Sysinternals 手册阅读 about vmmap--目标运行中优化内存

不念不忘少年蓝@ 2022-08-18 16:07 173阅读 0赞

Windows®Sysinternals Administrator’s Reference

66：一共三点 2012-3-21 17:10:37

所有内存区域的类型。

关于堆的观察。

还有trap.. snap的使用

//end

66当前的问题：不是程序退出时的泄漏，

这些通过purify 可以搞定，而是运行中的内存消耗率。

创意

66：这里说到可以通过这里看到申请最多空间的函数调用的谁？

66：这里统计堆分配函数调用的次数很有意思。

除了第一次系统的学习到了快照之间对比的方法。这里的观看系统的分配也是这一次的亮点

选中了 2个时间点，在主界面皆可以看到以前的，和现在的了。

这一点，必须注意You must manually initiate each snapshot by pressing F5.

终于找到了trace 的接口

待办事项

66：以上共享方式不知晓

程序运行中，可以把工作集合释放？？关注。。

浅？？

突出显示

上面列举监视堆分配的类型。 When alloc..

[![clip\_image001][clip_image001]][clip_image001_clip_image001]

[![image][]][image 1]

Process and Diagnostic Utilities

Process Explorer and Process Monitor,

discussed in Chapters 3 and 4, respectively, are the primary utilities for analyzing the runtime behavior

and dynamic state of processes and of the system as a whole.

This chapter describes six additional Sysinternals utilities for viewing details of process state:

■ **VMMap** is a GUI utility that displays details of a process’ virtual and physical memory usage.

■ **ProcDump** is a console utility that can generate a memory dump for a process when it meets specifiable criteria, such as exhibiting a CPU spike or having an unresponsive window.

■ **DebugView** is a GUI utility that lets you monitor user-mode and kernel-mode debug output generated from either the local computer or a remote computer.

■ **LiveKd** lets you run a standard kernel debugger on a snapshot of the running local system without having to reboot into debug mode.

■ **ListDLLs** is a console utility that displays information about DLLs loaded on the system.

■ **Handle** is a console utility that displays information about object handles held by processes on the system.

VMMap

VMMap (shown in Figure 7-1) is a process virtual and physical memory analysis utility. It shows graphical and tabular summaries of the different types of memory allocated by a process, as well as detailed maps of the specific virtual memory allocations, showing characteristics such as backing files and types of protection. VMMap also shows summary and detailed information about the amount of physical memory (working set) assigned by the operating system for the different virtual memory blocks.

VMMap can capture multiple snapshots of the process’ memory allocation state, graphically display allocations over time, and show exactly what changed between any two points in time. Combined with

VMMap’s filtering and refresh options, this allows you to identify the sources of process memory usage and the memory cost of application features.

VMMap can also instrument a process to track its individual memory allocations and show the code paths and call stacks where those allocations are made. With full symbolic information, VMMap can display the line of source code responsible for any memory allocation.

**FIGURE 7-1** VMMap main window.

[![clip\_image002][clip_image002]][clip_image002_clip_image002]

Besides flexible views for analyzing live processes, VMMap supports the export of data in multiple formats, including a native format that preserves detailed information so that you can load it back into VMMap at a later time. It also includes command-line options that enable scripting scenarios.

VMMap is the ideal tool for developers who want to understand and optimize their application’s memory resource usage. (To see how Microsoft Windows allocates physical memory as a systemwide resource, see RAMMap, which is described in Chapter 14, “System Information Utilities.”) VMMap runs on x86 and x64 versions of Windows XP and newer.

Starting VMMap and Choosing a Process

The first thing you must do when starting VMMap is to pick a process to analyze. If you don’t specify a process or an input file on the VMMap command line (described later in this chapter), VMMap displays its Select or Launch Process dialog box. Its View A Running Process tab lets you pick a process that is already running, and the “Launch And Trace A New Process tab lets you start a new, instrumented process and track its memory allocations. You can display the Select or Launch Process dialog box at a later time by pressing Ctrl+P.

View a Running Process

Select a process from the View A Running Process tab (shown in Figure 7-2), and click OK. To quickly find a process by process ID (PID) or by memory usage, click on any column header to sort the rows by that column. The columns include User, Private Bytes, Working Set, and Architecture (that is, whether the process is 32-bit or 64-bit). Click Refresh to update the list.

**FIGURE 7-2** VMMap Select or Launch Process dialog box lists running processes.

[![clip\_image003][clip_image003]][clip_image003_clip_image003]

The View A Running Process tab lists only processes that VMMap can open. If VMMap is not running with administrative permissions (including the Debug privilege), the list includes only processes running as the same user as VMMap and at the same integrity level or a lower one. On Windows Vista and newer, you can restart VMMap with elevated rights by clicking the Show All Processes button in the dialog box, or by choosing File | Run As Administrator.

On x64 editions of Windows, VMMap can analyze 32-bit and 64-bit processes. VMMap launches a 32-bit version of itself to analyze 32-bit processes and a 64-bit version to analyze 64-bit processes. (See “Single Executable Image” in Chapter 1, “Getting Started with the Sysinternals Utilities,” for more information.) With the **–****64** command-line option, described later in this chapter, the 64-bit version is used to analyze all processes.

Launch and Trace a New Process

When you launch an application from VMMap, the application is instrumented to track all individual memory allocations along with the associated call stack. Enter the path to the application and optionally any command-line arguments and the start directory as shown in Figure 7-3, and then click OK.

**FIGURE 7-3** Launch and trace a new process.

[![clip\_image004][clip_image004]][clip_image004_clip_image004]

VMMap injects a DLL into the target process at startup and intercepts its virtual memory API calls. Along with the allocation type, size, and memory protection, VMMap captures the call stack at the point when the allocation is made. VMMap aggregates this information in various ways, which are described in the “Viewing Allocations from Instrumented Processes” section later in this chapter. (See “Call Stacks and Symbols” in Chapter 2, “Windows Core Components,” for more information.)

On x64 editions of Windows, VMMap can instrument and trace x86 and x64 programs, launching a 32-bit or 64-bit version of itself accordingly. However, on x64 Windows VMMap cannot instrument and trace .NET programs built for “Any CPU.. It can instrument those programs on 32-bit versions of Windows, and you can analyze an “Any CPU” program on x64 without instrumentation by picking it from the View A Running Process tab of the Select or Launch Process dialog box.

[![clip\_image005][clip_image005]][clip_image005_clip_image005]

[![clip\_image002][clip_image002 1]][clip_image002_clip_image002 1]

The VMMap window //相当于overview

After you select or launch a process, VMMap analyzes the process,

displaying graphical representations of virtual and physical memory,

and tabular Summary and Details Views. Memory types are color coded

in each of these components, with the Summary View also serving as a color key.

<table style="margin:0px; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.356in; vertical-align:top"> The first bar graph in the VMMap window (shown in Figure 7-1) is the&nbsp;Committed&nbsp;summary. Its differently-colored areas&nbsp;show the relative proportions&nbsp;of the different types of committed memory within the process’address space. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.139in; vertical-align:top"> &nbsp;It also serves as the basis against which the other two graphs are scaled. The total figure shown above the right edge of the graph is not&nbsp;allallocated memory, but the process’&nbsp;“accessible”&nbsp;memory. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.136in; vertical-align:top"> Regions that have only been reserved cannot yet be accessed and are not included in this graph. In other words,&nbsp;the memory included here is backed by RAM, a paging file, or a mapped file. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.356in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.139in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.136in; vertical-align:top"> 66：不仅仅是&nbsp;驻留到银盘上的，比较工作集合，品读 </td> 
 </tr> 
 </tbody> 
</table>

Below Summary View, *Details View* displays information

about each memory region of the process’ user-mode virtual address space.

To show only one allocation type in Details View, select that type in the Summary View.

To view all memory allocations, select the Total row in the Summary View.

As with the Summary View, the columns in Details View allow sorting, resizing and reordering.

<table style="margin:0px 0px 0px 0.333in; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:1.893in; vertical-align:top"> Allocations shown in Details View can expand to show&nbsp;sub-blocks&nbsp;within the original allocation. This can occur, </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.232in; vertical-align:top"> for example, when a large block of memory is reserved, and then parts of it are committed. &nbsp; &nbsp;It also occurs when the image loader or an application creates a file mapping and then creates multiple mapped views of that file mapping; &nbsp; for example, to set protection differently on the different regions of the file mapping. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.131in; vertical-align:top"> You can expand or collapse individual groups of sub-allocations by clicking the plus (+) and minus (–) icons in Details View. &nbsp;You can also expand or collapse all of them by choosing Expand All or Collapse All from the Options menu. &nbsp; &nbsp;The top row of such a group shows the sums of the individual components within it. &nbsp; When a different sort order is selected for Details View, sub-blocks remain with their top-level rows and are sorted within that group. </td> 
 </tr> 
 </tbody> 
</table>

If VMMap’s default font is not to your liking, choose Options | Font to select a different font for Summary View, Details View, and some of VMMap’s dialog boxes.

Memory Types //重要

VMMap categorizes memory allocations into one of several types:

<table style="margin:0px; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.972in; vertical-align:top"> ■&nbsp;Image &nbsp; The memory represents an executable file, such as an&nbsp;EXE or DLL,&nbsp;that has been loaded into a process by the image loader. &nbsp; Note that Image memory&nbsp;does not&nbsp;include executable files loaded as data files— &nbsp; these are included in the Mapped File memory type. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:3.577in; vertical-align:top"> &nbsp;Executable code regions are typically read/execute-only and shareable. &nbsp; Data regions, such as initialized data, are typically read/write or copy-on-write. &nbsp; When copy-on-write pages are modified, additional private memory is created in the process and is marked as read/write. &nbsp; This private memory is backed by RAM or a paging file and not by the image file. The Details column in Details View shows the file’s path or section name. </td> 
 </tr> 
 </tbody> 
</table>

■ **Mapped File** The memory is shareable and represents a file on disk.

Mapped files are often resource DLLs and typically contain application data. The Details column shows the file's path.

<table style="margin:0px; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:3.62in; vertical-align:top"> ■&nbsp;Shareable&nbsp;Shareable memory is memory that can be shared with other processes and is backed by RAM or by the paging file (if present). &nbsp; &nbsp; &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.315in; vertical-align:top"> Shareable memory typically contains data shared between processes through DLL shared sections or through pagefile-backed, file-mapping objects (also known as pagefile-backed sections). &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:0.697in; vertical-align:top"> &nbsp; </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:3.62in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.315in; vertical-align:top"> 
 <ul style="margin:0in 0px 0in 0.159in; padding:0px; unicode-bidi:embed; direction:ltr"> 
 <li> 66：以上共享方式&nbsp;不知晓 </li> 
 </ul> </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:0.697in; vertical-align:top"> &nbsp; </td> 
 </tr> 
 </tbody> 
</table>

■ **Heap** A heap represents private memory allocated and managed by the user-mode heap manager

and typically contains application data. Application memory allocations that use Heap memory

include the C runtime malloc library, the C++ *new* operator, the Windows Heap APIs, and the legacy *GlobalAlloc* and *LocalAlloc APIs.*

■ **Managed Heap** Managed Heap represents private memory that is allocated and managed

by the .NET runtime and typically contains application data.

■ **Stack** Stack memory is allocated to each thread in a process to store function parameters, local variables,

and invocation records. Typically, a fixed amount of Stack memory is allocated and reserved when a thread is created,

but only a relatively small amount is committed. The amount of memory committed within that allocation will grow as needed,

but it will not shrink. Stack memory is freed when its thread exits.

■ **Page Table** Page Table memory is private kernel-mode memory associated with the process’ page tables.

Note that Page Table memory is never displayed in VMMap’s Details View, which shows only user-mode memory.

■ **Free** Free memory regions are spaces in the process’ virtual address space that are not allocated.

To include free memory regions in Details View when inspecting a process’ total memory map, choose Options | Show Free Regions.

[![clip\_image006][clip_image006]][clip_image006_clip_image006]

Memory Information

Summary View and Details View show the following information for allocation types and individual allocations. To reduce noise in the output, VMMap does not show entries that have a value of 0.

■ **Size** The total size of the allocated type or region. This includes areas that have been reserved but not committed.

■ **Committed** The amount of the allocation that is committed—that is, backed by RAM, a paging file, or a mapped file.

■ **Private** The amount of the allocation that is private to the process.

■ **Total WS** The total amount of working set (physical memory) assigned to the type or region.

■ **Private WS** The amount of working set assigned to the type or region that cannot be shared with other processes.

■ **Shareable WS** The amount of working set assigned to the type or region that can be shared with other processes.

■ **Shared WS** The amount of Shareable WS that is currently shared with other processes.

■ **Locked WS** The amount of memory that has been guaranteed to remain in physical memory and not incur a page fault when accessed.

■ **Blocks** The number of individually allocated memory regions.

■ **Largest** In Summary View, the size of the largest contiguous memory block for that allocation type.

■ **Address** In Details View, the base address of the memory region in the process’ virtual address space.

■ **Protection** In Details View, identifies the types of operations that can be performed on the memory. In the case of top-level allocations that show expandable sub-blocks, Protection identifies a summary of the types of protection in the sub-blocks. An access violation occurs on an attempt to execute code from a region not marked Execute (if DEP is enabled), to write to a region not marked Write or Copy-on-Write, or to access memory that is marked as no-access or is only reserved but not yet committed.

■ **Details** In Details View, additional information about the memory region, such as the path to its backing file, Heap ID (for Heap memory), Thread ID (for Stack memory), or .NET AppDomain and Garbage Collection generations.

[![clip\_image007][clip_image007]][clip_image007_clip_image007]

Timeline and Snapshots

VMMap retains a history of snapshots of the target process’ memory allocation state. You can load any of these snapshots into the VMMap main view and compare any two snapshots to see what changed.

When tracing an instrumented process, VMMap captures snapshots automatically. You can set the automatic capture interval to 1, 2, 5, or 10 seconds from the Options | Trace Snapshot Interval submenu. You can pause and resume automatic snapshots by pressing Ctrl+Space, and manually capture a new snapshot at any time by pressing F5.

When you analyze a running process instead of launching an instrumented one, VMMap does not automatically capture snapshots. You must manually initiate each snapshot by pressing F5.

Click the Timeline button on the VMMap main view to display the Timeline dialog box (shown in Figure 7-4), which renders a graphical representation of the history of allocations in the process’ working set. The Timeline lets you load a previous snapshot into the VMMap main view and compare any two snapshots. The graph’s horizontal axis represents the number of seconds since the initial snapshot, and its vertical access to the process’ working set. The colors in the graph correspond to the colors used to represent memory types in the VMMap main window.

**FIGURE 7-4** VMMap Timeline dialog box.

[![clip\_image008][clip_image008]][clip_image008_clip_image008]

When automatic capture is enabled for an instrumented trace, the Timeline dialog box automatically updates its content. You can click the Pause button to suspend automatic snapshot capture; click it again to resume automatic captures. When viewing a process without instrumented tracing, the Timeline dialog box must be closed and reopened to update its content.

Click on any point within the timeline to load the corresponding snapshot into the VMMap main view. To compare any two snapshots, click on a point near one of the snapshots and then drag the mouse to the other point. While you have the mouse button down, the time-line displays vertical lines indicating when snapshots were captured and shades the area between the two selected points, as shown in Figure 7-5. To increase the granularity of the timeline to make it easier to select snapshots, click the plus (+) and minus (–) zoom buttons and move the horizontal scroll.

**FIGURE 7-5** VMMap Timeline dialog box while dragging between two snapshots.

[![clip\_image009][clip_image009]][clip_image009_clip_image009]

<table style="margin:0px 0px 0px 0.707in; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:0.641in; vertical-align:top"> 66 </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:3.281in; vertical-align:top"> 
 <ul style="margin:0in 0px 0in 0.159in; padding:0px; unicode-bidi:embed; direction:ltr"> 
 <li>程序运行中，可以把工作集合&nbsp;释放？？&nbsp;&nbsp;关注。。 </li> 
 </ul> </td> 
 </tr> 
 </tbody> 
</table>

To switch from comparison view to single-snapshot view, open the Timeline dialog box and click on any snapshot.

Viewing Text Within Memory Regions

In some cases, the purpose of a memory region can be revealed by the string data stored within it. To view ASCII or Unicode strings of three or more characters in length, select a region in Details View and then choose View | Strings. VMMap displays a dialog box showing the virtual address range and the strings found within it, as shown in Figure 7-6. If the selected region has sub-blocks, the entire region is searched.

String data is not captured as part of a snapshot. The feature works only with a live process, and not with a saved VMMap (.mmp) file loaded from disk. Further, the strings are read directly from process memory when you invoke the Strings feature. That memory might have changed since the last snapshot was captured.

