!ca
The !ca extension displays information about a control area.
!ca [Address | 0 | -1] [Flags]
Parameters
Address
Address of the control area. If you specify 0 for this parameter, information is displayed about all control areas. If you specify -1 for this parameter, information is displayed about the unused segment list.
Flags
Flags that specify which information is displayed. This parameter is a bitwise OR of one or more of the following flags.
| Flag | Description |
|---|---|
0x1 |
Display segment information. |
0x2 |
Display subsection information. |
0x4 |
Display the list of mapped views. (Windows 7 and later) |
0x8 |
Display compact (single line) output. |
0x10 |
Display file-backed control areas. |
0x20 |
Display control areas backed by the page file. |
0x40 |
Display image control areas. |
If none of the last three flags are specified, all three types of control area are displayed.
DLL
Kdexts.dll
Additional Information
For information about control areas, see Microsoft Windows Internals by Mark Russinovich and David Solomon.
Remarks
To get a list of the control areas of all mapped files, use the !memusage extension.
Here is an example:
kd> !memusage
loading PFN database
loading (99% complete)
Zeroed: 16 ( 64 kb)
Free: 0 ( 0 kb)
Standby: 2642 ( 10568 kb)
Modified: 720 ( 2880 kb)
ModifiedNoWrite: 0 ( 0 kb)
Active/Valid: 13005 ( 52020 kb)
Transition: 0 ( 0 kb)
Unknown: 0 ( 0 kb)
TOTAL: 16383 ( 65532 kb)
Building kernel map
Finished building kernel map
Usage Summary (in Kb):
Control Valid Standby Dirty Shared Locked PageTables name
ff8636e8 56 376 0 0 0 0 mapped_file( browseui.dll )
ff8cf388 24 0 0 0 0 0 mapped_file( AVH32DLL.DLL )
ff8d62c8 12 0 0 0 0 0 mapped_file( PSAPI.DLL )
ff8dd468 156 28 0 0 0 0 mapped_file( INOJOBSV.EXE )
fe424808 136 88 0 52 0 0 mapped_file( oleaut32.dll )
fe4228a8 152 44 0 116 0 0 mapped_file( MSVCRT.DLL )
ff8ec848 4 0 0 0 0 0 No Name for File
ff859de8 0 32 0 0 0 0 mapped_file( timedate.cpl )
. . . . .
kd> !ca ff8636e8
ControlArea @ff8636e8
Segment: e1b74548 Flink 0 Blink: 0
Section Ref 0 Pfn Ref 6c Mapped Views: 1
User Ref 1 Subsections 5 Flush Count: 0
File Object ff86df88 ModWriteCount 0 System Views: 0
WaitForDel 0 Paged Usage 380 NonPaged Usage e0
Flags (10000a0) Image File HadUserReference
File: \WINNT\System32\browseui.dll
Segment @ e1b74548:
Base address 0 Total Ptes c8 NonExtendPtes: c8
Image commit 1 ControlArea ff8636e8 SizeOfSegment: c8000
Image Base 0 Committed 0 PTE Template: 31b8438
Based Addr 76e10000 ProtoPtes e1b74580 Image Info: e1b748a4
Subsection 1. @ ff863720
ControlArea: ff8636e8 Starting Sector 0 Number Of Sectors 2
Base Pte e1b74580 Ptes In subsect 1 Unused Ptes 0
Flags 15 Sector Offset 0 Protection 1
ReadOnly CopyOnWrite
Subsection 2. @ ff863740
ControlArea: ff8636e8 Starting Sector 2 Number Of Sectors 3d0
Base Pte e1b74584 Ptes In subsect 7a Unused Ptes 0
Flags 35 Sector Offset 0 Protection 3
ReadOnly CopyOnWrite
Subsection 3. @ ff863760
ControlArea: ff8636e8 Starting Sector 3D2 Number Of Sectors 7
Base Pte e1b7476c Ptes In subsect 1 Unused Ptes 0
Flags 55 Sector Offset 0 Protection 5
ReadOnly CopyOnWrite
Subsection 4. @ ff863780
ControlArea: ff8636e8 Starting Sector 3D9 Number Of Sectors 21f
Base Pte e1b74770 Ptes In subsect 44 Unused Ptes 0
Flags 15 Sector Offset 0 Protection 1
ReadOnly CopyOnWrite
Subsection 5. @ ff8637a0
ControlArea: ff8636e8 Starting Sector 5F8 Number Of Sectors 3a
Base Pte e1b74880 Ptes In subsect 8 Unused Ptes 0
Flags 15 Sector Offset 0 Protection 1
ReadOnly CopyOnWrite