
PE文件解析
1.dos头：
0:001> dt IMAGE_DOS_HEADER 01230000
2.nt头
e_lfanew定义了真正的PE文件头的相对偏移量RVA
0:001> da 01230000 +0n224
012300e0 “PE”
0:001> dt IMAGE_NT_HEADERS 01230000 +0n224
3.文件头
0:001> dt IMAGE_FILE_HEADER 01230000 +0n224+0x4
4.扩展文件头
0:001> dt _IMAGE_OPTIONAL_HEADER 01230000 +0n224+0x18

指令: dh
!dh 擴展顯示指定映像的頭部。

指令:!address
顯示整個地址空間和使用摘要的信息

0:000> !address     
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...

        BaseAddress      EndAddress+1        RegionSize     Type       State                 Protect             Usage
--------------------------------------------------------------------------------------------------------------------------
+        0`00000000        0`00010000        0`00010000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00010000        0`00020000        0`00010000 MEM_MAPPED  MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 1; Handle: 0000000000010000; Type: Segment]
+        0`00020000        0`00021000        0`00001000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [............NSDS]
+        0`00021000        0`00030000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00030000        0`00046000        0`00016000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [API Set Map]
+        0`00046000        0`00050000        0`0000a000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00050000        0`00143000        0`000f3000 MEM_PRIVATE MEM_RESERVE                                    Stack      [~0; b60.b64]
         0`00143000        0`00146000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE|PAGE_GUARD          Stack      [~0; b60.b64]
         0`00146000        0`00150000        0`0000a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Stack      [~0; b60.b64]
+        0`00150000        0`00154000        0`00004000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [System Default Activation Context Data]
+        0`00154000        0`00160000        0`0000c000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00160000        0`00161000        0`00001000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [Activation Context Data]
+        0`00161000        0`00170000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00170000        0`00172000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     <unknown>  [................]
+        0`00172000        0`00180000        0`0000e000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00180000        0`00183000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000590000; Type: Front End]
         0`00183000        0`0019a000        0`00017000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 0; Handle: 0000000000590000; Type: Front End]
+        0`0019a000        0`001a0000        0`00006000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`001a0000        0`001a1000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000000860000; Type: Front End]
         0`001a1000        0`001ba000        0`00019000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 2; Handle: 0000000000860000; Type: Front End]
+        0`001ba000        0`001c0000        0`00006000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`001c0000        0`001c1000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     <unknown>  [................]
+        0`001c1000        0`001d0000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`001d0000        0`001d1000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     <unknown>  [................]
+        0`001d1000        0`001e0000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`001e0000        0`001e5000        0`00005000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     <unknown>  [................]
+        0`001e5000        0`001f0000        0`0000b000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`001f0000        0`001f4000        0`00004000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [RESCDIR.........]
+        0`001f4000        0`00200000        0`0000c000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00200000        0`003be000        0`001be000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
         0`003be000        0`003bf000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     PEB        [b60]
         0`003bf000        0`003c1000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     TEB        [~0; b60.b64]
         0`003c1000        0`003c5000        0`00004000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
         0`003c5000        0`003c7000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     TEB        [~1; b60.dc4]
         0`003c7000        0`003c9000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     TEB        [~2; b60.e28]
         0`003c9000        0`003cb000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     TEB        [~3; b60.e2c]
         0`003cb000        0`00400000        0`00035000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`00400000        0`004c1000        0`000c1000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [................]
+        0`004c1000        0`004d0000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`004d0000        0`004ed000        0`0001d000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [..........0.5...]
         0`004ed000        0`00590000        0`000a3000 MEM_MAPPED  MEM_RESERVE                                    <unknown>  
+        0`00590000        0`0068f000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000590000; Type: Segment]
         0`0068f000        0`00690000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`00690000        0`006b0000        0`00020000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     <unknown>  [................]
+        0`006b0000        0`006b3000        0`00003000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [MZ..............]
+        0`006b3000        0`00790000        0`000dd000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00790000        0`00791000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000000cc0000; Type: Front End]
         0`00791000        0`007aa000        0`00019000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000000cc0000; Type: Front End]
+        0`007aa000        0`007d0000        0`00026000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`007d0000        0`007d1000        0`00001000 MEM_MAPPED  MEM_COMMIT  PAGE_READWRITE                     <unknown>  [RESCHIT.........]
+        0`007d1000        0`00860000        0`0008f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00860000        0`00867000        0`00007000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000000860000; Type: Segment]
         0`00867000        0`0086a000        0`00003000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 2; Handle: 0000000000860000; Type: Segment]
         0`0086a000        0`0086f000        0`00005000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000000860000; Type: Segment]
         0`0086f000        0`00870000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`00870000        0`00872000        0`00002000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [................]
         0`00872000        0`009f0000        0`0017e000 MEM_MAPPED  MEM_RESERVE                                    <unknown>  
         0`009f0000        0`009f5000        0`00005000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [............H...]
         0`009f5000        0`009f8000        0`00003000 MEM_MAPPED  MEM_RESERVE                                    <unknown>  
+        0`009f8000        0`00a00000        0`00008000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00a00000        0`00b81000        0`00181000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [GDI Shared Handle Table]
+        0`00b81000        0`00cc0000        0`0013f000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`00cc0000        0`00ccf000        0`0000f000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000000cc0000; Type: Segment]
         0`00ccf000        0`00cd0000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`00cd0000        0`00dca000        0`000fa000 MEM_PRIVATE MEM_RESERVE                                    Stack      [~1; b60.dc4]
         0`00dca000        0`00dcd000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE|PAGE_GUARD          Stack      [~1; b60.dc4]
         0`00dcd000        0`00dd0000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Stack      [~1; b60.dc4]
+        0`00dd0000        0`00dfd000        0`0002d000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 3; Handle: 0000000000cc0000; Type: Segment]
         0`00dfd000        0`00ecf000        0`000d2000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 3; Handle: 0000000000cc0000; Type: Segment]
         0`00ecf000        0`00ed0000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`00ed0000        0`00fca000        0`000fa000 MEM_PRIVATE MEM_RESERVE                                    Stack      [~2; b60.e28]
         0`00fca000        0`00fcd000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE|PAGE_GUARD          Stack      [~2; b60.e28]
         0`00fcd000        0`00fd0000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Stack      [~2; b60.e28]
+        0`00fd0000        0`010cb000        0`000fb000 MEM_PRIVATE MEM_RESERVE                                    Stack      [~3; b60.e2c]
         0`010cb000        0`010ce000        0`00003000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE|PAGE_GUARD          Stack      [~3; b60.e2c]
         0`010ce000        0`010d0000        0`00002000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Stack      [~3; b60.e2c]
+        0`010d0000        0`01280000        0`001b0000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`01280000        0`012da000        0`0005a000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 2; Handle: 0000000000860000; Type: Segment]
         0`012da000        0`0137f000        0`000a5000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 2; Handle: 0000000000860000; Type: Segment]
         0`0137f000        0`01380000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`01380000        0`0177f000        0`003ff000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [RESCSEG.........]
+        0`0177f000        0`01780000        0`00001000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`01780000        0`0197f000        0`001ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000590000; Type: Segment]
         0`0197f000        0`01980000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`01980000        0`019f0000        0`00070000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`019f0000        0`01aef000        0`000ff000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000590000; Type: Segment]
         0`01aef000        0`01af0000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`01af0000        0`01e84000        0`00394000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      <unknown>  [RESCSEG.........]
+        0`01e84000        0`01e90000        0`0000c000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`01e90000        0`01ea6000        0`00016000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     Heap       [ID: 0; Handle: 0000000000590000; Type: Segment]
         0`01ea6000        0`0228f000        0`003e9000 MEM_PRIVATE MEM_RESERVE                                    Heap       [ID: 0; Handle: 0000000000590000; Type: Segment]
         0`0228f000        0`02290000        0`00001000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`02290000        0`6a030000        0`67da0000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`6a030000        0`6a031000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
         0`6a031000        0`6a0cd000        0`0009c000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
         0`6a0cd000        0`6a0e9000        0`0001c000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
