Export (0) Print
Expand All
!ca
!ih
!tz
!vm
Expand Minimize

!pte

The !pte extension displays the page table entry (PTE) and page directory entry (PDE) for the specified address.

Syntax in Windows 2000

!pte VirtualAddress 
!pte PTE 
!pte LiteralAddress 1 
!pte StartAddress EndAddress

Syntax in Windows XP and later

!pte VirtualAddress 
!pte PTE 
!pte LiteralAddress 1 

Parameters

VirtualAddress

Specifies the virtual address whose page table is desired.

PTE

Specifies the address of an actual PTE.

LiteralAddress 1

Specifies the address of an actual PTE or PDE.

StartAddress

(x86 or x64 target computer only; Windows 2000 only) Specifies the first virtual address in a range. All page tables in this range will be displayed.

EndAddress

(x86 or x64 target computer only; Windows 2000 only) Specifies the last virtual address in a range. All page tables in this range will be displayed.

DLL

Windows 2000

Kdextx86.dll

Windows XP and later

Kdexts.dll

 

Additional Information

For information about page tables, page directories, and an explanation of the status bits, see Microsoft Windows Internals, by Mark Russinovich and David Solomon. (This book may not be available in some languages and countries.)

Remarks

If one parameter is supplied and this parameter is an address in the region of memory where the page tables are stored, the debugger treats this as the PTE parameter. This parameter is taken as the actual address of the desired PTE, and the debugger will display this PTE and the corresponding PDE.

If one parameter is supplied and this parameter is not an address in this region, the debugger treats this as the VirtualAddress parameter. The PTE and PDE that hold the mapping for this address are displayed.

If two parameters are supplied and the second parameter is 1 (or any other small number), the debugger treats the first parameter as LiteralAddress. This address is interpreted as the actual address of a PTE and also as the actual address of a PDE, and the corresponding (and possibly invalid) data will be shown.

(x86 or x64 target computer only) If two parameters are supplied and the second parameter is greater than the first, the debugger treats the two parameters as StartAddress and EndAddress. The command then displays the PTEs for each page in the specified memory range.

For a list of all system PTEs, use the !sysptes extension.

Here is an example from an x86 target computer:

kd> !pte 801544f4
801544F4  - PDE at C0300800        PTE at C0200550
          contains 0003B163      contains 00154121
        pfn 3b G-DA--KWV    pfn 154 G--A--KRV

The first line of this example restates the virtual address being investigated. It then gives the virtual address of the PDE and the PTE, which contain information about the virtual-physical mapping of this address.

The second line gives the actual contents of the PDE and the PTE.

The third line takes these contents and analyzes them, breaking them into the page frame number (PFN) and the status bits.

See the !pfn extension or the Converting Virtual Addresses to Physical Addresses section for information about how to interpret and use the PFN.

On an x86 or x64 target computer, the status bits for the PDE and the PTE are shown in the following table. The !pte display indicates these bits with capital letters or dashes, and adds additional information as well.

BitDisplay when setDisplay when clearMeaning

0x200

C

-

Copy on write.

0x100

G

-

Global.

0x80

L

-

Large page. This only occurs in PDEs, never in PTEs.

0x40

D

-

Dirty.

0x20

A

-

Accessed.

0x10

N

-

Cache disabled.

0x8

T

-

Write-through.

0x4

U

K

Owner (user mode or kernel mode).

0x2

W

R

Writeable or read-only. Only on multiprocessor computers and any computer running Windows Vista or later.

0x1

V

Valid.

E

-

Executable page. For platforms that do not support a hardware execute/noexecute bit, including many x86 systems, the E is always displayed.

 

On an Itanium target computer, the status bits for the PDE and the PTE are slightly different from those of the PPE. The Itanium PPE bits are as follows:

Display when setDisplay when clearMeaning

V

Valid.

U

K

Owner (user mode or kernel mode).

D

-

Dirty.

A

-

Accessed.

W

R

Writeable or read-only. Only on multiprocessor computers and any computer running Windows Vista or later.

E

-

Execute.

C

-

Copy on write.

 

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft