Windbg, how to check memory segment permission?
Asked Answered
R

1

7

For example output stack as non-executable, some heap is executable/non-executable..

Rok answered 2/2, 2013 at 21:28 Comment(0)
F
13

!address or !vprot (UM) extentions display virtual memory protection information.

0:000> !address 0038f750
Usage:                  Stack
Allocation Base:        00290000
Base Address:           0038d000
End Address:            00390000
Region Size:            00003000
Type:                   00020000    MEM_PRIVATE
State:                  00001000    MEM_COMMIT
Protect:                00000004    PAGE_READWRITE
More info:              ~0k

0:000> !vprot 0038f750
BaseAddress:       0038f000
AllocationBase:    00290000
AllocationProtect: 00000004  PAGE_READWRITE
RegionSize:        00001000
State:             00001000  MEM_COMMIT
Protect:           00000004  PAGE_READWRITE
Type:              00020000  MEM_PRIVATE
Folketing answered 3/2, 2013 at 5:48 Comment(1)
+1. for execution permission you need to look at Protect field, which displays memory protectionHelicopter

© 2022 - 2024 — McMap. All rights reserved.