Not a kernel guy » /LARGEADDRESSAWARE ?????????? ?????????????????? ?????? ???????? ????????.

Tue, 06 Mar 2007 22:39:40 GMT

PingBack from http://blog.not-a-kernel-guy.com/2007/03/06/156

Be Aware: 4GB of VAS under WOW, does it really worth it?

Slava Oks's WebLog — Mon, 13 Mar 2006 03:18:58 GMT

By now you have heard a lot about the fact that under WOW a 32 bit process can get 4GB of VAS.&nbsp;&nbsp;...

When new features expose old bugs.

Larry Osterman's WebLog — Mon, 06 Jun 2005 18:36:11 GMT

Not quite "Riffing on Raymond" but he just wrote about this, and it reminded me of a story that was related...

The story of the 3GB server switch

Savage Nomads — Fri, 20 Aug 2004 20:45:00 GMT

  As Evan already mentioned on his blog, Raymond Chen has a great series on /3GB switch on his blog. What is really cool is that Raymond takes on some myths about the /3GB switch and  the fact that he...

re: Myth: The /3GB switch expands the user-mode address space of all programs

DrPizza — Tue, 17 Aug 2004 18:56:00 GMT

"I've got office installed. Here's an example of an app (Notepad) that has the open file common dialog up:"
Office 2000? That's the one that's currently plonking a library in the middle of my address space.

"I really don't see where you are getting this idea that virtually process has lots and lots of rebased dlls. "
I didn't say it did. I said that every system has some rebased DLLs. Windows 2000's msi.dll seems to be consistently rebased, for example.

re: Myth: The /3GB switch expands the user-mode address space of all programs

Skywing — Tue, 17 Aug 2004 18:33:00 GMT

I've got office installed. Here's an example of an app (Notepad) that has the open file common dialog up:

0:004> lm t
start end module name
009d0000 009df000 Vxdif Timestamp: Tue Nov 19 08:34:44 2002 (3DDA3DF4) Checksum: 00000000
01000000 01014000 notepad Timestamp: Tue Mar 25 02:10:14 2003 (3E8000D6) Checksum: 000123BB
10000000 10112000 Apoint Timestamp: Thu Nov 28 01:05:09 2002 (3DE5B215) Checksum: 00000000
60970000 60979000 mslbui Timestamp: Tue Mar 25 04:46:43 2003 (3E802583) Checksum: 000112FE
70ad0000 70bb6000 COMCTL32 Timestamp: Tue Mar 25 04:43:33 2003 (3E8024C5) Checksum: 000E7161
71b70000 71ba3000 UxTheme Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 000340A1
71bf0000 71bf8000 WS2HELP Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 0000B6AB
71c00000 71c18000 WS2_32 Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00022613
71c40000 71c93000 NETAPI32 Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00058483
73070000 73096000 WINSPOOL Timestamp: Tue Mar 25 04:43:17 2003 (3E8024B5) Checksum: 0002C96E
744f0000 7453b000 MSCTF Timestamp: Tue Mar 25 04:43:07 2003 (3E8024AB) Checksum: 00053F50
75970000 75a2a000 USERENV Timestamp: Tue Mar 25 04:42:58 2003 (3E8024A2) Checksum: 000C15AA
75e60000 75e82000 appHelp Timestamp: Tue Mar 25 04:42:57 2003 (3E8024A1) Checksum: 0002A1FE
75eb0000 75fb6000 browseui Timestamp: Thu Jul 08 19:25:07 2004 (40EDE5E3) Checksum: 00106684
762b0000 762f7000 comdlg32 Timestamp: Tue Mar 25 04:42:55 2003 (3E80249F) Checksum: 0004C19F
76300000 76514000 msi Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 002140A0
765a0000 766a0000 SETUPAPI Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 000FE0F9
768f0000 76914000 ntshrui Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 0002A48F
76920000 76a77000 shdocvw Timestamp: Thu Jul 08 19:25:08 2004 (40EDE5E4) Checksum: 0015E185
76f90000 7700e000 CLBCatQ Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000837A0
77010000 770d6000 COMRes Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 000C4402
770e0000 7715d000 OLEAUT32 Timestamp: Tue Mar 25 04:42:48 2003 (3E802498) Checksum: 0007D084
77160000 77285000 ole32 Timestamp: Mon Mar 15 22:08:56 2004 (40566FC8) Checksum: 00129304
77290000 772d9000 SHLWAPI Timestamp: Thu Jul 08 19:25:08 2004 (40EDE5E4) Checksum: 000521B7
77380000 77b5e000 SHELL32 Timestamp: Wed May 12 19:07:37 2004 (40A2BC49) Checksum: 007CC594
77b90000 77b98000 VERSION Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0000CD51
77ba0000 77bf4000 msvcrt Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0005D4DB
77c00000 77c44000 GDI32 Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 00042EEA
77c50000 77cf5000 RPCRT4 Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000A240C
77d00000 77d8f000 USER32 Timestamp: Wed Aug 06 16:43:59 2003 (3F31769F) Checksum: 0008FBF9
77da0000 77e30000 ADVAPI32 Timestamp: Tue Mar 25 04:42:45 2003 (3E802495) Checksum: 00097775
77e40000 77f34000 kernel32 Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000F488C
77f40000 77ffa000 ntdll Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000B6DBA

Of all these dlls, there is exactly *one* that got rebased - Vxdif.dll, a third party hook dll that nobody bothered to move from 10000000.

