VMMap

Copyright © 2009 Mark Russinovich and Bryce Cogswell

Sysinternals - www.sysinternals.com
Portions based on code by Jeffrey Richter

VMMap is a process virtual and physical memory analysis utility. It shows a breakdown of a process's committed virtual memory types as well as the amount of physical memory (working set) assigned by the operating system to those types. Besides graphical representations of memory usage, VMMap also shows summary information and a detailed process memory map. Powerful filtering, refresh and snapshot comparison capabilities allow you to identify the sources of process memory usage and the memory cost of application features.

Before reporting a bug, please make sure that you can reproduce the bug on the latest version of VMMap posted at Sysinternals. To report a bug, email markruss@microsoft.com.

VMMap works on Windows XP and higher, including x64 64-bit versions of Windows.


Memory Types

VMMap categorizes memory into one of several types:

Image

The memory represents an executable file such as a .exe or .dll. The Details column shows the file's path.

Private

Private memory cannot be shared with other processes, is charged against the system commit limit, and typically contains application data.

Shareable

Shareable memory can be shared with other processes, is charged against the system commit limit and typically contains data shared between DLLs in different processes or inter-process communication messages. The Windows APIs refer to this type of memory as pagefile-backed sections.

Mapped File

The memory represents a file on disk and the Details column shows the file's path. Mapped files typically contain application data.

Heap

Heaps represent memory managed by the user-mode heap manager and, like Private memory, is charged against the system commit limit and contains application data.

Stack

Stacks are memory used to store function parameters, local function variables and function invocation records for individual threads. Stacks are charged agains the commit limit and typically grow on demand.

System

System memory is kernel-mode physical memory associated with the process. The vast majority of System memory consists of the process page tables.

Free

Free memory regions are spaces in the process address space that are not allocated.


Using VMMap

The VMMap Window

When you run VMMap, it will present a process selection dialog. After you select a process it analyzes the process and presents the graphs:

  • Virtual Memory Summary Graph This graph shows the committed (memory that represents data or code) memory usage of the process by type. The graph's scale is the total committed virtual memory usage of the process.

  • Working Set Summary Graph This graph shows the working set usage of the process by memory type. Working set represents the amount of commited virtual memory that's in physical memory and owned by the process. The graph's scale is the total committed virtual memory.

The color key for the regions in the graphs is presented in the Summary View. Below the graphs VMMap shows two windows:

  • Summary View This shows a summary of the virtual and physical usage of the process by type.

  • Details View This shows the memory regions of the process address space.

For each region, VMMap displays the memory type, memory protection, and virtual and physical memory usage. Selecting a type in the Summary View filters the Details View to just show regions of the selected type. Select Total to show all memory types in the Details View. In order to reduce noise in the output, VMMap does not show entries that have a value of 0.

Both windows include the following columns of information:

Size

Total size of the allocated type or region. For the Summary View and regions in the Details View that do not have reserved areas, this is equal to the maximum amount of physical memory required to store the region's data.

Committed

The amount of the allocation backed by virtual memory.

Total WS

The amount of physical memory assigned to the type or region.

Private WS

The amount of physical memory assigned to the type or region that cannot be shared with other processes.

Shareable WS

The amount of physical memory assigned to the type or region that can be shared with other processes.

Shared WS

The amount of Shareable WS that is currently shared with other processes.

Largest
The largest block of the particular size.

Note: Because of limitations in the APIs provided by the operating system, on 64-bit Windows XP or 64-bit Windows Server 2003, Vmmap does not show the regions corresponding to 32-bit thread stacks when analyzing 32-bit processes.


Strings

In some cases, the purpose of a memory region can be revealed by the string data stored within it. To view printable strings (ASCII or UNICODE strings of three or more characters in length), select a region and then the Strings menu item from the Edit menu.


Refreshing a Scan

You can refresh a scan by hitting F5 or selecting Refresh from the Refresh Menu. The Empty Working Set menu item in the Refresh menu releases all physical memory assigned to the process and then refreshes the scan. This feature is useful for measuring the memory cost of an application feature where you would empty the working set, exercise the feature and then refresh the display to look at how much physical memory the application referenced.


Viewing Changes

VMMap saves the two most recent refresh snapshots and allows you to view the differences by selecting the Show Changes entry in the Options menu. When you toggle to that mode, the status bar shows the times of the refreshes being compared and the summary and details lists shows the differences between them. VMMap shows address ranges that are in the most recent snaphot but not the previous one with a green highlight color and those that were deleted in red. You can toggle back to viewing the statistics of the most recent snapshot by deselecting the option.


Options

The options menu contains the following items:

  • Expand All This expands all memory regions in the Details View

  • Collapse All This collapses all memory regions in the Details View

  • Show Free Regions Selecting this causes Details View to include free memory regions

  • Font Use this to change the font of the Summary and Details Views.


Saving, Loading and Copying

Saving and Loading Scan Results

The Save menu item in the File menu includes several ways to save output from a VMMap scan. The Save dialog has options for the following output format:

  • .MMP This is the native VMMap file format. Use this format if you want to load the output back into the VMMap display.

  • .CSV This is comma-seperated value output, which is ideal for generating output that you can easily import into Excel.

  • .TXT This format is ideal for sharing the text form of scan results in a readable form.

Note that a saved .MMP file includes the two most recent snapshots, enabling you to view differences with the Refresh Shows Changes option when you load the file back into VMMap.

Copying

The Edit menu includes two selections for copying output to the clipboard

  • Copy Address This menu item copies just the address of the currently selected line in the Details View.

  • Copy All This copies the text from the display, including the process name and ID, Summary View and Details View.


Command Line Options

VMMap supports the following command-line options:

usage: vmmap [-p <pid or process name> [outputfile]]

-p | Process ID or process name. If you specify a name, VMMap will match it against the first process that has a name that begins with the specified text.
output file | If you specify an output file, VMMap will scan the target process and then terminate. If you don't include an extension, VMMap will add .mmp and save in its native format. Add a .csv extension to save as CSV format; any other extension will save as .txt.