All geek questions in one place

What <classified> means in windbg output!

Example:

 0:074> !address -summary --- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal Free 90919 7ec`34659000 ( 7.923 Tb) 99.03% <unclassified> 95426 12`3c3e9000 ( 72.941 Gb) 92.12% 0.89% Heap 744 1`7ee50000 ( 5.983 Gb) 7.56% 0.07% Image 4303 0`0f890000 ( 248.563 Mb) 0.31% 0.00% Stack 225 0`00de9000 ( 13.910 Mb) 0.02% 0.00% TEB 75 0`00096000 ( 600.000 kb) 0.00% 0.00% ActivationContextData 28 0`00025000 ( 148.000 kb) 0.00% 0.00% NlsTables 1 0`00023000 ( 140.000 kb) 0.00% 0.00% CsrSharedMemory 1 0`00006000 ( 24.000 kb) 0.00% 0.00% PEB 1 0`00001000 ( 4.000 kb) 0.00% 0.00%
+4
source share
2 answers

Hmmm, this is a wild hunch, but anything that might take up VA space that isn't on this list directly calls VirtualAlloc or memory mapped files. VMMap may be more useful here.

+1
source

<unclassified> intended for allocations that are not further monitored by other memory managers and therefore allocated through VirtualAlloc() from the perspective of WinDbg. In newer versions of WinDbg, this is called <unknown> .

There are various reasons for classifying memory as follows:

  • direct call to VirtualAlloc() course
  • through the Windows Heap Manager, the size of which exceeds 512 kb (see the expression of Sasha Goldstein ).
  • the distribution of the .NET runtime (which has its own heaps that are unknown to WinDbg until you use the special SOS extension)
  • some versions of MSXML
  • potential other memory managers, for example. heap manager from Java or Python (just a hunch, I never checked)
+1
source

Source: https://habr.com/ru/post/1300469/

More articles:


All Articles