         0`6a0e9000        0`6a0ee000        0`00005000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
         0`6a0ee000        0`6a0ef000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
         0`6a0ef000        0`6a0f9000        0`0000a000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]
+        0`6a0f9000        0`7ffe0000        0`15ee7000             MEM_FREE    PAGE_NOACCESS                      Free       
+        0`7ffe0000        0`7ffe1000        0`00001000 MEM_PRIVATE MEM_COMMIT  PAGE_READONLY                      Other      [User Shared Data]
         0`7ffe1000        0`7fff0000        0`0000f000 MEM_PRIVATE MEM_RESERVE                                    <unknown>  
+        0`7fff0000        1`40000000        0`c0010000             MEM_FREE    PAGE_NOACCESS                      Free       
+        1`40000000        1`40001000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`40001000        1`4000b000        0`0000a000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`4000b000        1`40011000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`40011000        1`40012000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`40012000        1`40013000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`40013000        1`40015000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
         1`40015000        1`40016000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]
+        1`40016000     7ff5`ffec0000     7ff4`bfeaa000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ff5`ffec0000     7ff5`ffec5000        0`00005000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [Read Only Shared Memory]
      7ff5`ffec5000     7ff5`fffc0000        0`000fb000 MEM_MAPPED  MEM_RESERVE                                    <unknown>  
+     7ff5`fffc0000     7ff5`ffff3000        0`00033000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      Other      [NLS Tables]
+     7ff5`ffff3000     7ffa`a9110000        4`a911d000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`a9110000     7ffa`a9111000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [wevtapi; "C:\Windows\System32\wevtapi.dll"]
      7ffa`a9111000     7ffa`a914f000        0`0003e000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [wevtapi; "C:\Windows\System32\wevtapi.dll"]
      7ffa`a914f000     7ffa`a9168000        0`00019000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [wevtapi; "C:\Windows\System32\wevtapi.dll"]
      7ffa`a9168000     7ffa`a9169000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [wevtapi; "C:\Windows\System32\wevtapi.dll"]
      7ffa`a9169000     7ffa`a9171000        0`00008000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [wevtapi; "C:\Windows\System32\wevtapi.dll"]
+     7ffa`a9171000     7ffa`aab40000        0`019cf000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`aab40000     7ffa`aab41000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [devobj; "C:\Windows\System32\devobj.dll"]
      7ffa`aab41000     7ffa`aab59000        0`00018000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [devobj; "C:\Windows\System32\devobj.dll"]
      7ffa`aab59000     7ffa`aab62000        0`00009000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [devobj; "C:\Windows\System32\devobj.dll"]
      7ffa`aab62000     7ffa`aab63000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [devobj; "C:\Windows\System32\devobj.dll"]
      7ffa`aab63000     7ffa`aab68000        0`00005000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [devobj; "C:\Windows\System32\devobj.dll"]
+     7ffa`aab68000     7ffa`aada0000        0`00238000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`aada0000     7ffa`aada1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [mintdh; "C:\Windows\System32\mintdh.dll"]
      7ffa`aada1000     7ffa`aadd9000        0`00038000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [mintdh; "C:\Windows\System32\mintdh.dll"]
      7ffa`aadd9000     7ffa`aaded000        0`00014000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [mintdh; "C:\Windows\System32\mintdh.dll"]
      7ffa`aaded000     7ffa`aadee000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [mintdh; "C:\Windows\System32\mintdh.dll"]
      7ffa`aadee000     7ffa`aadf4000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [mintdh; "C:\Windows\System32\mintdh.dll"]
+     7ffa`aadf4000     7ffa`aae00000        0`0000c000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`aae00000     7ffa`aae01000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aae01000     7ffa`aae1a000        0`00019000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aae1a000     7ffa`aae75000        0`0005b000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aae75000     7ffa`aae76000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aae76000     7ffa`aaea0000        0`0002a000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aaea0000     7ffa`aaea2000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aaea2000     7ffa`aaea5000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [tdh; "C:\Windows\System32\tdh.dll"]
      7ffa`aaea5000     7ffa`aaeae000        0`00009000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [tdh; "C:\Windows\System32\tdh.dll"]
+     7ffa`aaeae000     7ffa`ab940000        0`00a92000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ab940000     7ffa`ab941000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcrypt; "C:\Windows\System32\bcrypt.dll"]
      7ffa`ab941000     7ffa`ab960000        0`0001f000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [bcrypt; "C:\Windows\System32\bcrypt.dll"]
      7ffa`ab960000     7ffa`ab966000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcrypt; "C:\Windows\System32\bcrypt.dll"]
      7ffa`ab966000     7ffa`ab967000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [bcrypt; "C:\Windows\System32\bcrypt.dll"]
      7ffa`ab967000     7ffa`ab96b000        0`00004000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcrypt; "C:\Windows\System32\bcrypt.dll"]
+     7ffa`ab96b000     7ffa`abde0000        0`00475000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`abde0000     7ffa`abde1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msasn1; "C:\Windows\System32\msasn1.dll"]
      7ffa`abde1000     7ffa`abde9000        0`00008000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [msasn1; "C:\Windows\System32\msasn1.dll"]
      7ffa`abde9000     7ffa`abdec000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msasn1; "C:\Windows\System32\msasn1.dll"]
      7ffa`abdec000     7ffa`abded000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [msasn1; "C:\Windows\System32\msasn1.dll"]
      7ffa`abded000     7ffa`abdf0000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msasn1; "C:\Windows\System32\msasn1.dll"]
+     7ffa`abdf0000     7ffa`abdf1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
      7ffa`abdf1000     7ffa`abec1000        0`000d0000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
      7ffa`abec1000     7ffa`abfde000        0`0011d000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
      7ffa`abfde000     7ffa`abfe2000        0`00004000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
      7ffa`abfe2000     7ffa`abfe3000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
      7ffa`abfe3000     7ffa`ac00d000        0`0002a000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]
+     7ffa`ac00d000     7ffa`ac010000        0`00003000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ac010000     7ffa`ac011000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32full; "C:\Windows\System32\gdi32full.dll"]
      7ffa`ac011000     7ffa`ac0cf000        0`000be000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [gdi32full; "C:\Windows\System32\gdi32full.dll"]
      7ffa`ac0cf000     7ffa`ac170000        0`000a1000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32full; "C:\Windows\System32\gdi32full.dll"]
      7ffa`ac170000     7ffa`ac174000        0`00004000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [gdi32full; "C:\Windows\System32\gdi32full.dll"]
      7ffa`ac174000     7ffa`ac190000        0`0001c000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32full; "C:\Windows\System32\gdi32full.dll"]
+     7ffa`ac190000     7ffa`ac191000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [win32u; "C:\Windows\System32\win32u.dll"]
      7ffa`ac191000     7ffa`ac19a000        0`00009000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [win32u; "C:\Windows\System32\win32u.dll"]
      7ffa`ac19a000     7ffa`ac1a7000        0`0000d000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [win32u; "C:\Windows\System32\win32u.dll"]
      7ffa`ac1a7000     7ffa`ac1a8000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [win32u; "C:\Windows\System32\win32u.dll"]
      7ffa`ac1a8000     7ffa`ac1ae000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [win32u; "C:\Windows\System32\win32u.dll"]
+     7ffa`ac1ae000     7ffa`ac1b0000        0`00002000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ac1b0000     7ffa`ac1b1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]
      7ffa`ac1b1000     7ffa`ac1de000        0`0002d000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]
      7ffa`ac1de000     7ffa`ac1eb000        0`0000d000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]
      7ffa`ac1eb000     7ffa`ac1ec000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]
      7ffa`ac1ec000     7ffa`ac1f2000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]
+     7ffa`ac1f2000     7ffa`ac8e0000        0`006ee000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ac8e0000     7ffa`ac8e1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [crypt32; "C:\Windows\System32\crypt32.dll"]
      7ffa`ac8e1000     7ffa`ac9d7000        0`000f6000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [crypt32; "C:\Windows\System32\crypt32.dll"]
      7ffa`ac9d7000     7ffa`aca0e000        0`00037000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [crypt32; "C:\Windows\System32\crypt32.dll"]
      7ffa`aca0e000     7ffa`aca15000        0`00007000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [crypt32; "C:\Windows\System32\crypt32.dll"]
      7ffa`aca15000     7ffa`acaa9000        0`00094000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [crypt32; "C:\Windows\System32\crypt32.dll"]
+     7ffa`acaa9000     7ffa`acb60000        0`000b7000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`acb60000     7ffa`acb61000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]
      7ffa`acb61000     7ffa`acc0c000        0`000ab000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]
      7ffa`acc0c000     7ffa`acc45000        0`00039000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]
      7ffa`acc45000     7ffa`acc48000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]
      7ffa`acc48000     7ffa`acc55000        0`0000d000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]
+     7ffa`acc55000     7ffa`acc60000        0`0000b000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`acc60000     7ffa`acc61000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
      7ffa`acc61000     7ffa`accb2000        0`00051000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
      7ffa`accb2000     7ffa`accf1000        0`0003f000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
      7ffa`accf1000     7ffa`accf2000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
      7ffa`accf2000     7ffa`accf5000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
      7ffa`accf5000     7ffa`accfc000        0`00007000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]
+     7ffa`accfc000     7ffa`acd60000        0`00064000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`acd60000     7ffa`acd61000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]
      7ffa`acd61000     7ffa`acdb1000        0`00050000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]