[![clip\_image010][clip_image010]][clip_image010_clip_image010]

**FIGURE 7-6** The VMMap Strings dialog box.

[![clip\_image011][clip_image011]][clip_image011_clip_image011]

Finding and Copying Text

To search for specific text within Details View, press Ctrl+F. The Find feature selects the next visible row in Details View that contains the text you specify in any column. Note that it will not search for text in unexpanded sub-blocks. To repeat the previous search, press F3.

VMMap offers two ways to copy text from the VMMap display to the clipboard:

■ Ctrl+A copies all text from the VMMap display, including the process name and ID, and all text in Summary View and Details View, retaining the sort order. All sub-allocation data is copied even if it is not expanded in the view. If a specific allocation type is selected in Summary View, only that allocation type will be copied from Details View.

■ Ctrl+C copies all text from the Summary View table if Summary View has focus. If Details View has focus, Ctrl+C copies the address field from the selected row, which can then be pasted into a debugger.

Viewing Allocations from Instrumented Processes

When VMMap starts an instrumented process, it intercepts the program’s

calls to virtual memory APIs and captures information about the calls.

The captured information includes the following:

■ The function name, which indicates the type of allocation. For example, *VirtualAlloc* and *VirtualAllocEx* allocate private memory;

*RtlAllocateHeap* allocates heap memory.

■ The operation, such as Reserve, Commit, Protect (change protection), and Free.

■ The memory protection type, such as Execute/Read and Read/Write.

■ The requested size, in bytes.

■ The virtual memory address at which the allocated block was created.

■ The call stack at the point when the API was invoked.

The call stack identifies the code path within the program that resulted in the allocation request.

VMMap assigns a Call Site ID number to each unique call stack that is captured.

The first call stack is assigned ID 1, the second unique stack is assigned ID 2, and so forth.

If the same code path is executed multiple times, each instance will have the same call stack,

and the data from those allocations are grouped together under a single Call Site ID.

[![clip\_image012][clip_image012]][clip_image012_clip_image012]

**FIGURE 7-7** VMMap Trace dialog box.

<table style="margin:0px; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:4.245in; vertical-align:top"> 66 </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.303in; vertical-align:top"> 
 <ul style="margin:0in 0px 0in 0.159in; padding:0px; unicode-bidi:embed; direction:ltr"> 
 <li>除了&nbsp;第一次系统的学习到了&nbsp;快照之间对比的方法。这里的&nbsp;观看系统的分配也是这一次的亮点 </li> 
 </ul> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:4.245in; vertical-align:top"> <a href="http://images.cnblogs.com/cnblogs_com/titer1/201203/20120321174904323.jpg" style="margin:0px; padding:0px; text-decoration:none; color:rgb(0,0,0); border-bottom-width:1px; border-bottom-style:dotted; border-bottom-color:rgb(51,51,51)" rel="nofollow"><img title="clip_image013" alt="clip_image013" src="http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749045830.jpg" width="351" height="245" style="margin:0px; padding:0px; border:0px; display:inline"></a> &nbsp; &nbsp; Click the plus sign to expand the call site and show the virtual memory addresses at which the requested memory was provided. The Bytes column shows the size of each allocation. &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.303in; vertical-align:top"> Note that when memory is freed, a subsequent allocation request through the same call site might be satisfied at the same address. When this happens, VMMap does not display a separate entry.&nbsp;The Bytes column reports the size only of the first allocation granted at that address.&nbsp;However, the sum shown for the Call Site is accurate. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:4.245in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.303in; vertical-align:top"> 66：这里说到同一地址可能用到两次，vmmap&nbsp;只统计第一次 </td> 
 </tr> 
 </tbody> 
</table>

By default, the Trace dialog box shows only those operations for which “Bytes” is more than

0. Select the “Show all memory operations”check box to display operations that report no bytes.

These include operations such as *RtlCreateHeap*, *RtlFreeHeap*, and *VirtualFree*

(when releasing an entire allocation block).

In Figure 7-7, the call site assigned the ID 1136 was invoked eight times to allocate 26 MB of private memory.

That node is expanded and shows the virtual memory addresses and the requested sizes.

Because all of these requests went through a single code path,

you can select any of them or the top node and click the Stack button to see that site’s call stack, shown in Figure 7-8.

