Virtual and Physical Memory
The engine provides a number of methods for reading and writing the virtual and physical memory of a target.
Virtual Memory
When specifying a location in the virtual memory of a target, the target’s virtual address space is used. In user-mode debugging, this is the virtual address space of the current process. In kernel-mode debugging, this is the virtual address space of the implicit process. See Threads and Processes for more information about the current and implicit process.
The virtual memory (of the target) can be read by using ReadVirtual and written using WriteVirtual.
Pointers in the target’s memory can be read and written by using the convenience methods ReadPointersVirtual and WritePointersVirtual. These methods will automatically convert between the 64-bit pointers used by the engine and the native pointers used by the target. These methods are useful when requesting memory that contains pointers that will be used for subsequent requests — for example, a pointer to a string.
The SearchVirtual and SearchVirtual2 methods can be used to search the target’s virtual memory for a pattern of bytes.
The FillVirtual method can be used to copy a pattern of bytes, multiple times, to the target’s virtual memory.
The target’s virtual memory can also be read and written in a way that bypasses the debugger engine’s virtual memory cache using the methods ReadVirtualUncached and WriteVirtualUncached. These uncached versions are useful for reading virtual memory that is inherently volatile, such as memory-mapped device areas, without contaminating or invalidating the cache. Uncached memory access should only be used in situations when it is required, as the performance of uncached access can be significantly lower than cached access.
The engine provides some convenience methods to read strings from the target’s virtual memory. To read a multibyte string from the target, use ReadMultiByteStringVirtual and ReadMultiByteStringVirtualWide. To read a Unicode string from the target, use ReadUnicodeStringVirtual and ReadUnicodeStringVirtualWide.
To find information about a memory location, use GetOffsetInformation. Not all of the virtual address space in the target contains valid memory. To find valid memory within a region, use GetValidRegionVirtual. When manually searching for valid memory in a target, the method GetNextDifferentlyValidOffsetVirtual will find the next location where the validity may change.
Physical Memory
The physical memory can only be directly accessed in kernel-mode debugging.
The FillPhysical method can be used to copy a pattern of bytes, multiple times, to the target’s physical memory.
An address in the target’s virtual address space can be translated to a physical address on the target by using the VirtualToPhysical method. The system’s paging structures used to translate a virtual address to a physical address can be found by using GetVirtualTranslationPhysicalOffsets.
Events
When the virtual or physical memory of the target is changed, the IDebugEventCallbacks::ChangeDebuggeeState callback method is called.
Win32_PhysicalMemory class
The Win32_PhysicalMemory WMI class represents a physical memory device located on a computer system and available to the operating system.
The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties are listed in alphabetic order, not MOF order.
Syntax
Members
The Win32_PhysicalMemory class has these types of members:
Properties
The Win32_PhysicalMemory class has these properties.
Attributes
Data type: uint32
Access type: Read-only
SMBIOS — Type 17 — Attributes. Represents the RANK.
This value comes from the Attributes member of the Memory Device structure in the SMBIOS information.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
BankLabel
Data type: string
Access type: Read-only
Physically labeled bank where the memory is located.
Examples: «Bank 0», «Bank A»
This value comes from the Bank Locator member of the Memory Device structure in the SMBIOS information.
Capacity
Data type: uint64
Access type: Read-only
Total capacity of the physical memory—in bytes.
This value comes from the Memory Device structure in the SMBIOS version information. For SMBIOS versions 2.1 thru 2.6 the value comes from the Size member. For SMBIOS version 2.7+ the value comes from the Extended Size member.
For more information about using uint64 values in scripts, see Scripting in WMI.
Caption
Data type: string
Access type: Read-only
Short description of the object—a one-line string.
ConfiguredClockSpeed
Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings («SMBIOS|Type 17|Configured Memory Clock Speed»)
The configured clock speed of the memory device, in megahertz (MHz), or 0, if the speed is unknown.
This value comes from the Configured Memory Clock Speed member of the Memory Device structure in the SMBIOS information.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
ConfiguredVoltage
Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings («SMBIOS|Type 17|Configured voltage»)
Configured voltage for this device, in millivolts, or 0, if the voltage is unknown.