      7ffa`acdb1000     7ffa`acdc4000        0`00013000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]
      7ffa`acdc4000     7ffa`acdc5000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]
      7ffa`acdc5000     7ffa`acdca000        0`00005000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]
+     7ffa`acdca000     7ffa`ad120000        0`00356000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ad120000     7ffa`ad121000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [oleaut32; "C:\Windows\System32\oleaut32.dll"]
      7ffa`ad121000     7ffa`ad1a9000        0`00088000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [oleaut32; "C:\Windows\System32\oleaut32.dll"]
      7ffa`ad1a9000     7ffa`ad1ce000        0`00025000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [oleaut32; "C:\Windows\System32\oleaut32.dll"]
      7ffa`ad1ce000     7ffa`ad1d1000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [oleaut32; "C:\Windows\System32\oleaut32.dll"]
      7ffa`ad1d1000     7ffa`ad1df000        0`0000e000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [oleaut32; "C:\Windows\System32\oleaut32.dll"]
+     7ffa`ad1df000     7ffa`ad240000        0`00061000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ad240000     7ffa`ad241000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad241000     7ffa`ad409000        0`001c8000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad409000     7ffa`ad4be000        0`000b5000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad4be000     7ffa`ad4bf000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad4bf000     7ffa`ad4c0000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad4c0000     7ffa`ad4c3000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad4c3000     7ffa`ad4c4000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [combase; "C:\Windows\System32\combase.dll"]
      7ffa`ad4c4000     7ffa`ad508000        0`00044000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [combase; "C:\Windows\System32\combase.dll"]
+     7ffa`ad508000     7ffa`ad5b0000        0`000a8000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ad5b0000     7ffa`ad5b1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
      7ffa`ad5b1000     7ffa`ad65e000        0`000ad000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
      7ffa`ad65e000     7ffa`ad68c000        0`0002e000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
      7ffa`ad68c000     7ffa`ad68d000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
      7ffa`ad68d000     7ffa`ad68e000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
      7ffa`ad68e000     7ffa`ad9d9000        0`0034b000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [setupapi; "C:\Windows\System32\setupapi.dll"]
+     7ffa`ad9d9000     7ffa`ad9e0000        0`00007000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`ad9e0000     7ffa`ad9e1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]
      7ffa`ad9e1000     7ffa`adac0000        0`000df000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]
      7ffa`adac0000     7ffa`adaea000        0`0002a000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]
      7ffa`adaea000     7ffa`adaec000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]
      7ffa`adaec000     7ffa`adb01000        0`00015000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]
+     7ffa`adb01000     7ffa`adb10000        0`0000f000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`adb10000     7ffa`adb11000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb11000     7ffa`adb42000        0`00031000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb42000     7ffa`adb60000        0`0001e000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb60000     7ffa`adb61000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb61000     7ffa`adb62000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb62000     7ffa`adb63000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [sechost; "C:\Windows\System32\sechost.dll"]
      7ffa`adb63000     7ffa`adb69000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [sechost; "C:\Windows\System32\sechost.dll"]
+     7ffa`adb69000     7ffa`adbe0000        0`00077000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`adbe0000     7ffa`adbe1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32; "C:\Windows\System32\gdi32.dll"]
      7ffa`adbe1000     7ffa`adbf3000        0`00012000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [gdi32; "C:\Windows\System32\gdi32.dll"]
      7ffa`adbf3000     7ffa`adc0e000        0`0001b000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32; "C:\Windows\System32\gdi32.dll"]
      7ffa`adc0e000     7ffa`adc0f000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [gdi32; "C:\Windows\System32\gdi32.dll"]
      7ffa`adc0f000     7ffa`adc14000        0`00005000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [gdi32; "C:\Windows\System32\gdi32.dll"]
+     7ffa`adc14000     7ffa`adc20000        0`0000c000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`adc20000     7ffa`adc21000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adc21000     7ffa`adc96000        0`00075000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adc96000     7ffa`adcaf000        0`00019000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adcaf000     7ffa`adcb1000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adcb1000     7ffa`adcb4000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adcb4000     7ffa`adcb6000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adcb6000     7ffa`adcb7000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
      7ffa`adcb7000     7ffa`adcbe000        0`00007000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [msvcrt; "C:\Windows\System32\msvcrt.dll"]
+     7ffa`adcbe000     7ffa`af330000        0`01672000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af330000     7ffa`af331000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [kernel32; "C:\Windows\System32\kernel32.dll"]
      7ffa`af331000     7ffa`af3a4000        0`00073000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [kernel32; "C:\Windows\System32\kernel32.dll"]
      7ffa`af3a4000     7ffa`af3d3000        0`0002f000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [kernel32; "C:\Windows\System32\kernel32.dll"]
      7ffa`af3d3000     7ffa`af3d4000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [kernel32; "C:\Windows\System32\kernel32.dll"]
      7ffa`af3d4000     7ffa`af3dc000        0`00008000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [kernel32; "C:\Windows\System32\kernel32.dll"]
+     7ffa`af3dc000     7ffa`af3e0000        0`00004000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af3e0000     7ffa`af3e1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ole32; "C:\Windows\System32\ole32.dll"]
      7ffa`af3e1000     7ffa`af497000        0`000b6000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [ole32; "C:\Windows\System32\ole32.dll"]
      7ffa`af497000     7ffa`af4ee000        0`00057000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ole32; "C:\Windows\System32\ole32.dll"]
      7ffa`af4ee000     7ffa`af4f0000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [ole32; "C:\Windows\System32\ole32.dll"]
      7ffa`af4f0000     7ffa`af518000        0`00028000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ole32; "C:\Windows\System32\ole32.dll"]
+     7ffa`af518000     7ffa`af550000        0`00038000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af550000     7ffa`af551000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [user32; "C:\Windows\System32\user32.dll"]
      7ffa`af551000     7ffa`af5ee000        0`0009d000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [user32; "C:\Windows\System32\user32.dll"]
      7ffa`af5ee000     7ffa`af60b000        0`0001d000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [user32; "C:\Windows\System32\user32.dll"]
      7ffa`af60b000     7ffa`af60d000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [user32; "C:\Windows\System32\user32.dll"]
      7ffa`af60d000     7ffa`af6b5000        0`000a8000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [user32; "C:\Windows\System32\user32.dll"]
+     7ffa`af6b5000     7ffa`af6c0000        0`0000b000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af6c0000     7ffa`af6c1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af6c1000     7ffa`af720000        0`0005f000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af720000     7ffa`af754000        0`00034000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af754000     7ffa`af755000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af755000     7ffa`af756000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af756000     7ffa`af758000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af758000     7ffa`af759000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
      7ffa`af759000     7ffa`af762000        0`00009000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [advapi32; "C:\Windows\System32\advapi32.dll"]
+     7ffa`af762000     7ffa`af850000        0`000ee000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af850000     7ffa`af851000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af851000     7ffa`af85c000        0`0000b000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af85c000     7ffa`af863000        0`00007000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af863000     7ffa`af864000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af864000     7ffa`af865000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af865000     7ffa`af867000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af867000     7ffa`af86a000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
      7ffa`af86a000     7ffa`af86c000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [imagehlp; "C:\Windows\System32\imagehlp.dll"]
+     7ffa`af86c000     7ffa`af870000        0`00004000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af870000     7ffa`af871000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [psapi; "C:\Windows\System32\psapi.dll"]
      7ffa`af871000     7ffa`af872000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [psapi; "C:\Windows\System32\psapi.dll"]
      7ffa`af872000     7ffa`af874000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [psapi; "C:\Windows\System32\psapi.dll"]
      7ffa`af874000     7ffa`af875000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [psapi; "C:\Windows\System32\psapi.dll"]
      7ffa`af875000     7ffa`af878000        0`00003000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [psapi; "C:\Windows\System32\psapi.dll"]
+     7ffa`af878000     7ffa`af8f0000        0`00078000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7ffa`af8f0000     7ffa`af8f1000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`af8f1000     7ffa`af9f9000        0`00108000 MEM_IMAGE   MEM_COMMIT  PAGE_EXECUTE_READ                  Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`af9f9000     7ffa`afa3d000        0`00044000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`afa3d000     7ffa`afa3e000        0`00001000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`afa3e000     7ffa`afa40000        0`00002000 MEM_IMAGE   MEM_COMMIT  PAGE_WRITECOPY                     Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`afa40000     7ffa`afa46000        0`00006000 MEM_IMAGE   MEM_COMMIT  PAGE_READWRITE                     Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
      7ffa`afa46000     7ffa`afac2000        0`0007c000 MEM_IMAGE   MEM_COMMIT  PAGE_READONLY                      Image      [ntdll; "C:\Windows\System32\ntdll.dll"]
+     7ffa`afac2000     7fff`fffe0000        5`5051e000             MEM_FREE    PAGE_NOACCESS                      Free       
+     7fff`fffe0000     7fff`ffff0000        0`00010000 MEM_PRIVATE MEM_RESERVE PAGE_NOACCESS                      <unknown>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

0:000> !address

Mapping file section regions...

Mapping module regions...

Mapping PEB regions...

Mapping TEB and stack regions...

Mapping heap regions...

Mapping page heap regions...

Mapping other regions...

Mapping stack trace database regions...

Mapping activation context regions...

BaseAddress EndAddress+1 RegionSize Type State Protect Usage

--------------------------------------------------------------------------------------------------------------------------

+ 0`00000000 0`00010000 0`00010000 MEM_FREE PAGE_NOACCESS Free

+ 0`00010000 0`00020000 0`00010000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE Heap [ID: 1; Handle: 0000000000010000; Type: Segment]

+ 0`00020000 0`00021000 0`00001000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [............NSDS]

+ 0`00021000 0`00030000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 0`00030000 0`00046000 0`00016000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [API Set Map]

+ 0`00046000 0`00050000 0`0000a000 MEM_FREE PAGE_NOACCESS Free

+ 0`00050000 0`00143000 0`000f3000 MEM_PRIVATE MEM_RESERVE Stack [~0; b60.b64]

0`00143000 0`00146000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD Stack [~0; b60.b64]

0`00146000 0`00150000 0`0000a000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Stack [~0; b60.b64]

+ 0`00150000 0`00154000 0`00004000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [System Default Activation Context Data]

+ 0`00154000 0`00160000 0`0000c000 MEM_FREE PAGE_NOACCESS Free

+ 0`00160000 0`00161000 0`00001000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [Activation Context Data]

+ 0`00161000 0`00170000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 0`00170000 0`00172000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]

+ 0`00172000 0`00180000 0`0000e000 MEM_FREE PAGE_NOACCESS Free

+ 0`00180000 0`00183000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 0; Handle: 0000000000590000; Type: Front End]

0`00183000 0`0019a000 0`00017000 MEM_PRIVATE MEM_RESERVE Heap [ID: 0; Handle: 0000000000590000; Type: Front End]

+ 0`0019a000 0`001a0000 0`00006000 MEM_FREE PAGE_NOACCESS Free

+ 0`001a0000 0`001a1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 2; Handle: 0000000000860000; Type: Front End]

0`001a1000 0`001ba000 0`00019000 MEM_PRIVATE MEM_RESERVE Heap [ID: 2; Handle: 0000000000860000; Type: Front End]

+ 0`001ba000 0`001c0000 0`00006000 MEM_FREE PAGE_NOACCESS Free

+ 0`001c0000 0`001c1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]

+ 0`001c1000 0`001d0000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 0`001d0000 0`001d1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]

+ 0`001d1000 0`001e0000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 0`001e0000 0`001e5000 0`00005000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]

+ 0`001e5000 0`001f0000 0`0000b000 MEM_FREE PAGE_NOACCESS Free

+ 0`001f0000 0`001f4000 0`00004000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [RESCDIR.........]