We can also take a look at the example you suggested, Word itself:

0:007> lm t
start end module name
01830000 0183f000 Vxdif Timestamp: Tue Nov 19 08:34:44 2002 (3DDA3DF4) Checksum: 00000000
06470000 06582000 Apoint Timestamp: Thu Nov 28 01:05:09 2002 (3DE5B215) Checksum: 00000000
10000000 1005b000 SKCHUI Timestamp: Wed Feb 07 04:09:58 2001 (3A8110E6) Checksum: 00064FB0
30000000 30a4b000 WINWORD Timestamp: Thu Jan 15 19:11:23 2004 (40072C2B) Checksum: 00A2652E
30b00000 3145e000 mso Timestamp: Thu Jan 29 18:35:38 2004 (401998CA) Checksum: 0096240E
32520000 32532000 msohev Timestamp: Mon Feb 12 20:42:31 2001 (3A889107) Checksum: 00019384
34eb0000 34ec9000 ENVELOPE Timestamp: Mon Oct 13 13:27:06 2003 (3F8AEE7A) Checksum: 00022B91
35190000 351a1000 SENDTO Timestamp: Sat Feb 17 18:07:46 2001 (3A8F0442) Checksum: 00017F65
35230000 35236000 envelopr Timestamp: Mon Feb 26 20:14:11 2001 (3A9AFF63) Checksum: 0000D65D
3c640000 3c666000 FNAME Timestamp: Mon Oct 13 13:37:06 2003 (3F8AF0D2) Checksum: 0002A014
3c740000 3c77d000 MOFL Timestamp: Mon Oct 13 13:38:00 2003 (3F8AF108) Checksum: 000452FB
3e000000 3e0f1000 srintl Timestamp: Mon Dec 18 19:01:54 2000 (3A3EA572) Checksum: 00000000
3f000000 3f015000 MSSPELL3 Timestamp: Fri Feb 15 19:26:07 2002 (3C6DA71F) Checksum: 0001FBD2
3f100000 3f431000 MSGR3EN Timestamp: Fri Nov 03 23:39:13 2000 (3A0392F1) Checksum: 003311A0
48000000 4807d000 riched20 Timestamp: Mon Sep 15 14:32:10 2003 (3F6613BA) Checksum: 00085FD7
5bc50000 5bc88000 sptip Timestamp: Tue Mar 25 04:46:57 2003 (3E802591) Checksum: 00039F23
5cc10000 5ccbe000 sapi Timestamp: Tue Mar 25 04:46:02 2003 (3E80255A) Checksum: 000B7437
60970000 60979000 mslbui Timestamp: Tue Mar 25 04:46:43 2003 (3E802583) Checksum: 000112FE
64e30000 64e6d000 icm32 Timestamp: Tue Mar 25 04:45:11 2003 (3E802527) Checksum: 0004571F
6e210000 6e254000 CNBJUI2 Timestamp: Tue Mar 25 04:45:56 2003 (3E802554) Checksum: 0004AF41
6e2c0000 6e2dd000 CNBJDRV2 Timestamp: Tue Mar 25 04:45:53 2003 (3E802551) Checksum: 0002A634
70ad0000 70bb6000 comctl32 Timestamp: Tue Mar 25 04:43:33 2003 (3E8024C5) Checksum: 000E7161
70bc0000 70c50000 COMCTL32_70bc0000 Timestamp: Tue Mar 25 04:43:33 2003 (3E8024C5) Checksum: 00096B96
71640000 71805000 AcGenral Timestamp: Tue Mar 25 04:43:30 2003 (3E8024C2) Checksum: 001CA751
71af0000 71b1a000 ShimEng Timestamp: Tue Mar 25 04:43:27 2003 (3E8024BF) Checksum: 0001C598
71b70000 71ba3000 UxTheme Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 000340A1
71bf0000 71bf8000 WS2HELP Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 0000B6AB
71c00000 71c18000 WS2_32 Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00022613
71c20000 71c31000 tsappcmp Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 0001A640
71c40000 71c93000 NETAPI32 Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00058483
72e50000 72f9a000 msxml3 Timestamp: Tue Mar 25 04:43:17 2003 (3E8024B5) Checksum: 0015153E
73070000 73096000 winspool Timestamp: Tue Mar 25 04:43:17 2003 (3E8024B5) