Windows Process Switching Test

Compile a test.exe file. In the context of this process, the kernel is disconnected.

Kd>! Process 0 1 test.exe
PROCESS 83c74d60 SessionId: 0 Cid: 0360 Peb: 7ffdf000 ParentCid: 035c
DirBase: 14360000 ObjectTable: 83c8b7e8 TableSize: 18.
Image: Test.exe
VadRoot 83b49e28 Clone 0 Private 30. Modified 0. Locked 0.
DeviceMap 83fb40a8
Token e280b4b0
ElapsedTime 0:00:00. 0250
UserTime 0:00:00. 0015
KernelTime 0:00:00. 0031
QuotaPoolUsage [PagedPool] 7736
QuotaPoolUsage [NonPagedPool] 1232
Working Set Sizes (now, min, max) (156, 50,345) (624KB, 200KB, 1380KB)
PeakWorkingSetSize 156
VirtualSize 5 Mb
PeakVirtualSize 5 Mb
PageFaultCount 154
MemoryPriority FOREGROUND
BasePriority 8
CommitCharge 35

Kd>? 303.
Evaluate expression: 339083264 = 14360000

DirBase indicates the value to be loaded when a process switches to this process. That is to say, for different processes, the value of C3. For the same virtual address of different processes, the corresponding physical address is different.
Kd>! Vtop 14360 400000
Pdi 1 Pti 0
00400000 136df000 pfn (136df)

Here! The first parameter of top is the pfn of the process, that is, the high 20 bits of the process. The 14360000 bits and 20 bits in height are 14360. The physical address is 136df000, And the pfn is 136df.
The page Directory Index (pdi) is 1, with a height of 10 characters.
The page table index (pti) is 0. 10 digits in the middle