This value comes from the Configured voltage member of the Memory Device structure in the SMBIOS information.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
CreationClassName
Data type: string
Access type: Read-only
Name of the first concrete class that appears in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, the property allows all instances of this class and its subclasses to be identified uniquely.
DataWidth
Data type: uint16
Access type: Read-only
Data width of the physical memory—in bits. A data width of 0 (zero) and a total width of 8 (eight) indicates that the memory is used solely to provide error correction bits.
This value comes from the Data Width member of the Memory Device structure in the SMBIOS information.
Description
Data type: string
Access type: Read-only
Description of an object.
DeviceLocator
Data type: string
Access type: Read-only
Label of the socket or circuit board that holds the memory.
This value comes from the Device Locator member of the Memory Device structure in the SMBIOS information.
FormFactor
Data type: uint16
Access type: Read-only
Implementation form factor for the chip.
This value comes from the Form Factor member of the Memory Device structure in the SMBIOS information.
This property is inherited from CIM_Chip.
HotSwappable
Data type: boolean
Access type: Read-only
If TRUE, this physical media component can be replaced with a physically different but equivalent one while the containing package has the power applied. For example, a fan component may be designed to be hot-swapped. All components that can be hot-swapped are inherently removable and replaceable.
InstallDate
Data type: datetime
Access type: Read-only
Date and time the object is installed. This property does not need a value to indicate that the object is installed.
InterleaveDataDepth
Data type: uint16
Access type: Read-only
Qualifiers: MappingStrings («SMBIOS|Type 20|Interleaved Data Depth»)
Unsigned 16-bit integer maximum number of consecutive rows of data that are accessed in a single interleaved transfer from the memory device. If the value is 0 (zero), the memory is not interleaved.
InterleavePosition
Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings («MIF.DMTF|Memory Device Mapped Addresses|001.7»)
Position of the physical memory in an interleave. For example, in a 2:1 interleave, a value of «1» indicates that the memory is in the «even» position.
Manufacturer
Data type: string
Access type: Read-only
Name of the organization responsible for producing the physical element.
This value comes from the Manufacturer member of the Memory Device structure in the SMBIOS information.
MaxVoltage
Data type: uint32
Access type: Read-only
The maximum operating voltage for this device, in millivolts, or 0, if the voltage is unknown.
This value comes from the Maximum voltage member of the Memory Device structure in the SMBIOS information.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
MemoryType
Data type: uint16
Access type: Read-only
Type of physical memory. This is a CIM value that is mapped to the SMBIOS value. The SMBIOSMemoryType property contains the raw SMBIOS memory type.
This value comes from the Memory Type member of the Memory Device structure in the SMBIOS information.
Unknown (0)
Other (1)
DRAM (2)
Synchronous DRAM (3)
Cache DRAM (4)
EDO (5)
EDRAM (6)
VRAM (7)
SRAM (8)
RAM (9)
ROM (10)
Flash (11)
EEPROM (12)
FEPROM (13)
EPROM (14)
CDRAM (15)
3DRAM (16)
SDRAM (17)
SGRAM (18)
RDRAM (19)
DDR (20)
DDR2 (21)
DDR2—May not be available.
DDR2 FB-DIMM (22)
DDR2—FB-DIMM,May not be available.
DDR3—May not be available.
DDR4 (26)
MinVoltage
Data type: uint32
Access type: Read-only
The minimum operating voltage for this device, in millivolts, or 0, if the voltage is unknown.
This value comes from the Minimum voltage member of the Memory Device structure in the SMBIOS information.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
Model
Data type: string
Access type: Read-only
Name for the physical element.
Name
Data type: string
Access type: Read-only
Label for the object. When subclassed, the property can be overridden to be a key property.
OtherIdentifyingInfo
Data type: string
Access type: Read-only
Additional data, beyond asset tag information, that can be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. If only bar code data is available and unique or able to be used as an element key, this property is be NULL and the bar code data is used as the class key in the tag property.