If full symbolic information and source files are available,

select a frame in the call stack and click the

Source button to view the source file in the VMMap source file viewer with the indicated line of source selected.

**FIGURE 7-8** Call stack for a call site accessed from the Trace dialog box.

[![clip\_image014][clip_image014]][clip_image014_clip_image014]

<table style="margin:0px; padding:0px; border:1pt solid rgb(163,163,163); border-collapse:collapse; word-break:break-word; direction:ltr"> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.181in; vertical-align:top"> Click the Call Tree button in the VMMap main window for another way to visualize&nbsp;where your program allocates memory.The Call Tree dialog box (shown in Figure 7-9) identifies the commonalities and divergences in all the collected call stacks and renders them as an expandable tree. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:1.864in; vertical-align:top"> &nbsp;The&nbsp;topmost nodesrepresent the outermost functions in the call stacks. Their child nodes represent functions that they called, and their child nodes represent the various functions they called on the way to a memory operation. </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.586in; vertical-align:top"> Across each row, the Count and % Count columns indicate how many times in the collected set of call stacks that code path was traversed; the Bytes and % Bytes columns indicate how much memory was allocated through that path. You can use this to quickly drill down to the places&nbsp;where the most allocations were invoked or the most memory was allocated. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.181in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:1.864in; vertical-align:top"> &nbsp; </td> 
 <td style="margin:0px; padding:4pt; border:1pt solid rgb(163,163,163); border-collapse:collapse; width:2.586in; vertical-align:top"> 
 <ul style="margin:0in 0px 0in 0.159in; padding:0px; unicode-bidi:embed; direction:ltr"> 
 <li> 66：这里说到可以通过这里看到&nbsp;申请最多空间的函数调用的谁？ </li> 
 </ul> </td> 
 </tr> 
 </tbody> 
</table>

**FIGURE 7-9** The VMMap Call Tree dialog box.

[![clip\_image015][clip_image015]][clip_image015_clip_image015]

Finally, you can view the call stack for a specific heap allocation by selecting it

in Details View and clicking the Heap Allocations button to display the Heap Allocations dialog box.

(See Figure 7-10). Select the item in the dialog box, and click Stack to display the call stack that resulted in that allocation.

**FIGURE 7-10** The Heap Allocations dialog box.

[![clip\_image016][clip_image016]][clip_image016_clip_image016]

Address Space Fragmentation

Poor or unlucky memory management can result in a situation where there is plenty of free memory, but no individual free blocks large enough to satisfy a particular request. For 32-bit processes, the Address Space Fragmentation dialog box (shown in Figure 7-11) shows the layout of the different allocation types within the process’ address space. This can help identify whether fragmentation is a problem and locate the problematic allocations.

**FIGURE 7-11** Address Space Fragmentation (32-bit processes only).

[![clip\_image017][clip_image017]][clip_image017_clip_image017]

Saving and Loading Snapshot Results

The Save and Save As menu items in the File menu include several file formats to save output from a VMMap snapshot. The Save As Type drop-down list in the file-save dialog box includes the following:

■ **.MMP** This is the native VMMap file format. Use this format if you want to load the output back into the VMMap display on the same computer or a different computer. This format saves data from all snapshots, enabling you to view differences from the Timeline dialog box when you load the file back into VMMap.

■ **.CSV** This option saves data from the most recent snapshot as comma-separated values, which is ideal for generating output that you can easily import into Microsoft Excel. If a specific allocation type is selected in Summary View, details are saved only for that memory type.

■ **.TXT** This option saves data as formatted text, which is ideal for sharing the text results in a readable form using a monospace font. Like the .CSV format, if a specific allocation type is selected, details are saved only for that type.

To load a saved .MMP file into VMMap, press Ctrl+O, or pass the file name to VMMap on the command line with the **–****o** option. Also, when a user runs VMMap, VMMap associates the .mmp file extension with the path to that instance of VMMap and the **–****o** option so that users can open a saved .mmp file by double-clicking it in Windows Explorer.

