Free tool to solve Windows memory problems

Resolving Windows memory issues requires a deep understanding of the operating system and a working knowledge of how to use the Windows debugger or performance monitor. If you are trying to get the details, such as kernel stack size or hard disk memory consumption, you will need complex experience with debugger commands and kernel data architecture. Faced with the process address space to determine private and shared memory utilization or total stack size, even the most experienced administrators can find it challenging.

Don't be afraid, RamMap and VMMap facilitate the process of solving memory problems. You can download these free tools from the Sysinternals website. Both tools were written by Mark Russinovich and Bryce Cogswell.

RamMap

RamMap is used to show system and process memory state and utilization. It provides a summary bar named "Use Count" which lists all of the various system memory partitions, such as paged and nonpaged pools, process private, shareable, hard disk space, kernel stack, and Map file. It also shows the amount of cache file memory space called Metafile.

All of these partitions are further categorized into different types of physical memory consumption, such as active, alternate, modified, transformed, zeroed, free, or bad. Each of these columns can be sorted by clicking on the column header. All of these terms are explained in Russinovich's book, Inside Windows. As shown in Figure 1, the data is presented neatly in a graphical list view.

Figure 1: Usage Count Data in RamMap

RamMap also shows in-process utilization in the <;process" Here you can see all the listed processes and their corresponding private memory utilization. The data also includes all of the process memory that occupies the alternate or modified page list, as well as the amount of memory used for page table entries.

Figure 2: RamMap Process Bar

Another use of RamMap is to display the actual amount of physical memory, identifying memory lists, applications, and files one by one. Attributes such as name, process, virtual address, and pool label. Each column can be categorized and has a filtering function that can be used to selectively analyze the data.

Figure 3: RamMap Physical Page Bar

Finally, RamMap does a good job of showing cache file activity and data. You can use the "File Summary" & "File Details" column to view the system file cache to determine the file path, the size it occupies, and whether the corresponding memory is in the active, alternate, or modified page list.

Figure 4: RamMap File Summary Bar

VMMap

So far, we have seen how RamMap shows system and process memory usage. If the memory problem you are trying to solve seems to be related to a particular process or application, you may want to take a closer look by using VMMap. VMMap is a process-oriented tool that allows you to view existing processes or track new processes and view their memory usage. It provides much more information than RamMap.

When VMMap starts, it prompts you to select the current process you want to review or to open a new process. If you start a new process, you will be able to track memory utilization such as heap and virtual allocation. In Figure 5 below, I chose the communicator.exe process.

Figure 5: VMMap Display

Once the main window of VMMap is displayed, you can see that the screen is divided into sections. The top section is a graphical summary of process memory consumption. It is divided into commit space, private bytes, and working set. In the middle of the screen, memory utilization is categorized according to usage, such as proprietary data, shared data, images, map files, and heap size. Finally, the bottom of the screen shows what the corresponding page type for each virtual address, the size and number of working sets used, page protection, details of all blocks and partitions. Color markers let you quickly see how much space is consumed by a particular type of memory.

VMMap provides two additional views of the process address space, including a "string" view and a "split" view. The string view lets you search for all readable strings that exist in the address space. The split view displays the process virtual address space in a color-coded manner, so you can see how many assignments, their size, and their continuity.