!vprot

The !vprot extension displays virtual memory protection information.

!vprot [Address]

Parameters

Address

Specifies the hexadecimal address whose memory protection status is to be displayed.

DLL

Windows 2000

Uext.dll
Ntsdexts.dll

Windows XP and later

Uext.dll

 

Additional Information

To view memory protection information for all memory ranges owned by the target process, use !vadump. For information about memory protection, see Microsoft Windows Internals by Mark Russinovich and David Solomon. (This book may not be available in some languages and countries.)

Remarks

The !vprot extension command can be used for both live debugging and dump file debugging.

Here is an example:

0:000> !vprot 30c191c
BaseAddress: 030c1000
AllocationBase: 030c0000
AllocationProtect: 00000080 PAGE_EXECUTE_WRITECOPY
RegionSize: 00011000
State: 00001000 MEM_COMMIT
Protect: 00000010 PAGE_EXECUTE
Type: 01000000 MEM_IMAGE

In this display, the AllocationProtect line shows the default protection that the entire region was created with. Note that individual addresses within this region can have their protection altered after memory is allocated (for example, if VirtualProtect is called). The Protect line shows the actual protection for this specific address. The possible protection values are PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_WRITECOPY, PAGE_EXECUTE_WRITECOPY, and PAGE_GUARD.

The State line also applies to the specific virtual address passed to !vprot. The possible state values are MEM_COMMIT, MEM_FREE, and MEM_RESERVE.

The Type line shows the memory type. The possible values are MEM_IMAGE, MEM_MAPPED, and MEM_PRIVATE.

 

 

Send comments about this topic to Microsoft

Show: