Virtual and Physical Memory

The engine provides a number of methods for reading and writing the virtual and physical memory of a target.

Virtual Memory

When specifying a location in the virtual memory of a target, the target’s virtual address space is used. In user-mode debugging, this is the virtual address space of the current process. In kernel-mode debugging, this is the virtual address space of the implicit process. See Threads and Processes for more information about the current and implicit process.

The virtual memory (of the target) can be read by using ReadVirtual and written using WriteVirtual.

Pointers in the target’s memory can be read and written by using the convenience methods ReadPointersVirtual and WritePointersVirtual. These methods will automatically convert between the 64-bit pointers used by the engine and the native pointers used by the target. These methods are useful when requesting memory that contains pointers that will be used for subsequent requests — for example, a pointer to a string.

The SearchVirtual and SearchVirtual2 methods can be used to search the target’s virtual memory for a pattern of bytes.

The FillVirtual method can be used to copy a pattern of bytes, multiple times, to the target’s virtual memory.

The target’s virtual memory can also be read and written in a way that bypasses the debugger engine’s virtual memory cache using the methods ReadVirtualUncached and WriteVirtualUncached. These uncached versions are useful for reading virtual memory that is inherently volatile, such as memory-mapped device areas, without contaminating or invalidating the cache. Uncached memory access should only be used in situations when it is required, as the performance of uncached access can be significantly lower than cached access.

The engine provides some convenience methods to read strings from the target’s virtual memory. To read a multibyte string from the target, use ReadMultiByteStringVirtual and ReadMultiByteStringVirtualWide. To read a Unicode string from the target, use ReadUnicodeStringVirtual and ReadUnicodeStringVirtualWide.

To find information about a memory location, use GetOffsetInformation. Not all of the virtual address space in the target contains valid memory. To find valid memory within a region, use GetValidRegionVirtual. When manually searching for valid memory in a target, the method GetNextDifferentlyValidOffsetVirtual will find the next location where the validity may change.

Physical Memory

The physical memory can only be directly accessed in kernel-mode debugging.

The FillPhysical method can be used to copy a pattern of bytes, multiple times, to the target’s physical memory.

An address in the target’s virtual address space can be translated to a physical address on the target by using the VirtualToPhysical method. The system’s paging structures used to translate a virtual address to a physical address can be found by using GetVirtualTranslationPhysicalOffsets.

Events

When the virtual or physical memory of the target is changed, the IDebugEventCallbacks::ChangeDebuggeeState callback method is called.

Win32_PhysicalMemoryArray class

The Win32_PhysicalMemoryArray WMI class represents details about the computer system physical memory. This includes the number of memory devices, memory capacity available, and memory type—for example, system or video memory.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

Members

The Win32_PhysicalMemoryArray class has these types of members:

Methods

The Win32_PhysicalMemoryArray class has these methods.

Method	Description
IsCompatible	Not implemented.

Properties

The Win32_PhysicalMemoryArray class has these properties.

Caption

Data type: string

Access type: Read-only

Short description of the object—a one-line string.

CreationClassName

Data type: string

Access type: Read-only

Name of the first concrete class that appears in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, the property allows all instances of this class and its subclasses to be identified uniquely.

Depth

Data type: real32

Access type: Read-only

Depth of the physical package—in inches.

Description

Data type: string

Access type: Read-only

Description of the object.

Height

Data type: real32

Access type: Read-only

Height of the physical package—in inches.

HotSwappable

Data type: boolean

Access type: Read-only

If TRUE, a physical package can be hot-swapped (if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it, is «on»). For example, a disk drive package inserted using SCA connectors is removable and can be hot-swapped. All packages that can be hot-swapped are inherently removable and replaceable.

InstallDate

Data type: datetime

Access type: Read-only

Date and time the object was installed. This property does not need a value to indicate that the object is installed.

Location

Data type: uint16

Access type: Read-only

Physical location of the memory array.

This value comes from the Location member of the Physical Memory Array structure in the SMBIOS information.

Reserved (0)

Other (1)

Unknown (2)

System board or motherboard (3)

ISA add-on card (4)

EISA add-on card (5)

PCI add-on card (6)

MCA add-on card (7)

PCMCIA add-on card (8)

Proprietary add-on card (9)

NuBus (10)

PC-98/C20 add-on card (11)

PC-98/C24 add-on card (12)

PC-98/E add-on card (13)

PC-98/Local bus add-on card (14)

Manufacturer

Data type: string

Access type: Read-only

Name of the organization responsible for producing the physical element.

MaxCapacity

Data type: uint32

Access type: Read-only

Use the MaxCapacityEx property instead.

This value comes from the Maximum Capacity member of the Physical Memory Array structure in the SMBIOS information.

Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: Maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0 (zero).

MaxCapacityEx

Data type: uint64

Access type: Read-only

Maximum memory size (in kilobytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0 (zero).

This value comes from the Extended Maximum Capacity member of the Physical Memory Array structure in the SMBIOS information.

Windows ServerВ 2012В R2, WindowsВ 8.1, Windows ServerВ 2012, WindowsВ 8, Windows ServerВ 2008В R2, WindowsВ 7, Windows ServerВ 2008 and WindowsВ Vista: This property is not supported.

MemoryDevices

Data type: uint16

Access type: Read-only

Qualifiers: MappingStrings («SMBIOS|Type 16|Number of Memory Devices»)

Number of physical slots or sockets available in this memory array.

This value comes from the Number of Memory Devices member of the Physical Memory Array structure in the SMBIOS information.

MemoryErrorCorrection

Data type: uint16

Access type: Read-only

Qualifiers: MappingStrings («SMBIOS|Type 16|Memory Error Correction»)

Type of error correction used by the memory array.

This value comes from the Memory Error Correction member of the Physical Memory Array structure in the SMBIOS information.

Reserved (0)

Other (1)

Unknown (2)

None (3)

Parity (4)

Single-bit ECC (5)

Multi-bit ECC (6)

CRC (7)

Model

Data type: string

Access type: Read-only

Name by which the physical element is generally known.

Name

Data type: string

Access type: Read-only

Label by which the object is known. When subclassed, the property can be overridden to be a key property.

OtherIdentifyingInfo

Data type: string

Access type: Read-only

Additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. Note that if only bar code data is available and is unique or able to be used as an element key, this property would be NULL and the bar code data used as the class key, in the tag property.

PartNumber

Data type: string

Access type: Read-only

Part number assigned by the organization responsible for producing or manufacturing the physical element.

PoweredOn

Data type: boolean

Access type: Read-only

If TRUE, the physical element is powered on.

Removable

Data type: boolean

Access type: Read-only

If TRUE, a physical package is removable (if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging). A package can still be removable if power must be «off» to perform the removal. If power can be «on» and the package removed, then the element is removable and can be hot-swapped. For example, an extra battery in a laptop is removable, as is a disk drive package inserted using SCA connectors. However, the latter can be hot-swapped. A laptop’s display is not removable, nor is a nonredundant power supply. Removing these components would affect the function of the overall packaging or is impossible due to the tight integration of the package.

Replaceable

Data type: boolean

Access type: Read-only

If TRUE, this physical media component can be replaced with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable. Another example is a power supply package mounted on sliding rails. All removable packages are inherently replaceable.

SerialNumber

Data type: string

Access type: Read-only

Manufacturer-allocated number used to identify the physical element.

SKU

Data type: string

Access type: Read-only

Stockkeeping unit number for the physical element.

Status

Data type: string

Access type: Read-only

Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: «OK», «Degraded», and «Pred Fail» (an element, such as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in the near future). Nonoperational statuses include: «Error», «Starting», «Stopping», and «Service». The latter, «Service», could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, yet the managed element is neither «OK» nor in one of the other states.

Values include the following:

OK («OK»)

Error («Error»)

Degraded («Degraded»)

Unknown («Unknown»)

Pred Fail («Pred Fail»)

Starting («Starting»)

Stopping («Stopping»)

Service («Service»)

Stressed («Stressed»)

NonRecover («NonRecover»)

No Contact («No Contact»)

Lost Comm («Lost Comm»)

Tag

Data type: string

Access type: Read-only

Unique identifier of the physical memory array.

Example: «Physical Memory Array 1»

Use

Data type: uint16

Access type: Read-only

How memory is used in the computer system.

This value comes from the Use member of the Physical Memory Array structure in the SMBIOS information.

Reserved (0)

Other (1)

Unknown (2)

System memory (3)

Video memory (4)

Flash memory (5)

Non-volatile RAM (6)

Cache memory (7)

Version

Data type: string

Access type: Read-only

Version of the physical element.

Weight

Data type: real32

Access type: Read-only

Weight of the physical package in pounds.

Width

Data type: real32

Access type: Read-only

Width of the physical package in inches.

Remarks

The Win32_PhysicalMemoryArray class is derived from CIM_PhysicalPackage.

Examples

The following PowerShell sample retrieves the number of memory slots and the amount of memory installed on a target computer.

The following VBScript code sample returns information about the physical memory installed on a computer.