Windows sysinternals

218 Part II Usage Guide
■ Shared WS The amount of Shareable WS that is currently shared with other processes.
■ Locked WS The amount of memory that has been guaranteed to remain in physical
memory and not incur a page fault when accessed.
■ Blocks The number of individually allocated memory regions.
■ Largest In Summary View, the size of the largest contiguous memory block for that
allocation type.
■ Address In Details View, the base address of the memory region in the process’
virtual address space.
■ Protection In Details View, identifies the types of operations that can be performed
on the memory. In the case of top-level allocations that show expandable sub-blocks,
Protection identifies a summary of the types of protection in the sub-blocks. An access
violation occurs on an attempt to execute code from a region not marked Execute (if
DEP is enabled), to write to a region not marked Write or Copy-on-Write, or to access
memory that is marked as no-access or is only reserved but not yet committed.
■ Details In Details View, additional information about the memory region, such as the
path to its backing file, Heap ID (for Heap memory), Thread ID (for Stack memory), or
.NET AppDomain and Garbage Collection generations.
Note The VirtualProtect API can change the protection of any page to something different from
that set by the original memory allocation. This means that there can potentially be pages of
memory private to the process in a shareable memory region, for instance, because the region
was created as a pagefile-backed section, but then the application or some other software
changed the protection to copy-on-write and modified the pages.
Timeline and Snapshots
VMMap retains a history of snapshots of the target process’ memory allocation state. You
can load any of these snapshots into the VMMap main view and compare any two snapshots
to see what changed.
When tracing an instrumented process, VMMap captures snapshots automatically. You can
set the automatic capture interval to 1, 2, 5, or 10 seconds from the Options | Trace Snapshot
Interval submenu. You can pause and resume automatic snapshots by pressing Ctrl+Space,
and manually capture a new snapshot at any time by pressing F5.
When you analyze a running process instead of launching an instrumented one, VMMap
does not automatically capture snapshots. You must manually initiate each snapshot by
pressing F5.
www.it-ebooks.info