+ 0`001f4000 0`00200000 0`0000c000 MEM_FREE PAGE_NOACCESS Free

+ 0`00200000 0`003be000 0`001be000 MEM_PRIVATE MEM_RESERVE <unknown>

0`003be000 0`003bf000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PEB [b60]

0`003bf000 0`003c1000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~0; b60.b64]

0`003c1000 0`003c5000 0`00004000 MEM_PRIVATE MEM_RESERVE <unknown>

0`003c5000 0`003c7000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~1; b60.dc4]

0`003c7000 0`003c9000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~2; b60.e28]

0`003c9000 0`003cb000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~3; b60.e2c]

0`003cb000 0`00400000 0`00035000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`00400000 0`004c1000 0`000c1000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [................]

+ 0`004c1000 0`004d0000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 0`004d0000 0`004ed000 0`0001d000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [..........0.5...]

0`004ed000 0`00590000 0`000a3000 MEM_MAPPED MEM_RESERVE <unknown>

+ 0`00590000 0`0068f000 0`000ff000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 0; Handle: 0000000000590000; Type: Segment]

0`0068f000 0`00690000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`00690000 0`006b0000 0`00020000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]

+ 0`006b0000 0`006b3000 0`00003000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [MZ..............]

+ 0`006b3000 0`00790000 0`000dd000 MEM_FREE PAGE_NOACCESS Free

+ 0`00790000 0`00791000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 3; Handle: 0000000000cc0000; Type: Front End]

0`00791000 0`007aa000 0`00019000 MEM_PRIVATE MEM_RESERVE Heap [ID: 3; Handle: 0000000000cc0000; Type: Front End]

+ 0`007aa000 0`007d0000 0`00026000 MEM_FREE PAGE_NOACCESS Free

+ 0`007d0000 0`007d1000 0`00001000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE <unknown> [RESCHIT.........]

+ 0`007d1000 0`00860000 0`0008f000 MEM_FREE PAGE_NOACCESS Free

+ 0`00860000 0`00867000 0`00007000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 2; Handle: 0000000000860000; Type: Segment]

0`00867000 0`0086a000 0`00003000 MEM_PRIVATE MEM_RESERVE Heap [ID: 2; Handle: 0000000000860000; Type: Segment]

0`0086a000 0`0086f000 0`00005000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 2; Handle: 0000000000860000; Type: Segment]

0`0086f000 0`00870000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`00870000 0`00872000 0`00002000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [................]

0`00872000 0`009f0000 0`0017e000 MEM_MAPPED MEM_RESERVE <unknown>

0`009f0000 0`009f5000 0`00005000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [............H...]

0`009f5000 0`009f8000 0`00003000 MEM_MAPPED MEM_RESERVE <unknown>

+ 0`009f8000 0`00a00000 0`00008000 MEM_FREE PAGE_NOACCESS Free

+ 0`00a00000 0`00b81000 0`00181000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [GDI Shared Handle Table]

+ 0`00b81000 0`00cc0000 0`0013f000 MEM_FREE PAGE_NOACCESS Free

+ 0`00cc0000 0`00ccf000 0`0000f000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 3; Handle: 0000000000cc0000; Type: Segment]

0`00ccf000 0`00cd0000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`00cd0000 0`00dca000 0`000fa000 MEM_PRIVATE MEM_RESERVE Stack [~1; b60.dc4]

0`00dca000 0`00dcd000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD Stack [~1; b60.dc4]

0`00dcd000 0`00dd0000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Stack [~1; b60.dc4]

+ 0`00dd0000 0`00dfd000 0`0002d000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 3; Handle: 0000000000cc0000; Type: Segment]

0`00dfd000 0`00ecf000 0`000d2000 MEM_PRIVATE MEM_RESERVE Heap [ID: 3; Handle: 0000000000cc0000; Type: Segment]

0`00ecf000 0`00ed0000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`00ed0000 0`00fca000 0`000fa000 MEM_PRIVATE MEM_RESERVE Stack [~2; b60.e28]

0`00fca000 0`00fcd000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD Stack [~2; b60.e28]

0`00fcd000 0`00fd0000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Stack [~2; b60.e28]

+ 0`00fd0000 0`010cb000 0`000fb000 MEM_PRIVATE MEM_RESERVE Stack [~3; b60.e2c]

0`010cb000 0`010ce000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD Stack [~3; b60.e2c]

0`010ce000 0`010d0000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Stack [~3; b60.e2c]

+ 0`010d0000 0`01280000 0`001b0000 MEM_FREE PAGE_NOACCESS Free

+ 0`01280000 0`012da000 0`0005a000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 2; Handle: 0000000000860000; Type: Segment]

0`012da000 0`0137f000 0`000a5000 MEM_PRIVATE MEM_RESERVE Heap [ID: 2; Handle: 0000000000860000; Type: Segment]

0`0137f000 0`01380000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`01380000 0`0177f000 0`003ff000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [RESCSEG.........]

+ 0`0177f000 0`01780000 0`00001000 MEM_FREE PAGE_NOACCESS Free

+ 0`01780000 0`0197f000 0`001ff000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 0; Handle: 0000000000590000; Type: Segment]

0`0197f000 0`01980000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`01980000 0`019f0000 0`00070000 MEM_FREE PAGE_NOACCESS Free

+ 0`019f0000 0`01aef000 0`000ff000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 0; Handle: 0000000000590000; Type: Segment]

0`01aef000 0`01af0000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`01af0000 0`01e84000 0`00394000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unknown> [RESCSEG.........]

+ 0`01e84000 0`01e90000 0`0000c000 MEM_FREE PAGE_NOACCESS Free

+ 0`01e90000 0`01ea6000 0`00016000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Heap [ID: 0; Handle: 0000000000590000; Type: Segment]

0`01ea6000 0`0228f000 0`003e9000 MEM_PRIVATE MEM_RESERVE Heap [ID: 0; Handle: 0000000000590000; Type: Segment]

0`0228f000 0`02290000 0`00001000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`02290000 0`6a030000 0`67da0000 MEM_FREE PAGE_NOACCESS Free

+ 0`6a030000 0`6a031000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

0`6a031000 0`6a0cd000 0`0009c000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

0`6a0cd000 0`6a0e9000 0`0001c000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

0`6a0e9000 0`6a0ee000 0`00005000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

0`6a0ee000 0`6a0ef000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

0`6a0ef000 0`6a0f9000 0`0000a000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcr80; "C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9268_none_88e0de612fadfb38\msvcr80.dll"]

+ 0`6a0f9000 0`7ffe0000 0`15ee7000 MEM_FREE PAGE_NOACCESS Free

+ 0`7ffe0000 0`7ffe1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READONLY Other [User Shared Data]

