Chapter 2: exploring virtual memory

1. Obtain system information:

Void getsysteminfo (lpstystem_info psi );

The system_info struct is defined as follows:

Typedef struct _ system_info {

Union {

DWORD dwoemid ;//

Struct {

Word wprocessorarchitecture; // indicates the processor architecture.

Word wreserved; // reserved value. Do not use

};

};

DWORD dwpagesize; // page size

Lpvoid lpminimumapplicationaddress; // provides the minimum memory address in the available address space of each process. // The starting 64 K of each process address space is idle. Therefore, the value is 0x00001000.

Lpvoid lpmaximumapplicationaddress; // maximum available memory address of the private address space of the process

Dword_ptr dwactiveprocessormask; // bit mask used to indicate which CPUs are active

DWORD dwnumberofprocessors; // Number of CPUs in the Machine

DWORD dwprocessortype; // expired

DWORD dwallocationgranularity; // indicates the allocation granularity used for pre-address space allocation.

Word wprocessorlevel; // The structure of the subdivision processor (such as Pentium ,..)

Word wprocessorrevision; // further subdivided processor (relative to wprocessorlevel ).

} System_info;

To obtain the processor details, call getlogicalprocessorinformation.

Microsoft provides a Windows 32-bit on windows64 bit simulation layer (wow64 for short). When a 32-bit application runs through wow64, The getsysteminfo return value and 64-bit may be different. you can call the following functions to determine the running environment:

Bool iswow64process (// substitution function ISOs (OS _wow6432): True indicates that 32-bit runs on 64-bit

Handle hprocess, // Process Handle

Pbool pbwow64process) // return value, true indicates yes

Function return value: false indicates that some invalid values are used as parameters. if 32 applications run on 32-bit windows (or 64-bit on 64-bit), flase is returned. true is returned only when the 32-bit application runs the blocked wowprocess on wow64. in this case, you can use getnativesysteminfo to obtain the original system_info structure: void getnativesysteminfo (lpsystem_info lpsysteminfo );

2. Virtual Memory status:

Void globalmemorystatus (lpmemoryststus lpbuffer) // the size of the structure to be initialized before use

// Call globalmemorystatus

The memorystatus structure is as follows:

Ypedef struct _ memorystatus {

DWORD dwlength; // Length

Doword dwmemoryload; // indicates how busy the system is.

Size_t dwtotalphys, // total number of all available physical memory

Size_t dwavailphys; // total memory available for all nodes

Size_t dwtotalpagefile; // It indicates the maximum number of subnode data that can be stored in the swap file on the hard disk.

Size_t dwavailvirtual; // indicates the number of bytes in the page file that have not been used

Size_t dwtotalvirtual; // The number of bytes in the address space that are private to each process.

Size_t dwavailvirtual; // It indicates how much idle virtual space is available.

} Memorystatus, * lpmemorystatus;

In addition, if the application runs on a machine with 4 GB memory or the Page Swap file size may be greater than 4 GB, the new globalmemorystatusex (lpmemorystatus pmst) should be called );

Ypedef struct _ memorystatusex {

DWORD dwlength;

DWORD dwmemoryload;

Dwordlong ulltotalphys;

Dwordlong ullavailphys;

Dwordlong ulltotalpagefile;

Dowrdlong ullavaailpagefile;

Dowrdlong ulltotalvirtual;

Dwordlong ullavailvirtual;

Dwordlong ullavailvirtual;

Dwordlong ullavailextendvirtual; // It indicates the size of the memory address space that has not been pre-defined in the virtual address space of the current process. this member makes sense only for the CPU architecture of a specific class/type in a specific configuration.

