With address of private data from vmmap, how can I find out what is in there?

Question

I have a windows process whose virtual size is far too big for what it does (26gb) I've used VMMap to map out how the memory is laid out and I've gotten the address of the private data, which is showed as reserve.

How can I view what's in there? Is it even possible

Answer 1

This application is probably leaking memory. If it is so, then memory consumption will indefinitely grow with time.

If you are the developer, then you can use memory profiler to find out what objects are not released by application and who is holding them.

Answer 2

This is a 64 bit process and what you're seeing isn't abnormal and not a result of a memory leak.

On 64 bit windows each 64 bit process can allocate up to 128TB of virtual memory. This is only reserved memory and doesn't mean it's committed memory. Reserved memory is not backed up by real memory.

You can read more here: http://blogs.microsoft.co.il/sasha/2016/01/05/windows-process-memory-usage-demystified/