0`7ffe1000 0`7fff0000 0`0000f000 MEM_PRIVATE MEM_RESERVE <unknown>

+ 0`7fff0000 1`40000000 0`c0010000 MEM_FREE PAGE_NOACCESS Free

+ 1`40000000 1`40001000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`40001000 1`4000b000 0`0000a000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`4000b000 1`40011000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`40011000 1`40012000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`40012000 1`40013000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`40013000 1`40015000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

1`40015000 1`40016000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [valWBFPolicyService; "C:\Windows\System32\valWBFPolicyService.exe"]

+ 1`40016000 7ff5`ffec0000 7ff4`bfeaa000 MEM_FREE PAGE_NOACCESS Free

+ 7ff5`ffec0000 7ff5`ffec5000 0`00005000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [Read Only Shared Memory]

7ff5`ffec5000 7ff5`fffc0000 0`000fb000 MEM_MAPPED MEM_RESERVE <unknown>

+ 7ff5`fffc0000 7ff5`ffff3000 0`00033000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [NLS Tables]

+ 7ff5`ffff3000 7ffa`a9110000 4`a911d000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`a9110000 7ffa`a9111000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [wevtapi; "C:\Windows\System32\wevtapi.dll"]

7ffa`a9111000 7ffa`a914f000 0`0003e000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [wevtapi; "C:\Windows\System32\wevtapi.dll"]

7ffa`a914f000 7ffa`a9168000 0`00019000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [wevtapi; "C:\Windows\System32\wevtapi.dll"]

7ffa`a9168000 7ffa`a9169000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [wevtapi; "C:\Windows\System32\wevtapi.dll"]

7ffa`a9169000 7ffa`a9171000 0`00008000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [wevtapi; "C:\Windows\System32\wevtapi.dll"]

+ 7ffa`a9171000 7ffa`aab40000 0`019cf000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`aab40000 7ffa`aab41000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [devobj; "C:\Windows\System32\devobj.dll"]

7ffa`aab41000 7ffa`aab59000 0`00018000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [devobj; "C:\Windows\System32\devobj.dll"]

7ffa`aab59000 7ffa`aab62000 0`00009000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [devobj; "C:\Windows\System32\devobj.dll"]

7ffa`aab62000 7ffa`aab63000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [devobj; "C:\Windows\System32\devobj.dll"]

7ffa`aab63000 7ffa`aab68000 0`00005000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [devobj; "C:\Windows\System32\devobj.dll"]

+ 7ffa`aab68000 7ffa`aada0000 0`00238000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`aada0000 7ffa`aada1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [mintdh; "C:\Windows\System32\mintdh.dll"]

7ffa`aada1000 7ffa`aadd9000 0`00038000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [mintdh; "C:\Windows\System32\mintdh.dll"]

7ffa`aadd9000 7ffa`aaded000 0`00014000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [mintdh; "C:\Windows\System32\mintdh.dll"]

7ffa`aaded000 7ffa`aadee000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [mintdh; "C:\Windows\System32\mintdh.dll"]

7ffa`aadee000 7ffa`aadf4000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [mintdh; "C:\Windows\System32\mintdh.dll"]

+ 7ffa`aadf4000 7ffa`aae00000 0`0000c000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`aae00000 7ffa`aae01000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aae01000 7ffa`aae1a000 0`00019000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aae1a000 7ffa`aae75000 0`0005b000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aae75000 7ffa`aae76000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aae76000 7ffa`aaea0000 0`0002a000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aaea0000 7ffa`aaea2000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aaea2000 7ffa`aaea5000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [tdh; "C:\Windows\System32\tdh.dll"]

7ffa`aaea5000 7ffa`aaeae000 0`00009000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [tdh; "C:\Windows\System32\tdh.dll"]

+ 7ffa`aaeae000 7ffa`ab940000 0`00a92000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ab940000 7ffa`ab941000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcrypt; "C:\Windows\System32\bcrypt.dll"]

7ffa`ab941000 7ffa`ab960000 0`0001f000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [bcrypt; "C:\Windows\System32\bcrypt.dll"]

7ffa`ab960000 7ffa`ab966000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcrypt; "C:\Windows\System32\bcrypt.dll"]

7ffa`ab966000 7ffa`ab967000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [bcrypt; "C:\Windows\System32\bcrypt.dll"]

7ffa`ab967000 7ffa`ab96b000 0`00004000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcrypt; "C:\Windows\System32\bcrypt.dll"]

+ 7ffa`ab96b000 7ffa`abde0000 0`00475000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`abde0000 7ffa`abde1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msasn1; "C:\Windows\System32\msasn1.dll"]

7ffa`abde1000 7ffa`abde9000 0`00008000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [msasn1; "C:\Windows\System32\msasn1.dll"]

7ffa`abde9000 7ffa`abdec000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msasn1; "C:\Windows\System32\msasn1.dll"]

7ffa`abdec000 7ffa`abded000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [msasn1; "C:\Windows\System32\msasn1.dll"]

7ffa`abded000 7ffa`abdf0000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msasn1; "C:\Windows\System32\msasn1.dll"]

+ 7ffa`abdf0000 7ffa`abdf1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

7ffa`abdf1000 7ffa`abec1000 0`000d0000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

7ffa`abec1000 7ffa`abfde000 0`0011d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

7ffa`abfde000 7ffa`abfe2000 0`00004000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

7ffa`abfe2000 7ffa`abfe3000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

7ffa`abfe3000 7ffa`ac00d000 0`0002a000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [KERNELBASE; "C:\Windows\System32\KERNELBASE.dll"]

+ 7ffa`ac00d000 7ffa`ac010000 0`00003000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ac010000 7ffa`ac011000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32full; "C:\Windows\System32\gdi32full.dll"]

7ffa`ac011000 7ffa`ac0cf000 0`000be000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [gdi32full; "C:\Windows\System32\gdi32full.dll"]

7ffa`ac0cf000 7ffa`ac170000 0`000a1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32full; "C:\Windows\System32\gdi32full.dll"]

7ffa`ac170000 7ffa`ac174000 0`00004000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [gdi32full; "C:\Windows\System32\gdi32full.dll"]

7ffa`ac174000 7ffa`ac190000 0`0001c000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32full; "C:\Windows\System32\gdi32full.dll"]

+ 7ffa`ac190000 7ffa`ac191000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [win32u; "C:\Windows\System32\win32u.dll"]

7ffa`ac191000 7ffa`ac19a000 0`00009000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [win32u; "C:\Windows\System32\win32u.dll"]

7ffa`ac19a000 7ffa`ac1a7000 0`0000d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [win32u; "C:\Windows\System32\win32u.dll"]

7ffa`ac1a7000 7ffa`ac1a8000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [win32u; "C:\Windows\System32\win32u.dll"]

7ffa`ac1a8000 7ffa`ac1ae000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [win32u; "C:\Windows\System32\win32u.dll"]

+ 7ffa`ac1ae000 7ffa`ac1b0000 0`00002000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ac1b0000 7ffa`ac1b1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]

7ffa`ac1b1000 7ffa`ac1de000 0`0002d000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]

7ffa`ac1de000 7ffa`ac1eb000 0`0000d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]

7ffa`ac1eb000 7ffa`ac1ec000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]

7ffa`ac1ec000 7ffa`ac1f2000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [cfgmgr32; "C:\Windows\System32\cfgmgr32.dll"]