} Memorystatusex, * lpmemorystatusex;

3. non-uniform memory access (NUMA): when multiple CPUs are used, CPU skills can access local Memory nodes and non-local Memory nodes. to know the memory size of a specific NUMA node, you can call the following function:

Bool getnumaavailablememorynode (

Uchar unode, // used to represent a node

Pulonglong pulavailablebytes); // The number of returned node memory

Query function of the node on which the CPU resides:

Bool getnumaprocessornode (

Uchar processor,

Puchar nodenumber );

Obtain the number of nodes:

Bool getnumahighestnodenumber (

Pulong pulhighestnodenumber );

List of CPUs residing on a node:

Bool getnumanodeprocessormask (

Uchar unode, // number of nodes

[_ Out] pulonglong pulprocessormask); // bit mask

Obtain the current working set size and maximum working set size of a process:

Bool getprocessmemoryinfo (

Handle hprocess. // handle with process_query_information and process_vm_read // access permission

Pprocess_memory_counters ppmc ,//

DWORD cbsize); // structure size

Typedef struct _ process_memory_counters {

Dword cb;

DWORD pagefaultcount;

Size_t peakworkingsetsize; // maximum number of memories used

Size_t workingsetsize; // workset size

Size_t quotapeakpagedpoolusage;

Size_t quotapagedpoolusage;

Size_t quotapeaknonpagedpoolusage;

Size_t quotanonpagedpoolusage;

Size_t pagefileusage;

Size_t peakpagefileusage;

Size_t privateusage; // The number of allocated memory is displayed by calling New, malloc, or virtualalloc.

} Process_memory_counters;

4. query function of the virtual memory ing table: // query Process

DWORD virtualquery (

Lpcvoid pvaddress, // point to the pmemory_basic_information structure and fill in information related to adjacent pages // intervals

Pmemory_basic_information pmbi,

DWORD dwlength );

// Query non-Processes

DWORD virtualqueryex (

Handle hprocess, // Process Handle to be queried

Lpcvoid pvaddress,

Pmemory_basic_information pmbi,

DWORD dwlength); // point to the structure size of the previous Parameter

The return value of the two functions is the actual number of bytes used.

The memory_basic_information structure is defined as follows:

Tyopedef _ memory_basic_information

{

Pvoid baseaddresss, // equal to the value of the pvaddress parameter rounded down to the page size

Pvoid allocationbase; // indicates the base address of the region, which contains the address specified by the pvaddress parameter.

DWORD allocationprotect; // indicates the protection attribute specified for the region at the beginning of the reservation.

Size_t regionsize; // indicates the size of the region, in bytes. The starting address of the region is baseaddress,

// All pages in the region have the same protection property, status, and type.

DWORD state; // For All adjacent page states (mem_free, mem_reserve or mem_commit). For example, the status is mem_free.

// The allocationbase, allocationprotect, protect, and type members are meaningless.

DWORD protect; // For All adjacent pages (provided that the protection attributes, status and type are consistent

// The page containing the addresses specified in the pvaddress parameter is the same), indicating their protection properties (page _*)

DWORD type; // indicates the page type in the region (mem_image, mem_mapped, or mem_private)

} Memory_basic_information, pmemory_basic_information;

To get more detailed information, you can use a function encapsulated by the author:

Bool vmquery (

Handle hprocess,

Lpcvoid pvaddress,

Pvmquery pvmq );

Pvmq definition:

Typedef struct {

// Region information

Pvoid pvrgnbaseaddress; // region start address

DWORD dwrgnprotection; // page _ * is equivalent to the allocationbase Field

Size_t rgnsize; // The regionsize field.

DWORD dwrgnstorage; // mem _ *: free, image, mapped, private is equivalent to state

DWORD dwrgnblocks; // number of blocks

DWORD dwrgnguardblks; // If> 0, region contains thread Stack

Bool brgnisastack; // true if region contains thread stack (obtained through speculation)

// Block information

Pvoid pvblkbaseaddress; // block start address

DWORD dwblkprotection; // protection attribute of the page _ * Block

Size_t blksize; // block size, in bytes

DWORD dwblkstorage; // mem _ *: free, reserve, image, mapped, private (representing the block storage type)

} Vmquery, * pvmquery;

Note: Because this function needs to call virtualqueryex multiple times to run, this means that it will be executed slowly.