nt!MiDispatchFault函数分析之第一次循环前后的变化

第一部分：nt!MiDispatchFault函数分析之第一次循环之前

1: kd> !pte 0x002bf810
                 VA 002bf810
PDE at C0300000         PTE at C0000AFC
contains 7B314867       contains 00000000
pfn 7b314 ---DA--UWEV   not valid

1: kd> dd C0000AFC
c0000afc  00000000 00000000 00000000 00000000
c0000b0c  00000000 00000000 00000000 00000000

1: kd> dd 0xe1439418
e1439418  7ec61921 7ed22921 fc078cca fc078cca
e1439428  fc078cca fc078cca fc078cca 7eda3921
e1439438  fc078cca fc078cca fc078cca fc078cca
e1439448  fc078cca 7ee648c0 7eda58c0 7ede68c0
e1439458  7ee278c0 fc078cca fc078cca fc078cca
e1439468  fc078cca fc078cca

1: kd> dd 81000000+7ede6*18
81be4d90  0007eda5 e1439454 0007ee27 00001208
81be4da0  fc078cca 00000537

1: kd> dd 81000000+7B314*18
81b8c9e0  00000021 c0300000 00000012 00011601
81b8c9f0  00000080 0007b29b

第二部分：nt!MiDispatchFault函数分析之第一次循环之后

            //
            // If the fault can be handled inline (prototype transition or
            // valid for example), then process it here (eliminating
            // locked page charges, etc) to reduce PFN hold times.
            //

            if (AccessCheckNeeded == FALSE) {

                while (TRUE) {

1: kd> !pte 0x002bf810
                 VA 002bf810
PDE at C0300000         PTE at C0000AFC
contains 7B314867       contains 7EDE6025
pfn 7b314 ---DA--UWEV   pfn 7ede6 ----A--UREV

1: kd> dd 0xc0000afc
c0000afc  7ede6025 fffff420 fffff420 fffff420
c0000b0c  fffff420 fffff420 fffff420 00000000

1: kd> dd e1439454
e1439454  7ede6921 7ee278c0 fc078cca fc078cca
e1439464  fc078cca fc078cca

1: kd> dd 81000000+7EDE6*18
81be4d90  00000000 e1439454 00000001 00011608
81be4da0  fc078cca 00000537

1: kd> dd 81000000+7b314*18
81b8c9e0  00000021 c0300000 00000013 00011601
81b8c9f0  00000080 0007b29b