+ 7ffa`ac1f2000 7ffa`ac8e0000 0`006ee000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ac8e0000 7ffa`ac8e1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [crypt32; "C:\Windows\System32\crypt32.dll"]

7ffa`ac8e1000 7ffa`ac9d7000 0`000f6000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [crypt32; "C:\Windows\System32\crypt32.dll"]

7ffa`ac9d7000 7ffa`aca0e000 0`00037000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [crypt32; "C:\Windows\System32\crypt32.dll"]

7ffa`aca0e000 7ffa`aca15000 0`00007000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [crypt32; "C:\Windows\System32\crypt32.dll"]

7ffa`aca15000 7ffa`acaa9000 0`00094000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [crypt32; "C:\Windows\System32\crypt32.dll"]

+ 7ffa`acaa9000 7ffa`acb60000 0`000b7000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`acb60000 7ffa`acb61000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]

7ffa`acb61000 7ffa`acc0c000 0`000ab000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]

7ffa`acc0c000 7ffa`acc45000 0`00039000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]

7ffa`acc45000 7ffa`acc48000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]

7ffa`acc48000 7ffa`acc55000 0`0000d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ucrtbase; "C:\Windows\System32\ucrtbase.dll"]

+ 7ffa`acc55000 7ffa`acc60000 0`0000b000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`acc60000 7ffa`acc61000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

7ffa`acc61000 7ffa`accb2000 0`00051000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

7ffa`accb2000 7ffa`accf1000 0`0003f000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

7ffa`accf1000 7ffa`accf2000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

7ffa`accf2000 7ffa`accf5000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

7ffa`accf5000 7ffa`accfc000 0`00007000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcp_win; "C:\Windows\System32\msvcp_win.dll"]

+ 7ffa`accfc000 7ffa`acd60000 0`00064000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`acd60000 7ffa`acd61000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]

7ffa`acd61000 7ffa`acdb1000 0`00050000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]

7ffa`acdb1000 7ffa`acdc4000 0`00013000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]

7ffa`acdc4000 7ffa`acdc5000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]

7ffa`acdc5000 7ffa`acdca000 0`00005000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [bcryptPrimitives; "C:\Windows\System32\bcryptPrimitives.dll"]

+ 7ffa`acdca000 7ffa`ad120000 0`00356000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ad120000 7ffa`ad121000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [oleaut32; "C:\Windows\System32\oleaut32.dll"]

7ffa`ad121000 7ffa`ad1a9000 0`00088000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [oleaut32; "C:\Windows\System32\oleaut32.dll"]

7ffa`ad1a9000 7ffa`ad1ce000 0`00025000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [oleaut32; "C:\Windows\System32\oleaut32.dll"]

7ffa`ad1ce000 7ffa`ad1d1000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [oleaut32; "C:\Windows\System32\oleaut32.dll"]

7ffa`ad1d1000 7ffa`ad1df000 0`0000e000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [oleaut32; "C:\Windows\System32\oleaut32.dll"]

+ 7ffa`ad1df000 7ffa`ad240000 0`00061000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ad240000 7ffa`ad241000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad241000 7ffa`ad409000 0`001c8000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad409000 7ffa`ad4be000 0`000b5000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad4be000 7ffa`ad4bf000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad4bf000 7ffa`ad4c0000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad4c0000 7ffa`ad4c3000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad4c3000 7ffa`ad4c4000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [combase; "C:\Windows\System32\combase.dll"]

7ffa`ad4c4000 7ffa`ad508000 0`00044000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [combase; "C:\Windows\System32\combase.dll"]

+ 7ffa`ad508000 7ffa`ad5b0000 0`000a8000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ad5b0000 7ffa`ad5b1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [setupapi; "C:\Windows\System32\setupapi.dll"]

7ffa`ad5b1000 7ffa`ad65e000 0`000ad000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [setupapi; "C:\Windows\System32\setupapi.dll"]

7ffa`ad65e000 7ffa`ad68c000 0`0002e000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [setupapi; "C:\Windows\System32\setupapi.dll"]

7ffa`ad68c000 7ffa`ad68d000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [setupapi; "C:\Windows\System32\setupapi.dll"]

7ffa`ad68d000 7ffa`ad68e000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [setupapi; "C:\Windows\System32\setupapi.dll"]

7ffa`ad68e000 7ffa`ad9d9000 0`0034b000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [setupapi; "C:\Windows\System32\setupapi.dll"]

+ 7ffa`ad9d9000 7ffa`ad9e0000 0`00007000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`ad9e0000 7ffa`ad9e1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]

7ffa`ad9e1000 7ffa`adac0000 0`000df000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]

7ffa`adac0000 7ffa`adaea000 0`0002a000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]

7ffa`adaea000 7ffa`adaec000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]

7ffa`adaec000 7ffa`adb01000 0`00015000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [rpcrt4; "C:\Windows\System32\rpcrt4.dll"]

+ 7ffa`adb01000 7ffa`adb10000 0`0000f000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`adb10000 7ffa`adb11000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb11000 7ffa`adb42000 0`00031000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb42000 7ffa`adb60000 0`0001e000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb60000 7ffa`adb61000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb61000 7ffa`adb62000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb62000 7ffa`adb63000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [sechost; "C:\Windows\System32\sechost.dll"]

7ffa`adb63000 7ffa`adb69000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [sechost; "C:\Windows\System32\sechost.dll"]

+ 7ffa`adb69000 7ffa`adbe0000 0`00077000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`adbe0000 7ffa`adbe1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32; "C:\Windows\System32\gdi32.dll"]

7ffa`adbe1000 7ffa`adbf3000 0`00012000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [gdi32; "C:\Windows\System32\gdi32.dll"]

7ffa`adbf3000 7ffa`adc0e000 0`0001b000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32; "C:\Windows\System32\gdi32.dll"]

7ffa`adc0e000 7ffa`adc0f000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [gdi32; "C:\Windows\System32\gdi32.dll"]

7ffa`adc0f000 7ffa`adc14000 0`00005000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [gdi32; "C:\Windows\System32\gdi32.dll"]

+ 7ffa`adc14000 7ffa`adc20000 0`0000c000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`adc20000 7ffa`adc21000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adc21000 7ffa`adc96000 0`00075000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adc96000 7ffa`adcaf000 0`00019000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adcaf000 7ffa`adcb1000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adcb1000 7ffa`adcb4000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adcb4000 7ffa`adcb6000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adcb6000 7ffa`adcb7000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

7ffa`adcb7000 7ffa`adcbe000 0`00007000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [msvcrt; "C:\Windows\System32\msvcrt.dll"]

+ 7ffa`adcbe000 7ffa`af330000 0`01672000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af330000 7ffa`af331000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [kernel32; "C:\Windows\System32\kernel32.dll"]

7ffa`af331000 7ffa`af3a4000 0`00073000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [kernel32; "C:\Windows\System32\kernel32.dll"]

7ffa`af3a4000 7ffa`af3d3000 0`0002f000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [kernel32; "C:\Windows\System32\kernel32.dll"]

7ffa`af3d3000 7ffa`af3d4000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [kernel32; "C:\Windows\System32\kernel32.dll"]

7ffa`af3d4000 7ffa`af3dc000 0`00008000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [kernel32; "C:\Windows\System32\kernel32.dll"]

