We have been using Vmmap, and Processexplorer and MS Detours to analyze the memory usage in our program. Our goal was to validate our program's memory usage. For example, we know that we have X MB of data which we load from disk into memory, we want to make sure that we are not somehow using 2X MB of memory doing this.
However, we noticed the following discrepancies: - for a particular point during execution, Vmmap will report ~1310 MBs of private working set where Processexplorer will report ~1304 MBs (only 6MB off, but which one is "more" accurate...) - memory tracking with MS Detours will report ~948 MBs allocated from HeapAlloc calls, but Vmmap will say that the program is using ~1143 MBs of private heap
My question is, barring errors in our tracking code, and memory being mapped by drivers, can anyone explain how Vmmap and Processexplorer can capture more memory data than our MS Detours hooks?
Other notable calls which we have hooked into are: - VirtualAlloc - ZwAllocateVirtualMemory - RtlAllocateHeap - MapViewOfSection
Many thanks in advance!
it would suggest take memory dump at that particular time and open it in windbg and do !address -summary. This command should tell you state of each memory region. If its a .NET application then you may want to go deep and look into GC heap. You may refer the article http://vpnchoudhary.blogspot.com/2011/03/out-of-memory-exception-simple.html for more details.