[Vol-users] VAD nodes: Private memory, but Prototype PTEs?!

Bridgey adam.bridge at yahoo.com
Sat May 10 14:13:42 CDT 2014


Hi all,

I'm trying to understand what I've misunderstood.
Consider this entry from a run of vadinfo:

VAD node @ 0x84f1f3b0 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
Vad Type: VadNone
First prototype PTE: 94181720 Last contiguous PTE: 94181728

This node represents a range which is private (PrivateMemory: 1).
If it's private, i.e. not shareable, why are there Prototype PTEs?
I though prototype PTEs were only used when a range was shareable?

I have a few Vadl nodes like this. The VadS nodes in the output with 'PrivateMemory: 1' don't show any prototype PTEs.

Any pointers greatly appreciated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20140510/9d8cc806/attachment.html


More information about the Vol-users mailing list