+ 7ffa`af3dc000 7ffa`af3e0000 0`00004000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af3e0000 7ffa`af3e1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ole32; "C:\Windows\System32\ole32.dll"]

7ffa`af3e1000 7ffa`af497000 0`000b6000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [ole32; "C:\Windows\System32\ole32.dll"]

7ffa`af497000 7ffa`af4ee000 0`00057000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ole32; "C:\Windows\System32\ole32.dll"]

7ffa`af4ee000 7ffa`af4f0000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [ole32; "C:\Windows\System32\ole32.dll"]

7ffa`af4f0000 7ffa`af518000 0`00028000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ole32; "C:\Windows\System32\ole32.dll"]

+ 7ffa`af518000 7ffa`af550000 0`00038000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af550000 7ffa`af551000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [user32; "C:\Windows\System32\user32.dll"]

7ffa`af551000 7ffa`af5ee000 0`0009d000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [user32; "C:\Windows\System32\user32.dll"]

7ffa`af5ee000 7ffa`af60b000 0`0001d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [user32; "C:\Windows\System32\user32.dll"]

7ffa`af60b000 7ffa`af60d000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [user32; "C:\Windows\System32\user32.dll"]

7ffa`af60d000 7ffa`af6b5000 0`000a8000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [user32; "C:\Windows\System32\user32.dll"]

+ 7ffa`af6b5000 7ffa`af6c0000 0`0000b000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af6c0000 7ffa`af6c1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af6c1000 7ffa`af720000 0`0005f000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af720000 7ffa`af754000 0`00034000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af754000 7ffa`af755000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af755000 7ffa`af756000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af756000 7ffa`af758000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af758000 7ffa`af759000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [advapi32; "C:\Windows\System32\advapi32.dll"]

7ffa`af759000 7ffa`af762000 0`00009000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [advapi32; "C:\Windows\System32\advapi32.dll"]

+ 7ffa`af762000 7ffa`af850000 0`000ee000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af850000 7ffa`af851000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af851000 7ffa`af85c000 0`0000b000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af85c000 7ffa`af863000 0`00007000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af863000 7ffa`af864000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af864000 7ffa`af865000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af865000 7ffa`af867000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af867000 7ffa`af86a000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

7ffa`af86a000 7ffa`af86c000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [imagehlp; "C:\Windows\System32\imagehlp.dll"]

+ 7ffa`af86c000 7ffa`af870000 0`00004000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af870000 7ffa`af871000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [psapi; "C:\Windows\System32\psapi.dll"]

7ffa`af871000 7ffa`af872000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [psapi; "C:\Windows\System32\psapi.dll"]

7ffa`af872000 7ffa`af874000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [psapi; "C:\Windows\System32\psapi.dll"]

7ffa`af874000 7ffa`af875000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [psapi; "C:\Windows\System32\psapi.dll"]

7ffa`af875000 7ffa`af878000 0`00003000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [psapi; "C:\Windows\System32\psapi.dll"]

+ 7ffa`af878000 7ffa`af8f0000 0`00078000 MEM_FREE PAGE_NOACCESS Free

+ 7ffa`af8f0000 7ffa`af8f1000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`af8f1000 7ffa`af9f9000 0`00108000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`af9f9000 7ffa`afa3d000 0`00044000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`afa3d000 7ffa`afa3e000 0`00001000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`afa3e000 7ffa`afa40000 0`00002000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`afa40000 7ffa`afa46000 0`00006000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image [ntdll; "C:\Windows\System32\ntdll.dll"]

7ffa`afa46000 7ffa`afac2000 0`0007c000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image [ntdll; "C:\Windows\System32\ntdll.dll"]

+ 7ffa`afac2000 7fff`fffe0000 5`5051e000 MEM_FREE PAGE_NOACCESS Free

+ 7fff`fffe0000 7fff`ffff0000 0`00010000 MEM_PRIVATE MEM_RESERVE PAGE_NOACCESS <unknown>

指令: !vadump : 這個會顯示所有的虛擬內存區域和它的保護屬性

指令: !runaway : 顯示每個Thread消費的時間
  Bit 0 (0x1) 讓調試器顯示每個Thread消耗的用戶模式時間(user time)，默認不加就是0x1
  Bit 1 (0x2) 顯示每個Thread消耗的內核時間(kernel time)。
  Bit 2 (0x4) 顯示每個Thread從創建開始經歷了多少時間。

Windbg 關於process的指令:

指令: |
顯示當前Process的信息

0:000> |
.  0	id: b60	examine	name: C:\Windows\System32\valWBFPolicyService.exe

1 2	0:000> \| . 0 id: b60 examine name: C:\Windows\System32\valWBFPolicyService.exe

指令: !dml_proc
顯示當前Process的信息

0:000> !dml_proc
DbgId  PID    Image file name
0      b60    C:\Windows\System32\valWBFPolicyService.exe

0:000> !dml_proc

DbgId PID Image file name

0 b60 C:\Windows\System32\valWBFPolicyService.exe

指令: .tlist
顯示本機當前所有Process

指令: process
!process 0 0 顯示進程列表

Windbg 關於thread的指令:

指令: ~ (Thread Status):
波形符(~) 命令显示指定线程或当前进程中的所有线程的信息, ~和~*还是有点区别的，~*会把入口函数和优先级都打印出来

指令: ~
顯示所有thread信息

0:000> ~
.  0  Id: b60.b64 Suspend: 0 Teb: 00000000`003bf000 Unfrozen
   1  Id: b60.dc4 Suspend: 0 Teb: 00000000`003c5000 Unfrozen
   2  Id: b60.e28 Suspend: 0 Teb: 00000000`003c7000 Unfrozen
   3  Id: b60.e2c Suspend: 0 Teb: 00000000`003c9000 Unfrozen

0:000> ~

. 0 Id: b60.b64 Suspend: 0 Teb: 00000000`003bf000 Unfrozen

1 Id: b60.dc4 Suspend: 0 Teb: 00000000`003c5000 Unfrozen

2 Id: b60.e28 Suspend: 0 Teb: 00000000`003c7000 Unfrozen

3 Id: b60.e2c Suspend: 0 Teb: 00000000`003c9000 Unfrozen

指令: ~*
顯示所有thread

.  0  Id: b60.b64 Suspend: 0 Teb: 00000000`003bf000 Unfrozen
      Start: valWBFPolicyService+0x7710 (00000001`40007710)
      Priority: 0  Priority class: 32  Affinity: f
   1  Id: b60.dc4 Suspend: 0 Teb: 00000000`003c5000 Unfrozen
      Start: sechost!ScSvcctrlThreadA (00007ffa`adb23db0)
      Priority: 0  Priority class: 32  Affinity: f
   2  Id: b60.e28 Suspend: 0 Teb: 00000000`003c7000 Unfrozen
      Start: valWBFPolicyService+0x1087 (00000001`40001087)
      Priority: 0  Priority class: 32  Affinity: f
   3  Id: b60.e2c Suspend: 0 Teb: 00000000`003c9000 Unfrozen
      Start: valWBFPolicyService+0x1064 (00000001`40001064)
      Priority: 0  Priority class: 32  Affinity: f

. 0 Id: b60.b64 Suspend: 0 Teb: 00000000`003bf000 Unfrozen

Start: valWBFPolicyService+0x7710 (00000001`40007710)