Windbg,如何检查内存段权限？

Question

例如,输出堆栈是不可执行的,某些堆是可执行/不可执行的.

Answer 1

!address或!vprot(UM)扩展显示虚拟内存保护信息.

0:000> !address 0038f750
Usage:                  Stack
Allocation Base:        00290000
Base Address:           0038d000
End Address:            00390000
Region Size:            00003000
Type:                   00020000    MEM_PRIVATE
State:                  00001000    MEM_COMMIT
Protect:                00000004    PAGE_READWRITE
More info:              ~0k

0:000> !vprot 0038f750
BaseAddress:       0038f000
AllocationBase:    00290000
AllocationProtect: 00000004  PAGE_READWRITE
RegionSize:        00001000
State:             00001000  MEM_COMMIT
Protect:           00000004  PAGE_READWRITE
Type:              00020000  MEM_PRIVATE