How to find a memory mapping file name in WinDbg?

Question

When I look at my process in VMMap, I can see memory mapped file names. Now I am analyzing a memory dump in WinDbg and would like to know the names of the memory mapped files. How can I find this from a WinDbg or .dmp file?

Answer 1

! address -f: FileMap

You can see more about other flags that you can use to clarify the output in the documentation for addresses!

-Scott

Answer 2

, , ( ) !handle <address> 0xF.
, , : !handle 0 0x4 Section.
, :

Handle 6bc
  Name          \BaseNamedObjects\NLS_CodePage_862_3_2_0_0
Handle 6cc
  Name          \BaseNamedObjects\MyMap
Handle 794
  Name          \BaseNamedObjects\Cor_Private_IPCBlock_v4_4092
Handle 798
  Name          \BaseNamedObjects\Cor_SxSPublic_IPCBlock_4092
Handle 7cc
  Name          \BaseNamedObjects\ShimSharedMemory
5 handles of type Section

, !handle , , .
:

lkd> !handle 0 0x3 2c4 File

Searching for Process with Cid == 2c4
Searching for handles of type File
PROCESS 89242da0  SessionId: 0  Cid: 02c4    Peb: 7ffdd000  ParentCid: 0b48
    DirBase: 0a640dc0  ObjectTable: e1c361d0  HandleCount:  83.
    Image: ConsoleApplication1.exe

Handle table at e11f6000 with 83 entries in use

000c: Object: 86a74868  GrantedAccess: 00100020 (Inherit) Entry: e11f6018
Object: 86a74868  Type: (89e2a730) File
    ObjectHeader: 86a74850 (old version)
        HandleCount: 1  PointerCount: 1
        Directory Object: 00000000  Name: \Foo\Bar {HarddiskVolume2}

06d0: Object: 8669c4b8  GrantedAccess: 00100083 Entry: e11f6da0
Object: 8669c4b8  Type: (89e2a730) File
    ObjectHeader: 8669c4a0 (old version)
        HandleCount: 1  PointerCount: 1
        Directory Object: 00000000  Name: \wubildr {HarddiskVolume1}

06d4: Object: 86bf1f58  GrantedAccess: 00120089 Entry: e11f6da8
Object: 86bf1f58  Type: (89e2a730) File
    ObjectHeader: 86bf1f40 (old version)
        HandleCount: 1  PointerCount: 1
        Directory Object: 00000000  Name: \WINDOWS\assembly\pubpol6.dat {HarddiskVolume1}

06dc: Object: 892c43e0  GrantedAccess: 00120089 Entry: e11f6db8
Object: 892c43e0  Type: (89e2a730) File
    ObjectHeader: 892c43c8 (old version)
        HandleCount: 1  PointerCount: 1
        Directory Object: 00000000  Name: \WINDOWS\assembly\NativeImages_v4.0.30319_32\index1fe.dat {HarddiskVolume1}

06ec: Object: 892cf1f8  GrantedAccess: 00100001 Entry: e11f6dd8
Object: 892cf1f8  Type: (89e2a730) File
    ObjectHeader: 892cf1e0 (old version)
        HandleCount: 1  PointerCount: 1