If you attended Fundamentals of Complete Crash and Hang Memory Dump Analysis you probably remember the memory dump visualization question that I repeat here on this slide fragment:
I got a few responses:
“Unfortunately they are not identical - visual inspection shows that. I tried differencing the relevant sub-images in Photoshop and I can’t get zero. Of course this can be due to compression artifacts and, more likely, the fact that the duplication is not required to be aligned to the borders. A stronger confirmation/refutation would require unrolling the bitmap to one dimension and sliding it back and forth until maximum correlation is found. Since I have not done the examples step by step, I am left guessing about just what the dump you show illustrates. An aliased memory mapped area is my first guess, and a flip/flop garbage collector is my second.”
“perhaps some module such as a .NET assembly is getting loaded twice in a .NET app, pre .NET 4, such as is dicsussed in this thread:
http://forum.sysinternals.com/why-some-net-assemblies-are-duplicated-in-memory_topic15279_post121591.html“
Initially I also thought that there was the same module loaded twice from different location like in Duplicated Module pattern. Unfortunately lm command didn’t show any duplicated loaded and unloaded modules as well as any hidden modules. So I looked at address information and found two identical relatively large regions at the beginning:
0:000> !address
[...]
BaseAddress EndAddress+1 RegionSize Type State Protect Usage
[...]
0`00470000 0`007f0000 0`00380000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unclassified>
[…]
0`01f10000 0`02290000 0`00380000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unclassified>
[…]
The image above was scaled by ImageMagic from a bitmap generated by Dump2Picture:
The original image from Dump2Picture had different colors:
I quickly checked the colorimetric structure of those regions: 0`00470000 0`007f0000 and 0`01f10000 0`02290000 using MemPicture WinDbg script and they seem to conform with the magnified picture above:
0:000> $$>a< d:\Dump2Picture\mempicture.txt 0`00470000 L?0`007f0000-0`00470000
Writing 380000 bytes
C:\Program Files\Debugging Tools for Windows (x64)>dump2picture d2p-range.bin d2p-range.bmp
Dump2Picture version 1.1
Written by Dmitry Vostokov, 2007
d2p-range.bmp
d2p-range.bin
1 file(s) copied.
C:\Program Files\Debugging Tools for Windows (x64)>d2p-range.bmp
.shell: Process exited
Here is the magnified slice from the original picture:
We see the same partitioning if we juxtapose the original picture and the picture of the address region:
Also these regions are completely identical if we compare their data:
0:000> c 0`00470000 L?(0`007f0000-0`00470000)/8 0`01f10000
So it looks like some file was mapped twice. Inspected via dc command it shows remarkable regularity not seen in executable modules. This regularity also manifests itself in color:
In order to verify I modeled this by writing a simple program that maps a file twice passed as a command line parameter:
int _tmain(int argc, _TCHAR* argv[])
{
if (argc < 2)
{
puts("Usage: MappedFiles.exe <File_Name_To_Map>\n");
return -1;
}
HANDLE hf = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
HANDLE hm = CreateFileMapping(hf, NULL, PAGE_READONLY, 0, 0, NULL);
MapViewOfFile(hm, FILE_MAP_READ, 0, 0, 0);
hf = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
hm = CreateFileMapping(hf, NULL, PAGE_READONLY, 0, 0, NULL);
MapViewOfFile(hm, FILE_MAP_READ, 0, 0, 0);
DebugBreak();
return 0;
}
I ran it and chose to map explorer.exe because it was a sufficiently large image file:
C:\MappedFiles\Release>MappedFiles.exe c:\windows\explorer.exe
The dump file was saved and its processing shows this picture:
We clearly see identical regions and double check them from the dump file:
0:000> !address
BaseAddr EndAddr+1 RgnSize Type State Protect Usage
[...]
a60000 d1d000 2bd000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unclassified>
d1d000 d20000 3000 MEM_FREE PAGE_NOACCESS Free
d20000 fdd000 2bd000 MEM_MAPPED MEM_COMMIT PAGE_READONLY <unclassified>
[…]
0:000> $$>a< d:\Dump2Picture\mempicture.txt 0`00470000 L?0`007f0000-0`00470000
Writing 380000 bytes
C:\Program Files\Debugging Tools for Windows (x64)>dump2picture d2p-range.bin d2p-range.bmp
Dump2Picture version 1.1
Written by Dmitry Vostokov, 2007
d2p-range.bmp
d2p-range.bin
1 file(s) copied.
C:\Program Files\Debugging Tools for Windows (x64)>d2p-range.bmp
.shell: Process exited
We see the same partitioning if we juxtapose results:
The application can be downloaded from here: MappedFiles.zip
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
May be someone from MS provides some comments what we should expect at the turn of the century? What should I tell my children to expect if they still run the Windows OS?
