re: VMMap - A Peek Inside Virtual Memory

Paul Gürtler — Wed, 24 Oct 2012 11:09:28 GMT

VMMap is a very nice tool, but for some reason, there is often a mismatch in Private Bytes when comparing to pslist or Process Explorer. The deviation seems to originate from "Image", where the sum of Private Bytes usually does not match the listed sum in the upper pane. The deviation is small unless the module is loaded from a file share, where the full module size seems to be added to the Private Bytes sum. A very small program loading imageres.dll (~20 MBytes on Windows 7) can demo this behavior (both for x86 and x64):

#include <windows.h>

void main(void)

{

HMODULE hMod;

hMod = LoadLibrary("imageres.dll");

//hMod = LoadLibrary("u:\\imageres.dll");

if(!hMod)

printf("GLE=%d\n", GetLastError());

else

Sleep(60000);

}

When loading from local disk, total Private Bytes for "Image" remains small, but if you copy imageres.dll to a file share (U:\ in the example above) and load it from there, the full module size seems to be added to the total, but does not appear in the details pane (the module is not relocated in any case). This is just a small demo with simple standard ingredients. If you have a larger application with several modules on a file share, the deviation can be huge. This was tested with VMMap 3.11 on 64 bit Windows 7.