The !wsle extension displays all working set list entries (WSLEs).
Syntax in Windows 2000
!wsle [DisplayMode [Address]]
Syntax in Windows XP and later
!wsle [Flags [Address]]
(Windows 2000 only) Specifies the information to include in the display. This can be one of the following values (the default is zero):
Displays only basic information about the working set list.
Displays basic information about the working set list, plus information about each WSLE's address, age, lock status, and reference count. If a WSLE has an invalid page table entry (PTE) or page directory entry (PDE) associated with it, this is displayed as well.
Displays basic information about the working set list, plus the index and value of each WSLE.
(Windows XP and later) Specifies the information to include in the display. This can be any combination of the following bits. The default is zero. If this is used, only basic information about the working set is displayed.
- Bit 0 (0x1)
Causes the display to include information about each WSLE's address, age, lock status, and reference count. If a WSLE has an invalid page table entry (PTE) or page directory entry (PDE) associated with it, this is also displayed.
- Bit 1 (0x2)
Causes the display to include the total number of valid WSLEs, the index of the last WSLE, and the index of the first free WSLE.
- Bit 2 (0x4)
Causes the display to include the total number of free WSLEs, as well as the index of each free WSLE. If bit 1 is also set, then a check is done to make sure that the number of free WSLEs plus the number of valid WSLEs is actually equal to the total number of WSLEs.
Specifies the address of the working set list. If this is omitted, the default working set list is used.
(In Windows 2000, specifying -1 for Address is the same as omitting it. In Windows XP and later versions of Windows, specifying zero for Address is the same as omitting it.)
Windows XP and later
For information about working sets, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals, by Mark Russinovich and David Solomon. (These resources may not be available in some languages and countries.)
This extension can take a significant amount of time to execute.
Here is an example from an x86 target computer running Windows Server 2003:
kd> !wsle 3 Working Set @ c0503000 FirstFree: a7 FirstDynamic: 4 LastEntry 23d NextSlot: 4 LastInitialized 259 NonDirect 65 HashTable: 0 HashTableSize: 0 Reading the WSLE data... Virtual Address Age Locked ReferenceCount c0300203 0 1 1 c0301203 0 1 1 c0502203 0 1 1 c0503203 0 1 1 c01ff201 0 0 1 77f74d19 3 0 1 7ffdfa01 2 0 1 c0001201 0 0 1 ..... Reading the WSLE data... Valid WSLE entries = 0xa7 found end @ wsle index 0x259 .....
Build date: 11/16/2013