PartNumber
Data type: string
Access type: Read-only
Part number assigned by the organization responsible for producing or manufacturing the physical element.
This value comes from the Part Number member of the Memory Device structure in the SMBIOS information.
PositionInRow
Data type: uint32
Access type: Read-only
Qualifiers: MappingStrings («MIF.DMTF|Memory Device Mapped Addresses|001.6»)
Position of the physical memory in a row. For example, if it takes two 8-bit memory devices to form a 16-bit row, then a value of 2 (two) means that this memory is the second device—0 (zero) is an invalid value for this property.
PoweredOn
Data type: boolean
Access type: Read-only
If TRUE, the physical element is powered on.
Removable
Data type: boolean
Access type: Read-only
If TRUE, a physical component is removable (if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging). A component can still be removable if power must be «off» to perform the removal. If power can be «on» and the component removed, then the element is removable and can be hot-swapped. For example, an upgradable processor chip is removable.
Replaceable
Data type: boolean
Access type: Read-only
If TRUE, this physical media component can be replaced with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable. All removable components are inherently replaceable.
SerialNumber
Data type: string
Access type: Read-only
Manufacturer-allocated number to identify the physical element.
This value comes from the Serial Number member of the Memory Device structure in the SMBIOS information.
SKU
Data type: string
Access type: Read-only
Stock keeping unit number for the physical element.
SMBIOSMemoryType
Data type: uint32
Access type: Read-only
The raw SMBIOS memory type. The value of the MemoryType property is a CIM value that is mapped to the SMBIOS value.
Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported before Windows ServerВ 2016 and WindowsВ 10.
Speed
Data type: uint32
Access type: Read-only
Speed of the physical memory—in nanoseconds.
This value comes from the Speed member of the Memory Device structure in the SMBIOS information.
Status
Data type: string
Access type: Read-only
Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: «OK», «Degraded», and «Pred Fail» (an element, such as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in the near future). Nonoperational statuses include: «Error», «Starting», «Stopping», and «Service». The latter, «Service», could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, yet the managed element is neither «OK» nor in one of the other states.
The possible values are.
OK («OK»)
Error («Error»)
Degraded («Degraded»)
Unknown («Unknown»)
Pred Fail («Pred Fail»)
Starting («Starting»)
Stopping («Stopping»)
Service («Service»)
Stressed («Stressed»)
NonRecover («NonRecover»)
No Contact («No Contact»)
Lost Comm («Lost Comm»)
Tag
Data type: string
Access type: Read-only
Unique identifier for the physical memory device that is represented by an instance of Win32_PhysicalMemory. This property is inherited from CIM_PhysicalElement.
Example: «Physical Memory 1»
TotalWidth
Data type: uint16
Access type: Read-only
Total width, in bits, of the physical memory, including check or error correction bits. If there are no error correction bits, the value in this property should match what is specified for the DataWidth property.
This value comes from the Total Width member of the Memory Device structure in the SMBIOS information.
TypeDetail
Data type: uint16
Access type: Read-only
Type of physical memory represented.
This value comes from the Type Detail member of the Memory Device structure in the SMBIOS information.
Reserved (1)
Other (2)
Unknown (4)
Fast-paged (8)
Static column (16)
Pseudo-static (32)
RAMBUS (64)
Synchronous (128)
CMOS (256)
EDO (512)
Window DRAM (1024)
Cache DRAM (2048)
Non-volatile (4096)
Version
Data type: string
Access type: Read-only
Version of the physical element.
Remarks
The Win32_PhysicalMemory class is derived from CIM_PhysicalMemory.
Examples
The Get-ComputerInfo — Query Computer Info From Local/Remote Computers — (WMI) PowerShell sample on TechNet Gallery uses a number of calls to hardware and software, including Win32_PhysicalMemory, to display information about a local or remote system.
The Server Report PowerShell sample on TechNet gallery uses a number of calls to hardware and software, including Win32_PhysicalMemory, to gather server information and publish in Word document.
The following PowerShell code sample retrieves information regarding the physical memory of the local computer.