VMMap Command-Line Options

VMMap supports the following command-line options:

vmmap \[-64\] \[-p \{PID | processname\} \[outputfile\]\] \[-o inputfile\]

–64

On x64 editions of Windows, VMMap will run a 32-bit version of itself when a 32-bit process is selected, and a 64-bit version when a 64-bit process is selected. With the **–****64** option, the 64-bit version of VMMap is used to analyze all processes. For 32-bit processes, the 32-bit version of VMMap more accurately categorizes allocation types. The only advantages of the 64-bit version are that it can identify the thread ID associated with 64-bit stacks and more accurately report System memory statistics.

[![clip\_image018][clip_image018]][clip_image018_clip_image018]

–p \{PID | processname\} \[outputfile\]

Use this format to analyze the process specified by the PID or process name. If you specify a name, VMMap will match it against the first process that has a name that begins with the specified text.

If you specify an output file, VMMap will scan the target process, output results to the named file, and then terminate. If you don’t include an extension, VMMap will add .MMP and save in its native format. Add a .CSV extension to the output file name to save as comma-separated values. Any other file extension will save the output using the .TXT format.

–o inputfile

When you use this command, VMMaps open the specified .MMP input file on startup.

Restoring VMMap defaults

VMMap stores all its configuration settings in the registry in “HKEY\_CURRENT\_USER\\ Software\\Sysinternals\\VMMap.” The simplest way to restore all VMMap configuration settings to their defaults is to close VMMap, delete the registry key, and then start VMMap again.

[clip_image001]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748523214.png
[clip_image001_clip_image001]: /images/20220731/f62c12abf49e474e970f7dd2f09425b3.png
[image]: /images/20220731/ad069a81b672406a86585f3e2ead1fad.png
[image 1]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748523181.png
[clip_image002]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748541380.jpg
[clip_image002_clip_image002]: /images/20220731/119a48607a304a13886b07e87058fea6.png
[clip_image003]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748559329.jpg
[clip_image003_clip_image003]: /images/20220731/3247829063094b8682f1585f1add62e5.png
[clip_image004]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748566198.jpg
[clip_image004_clip_image004]: /images/20220731/9003d0bd7ba041c9a98f0c10b55c1f31.png
[clip_image005]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748566689.jpg
[clip_image005_clip_image005]: /images/20220731/0bbb8cabd67e4d75ae4db6b1e13843a5.png
[clip_image002 1]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748573558.jpg
[clip_image002_clip_image002 1]: /images/20220731/12edaa2f69cb461ebc76670c05aa1dd4.png
[clip_image006]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211748598310.jpg
[clip_image006_clip_image006]: /images/20220731/95d82560ff544c8eb69e9b8b75fbcb88.png
[clip_image007]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749008244.jpg
[clip_image007_clip_image007]: /images/20220731/ab5e73bfca2440a19ed5e7084d814d2b.png
[clip_image008]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749019815.jpg
[clip_image008_clip_image008]: /images/20220731/e2a17b58230d418d84ca98f73ea4209b.png
[clip_image009]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749017556.jpg
[clip_image009_clip_image009]: /images/20220731/ec18e65dc1284d01a585a09f0bc26504.png
[clip_image010]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749029998.jpg
[clip_image010_clip_image010]: /images/20220731/e3c362743cb54f67863e7eac989a7567.png
[clip_image011]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749032092.jpg
[clip_image011_clip_image011]: /images/20220731/86e5963cef3f4e8081c5dfbbfd8f2f13.png
[clip_image012]: http://images.cnblogs.com/cnblogs_com/titer1/201203/20120321174903946.jpg
[clip_image012_clip_image012]: /images/20220731/525b4f0a155d430bb2495501919dd684.png
[clip_image014]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749056811.jpg
[clip_image014_clip_image014]: /images/20220731/e9ec933a917a4627972dd5fa060e3aad.png
[clip_image015]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749062567.jpg
[clip_image015_clip_image015]: /images/20220731/595b0b4e509649a191053c864e371b9a.png
[clip_image016]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749079121.jpg
[clip_image016_clip_image016]: /images/20220731/a4f6cc27bb20405f92daff6eb67fb5e1.png
[clip_image017]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749085467.jpg
[clip_image017_clip_image017]: /images/20220731/c3c202f2284e40f1af8b69fb220db4d8.png
[clip_image018]: http://images.cnblogs.com/cnblogs_com/titer1/201203/201203211749089861.jpg
[clip_image018_clip_image018]: /images/20220731/4c99bce8c1044832872491b87dfb8da3.png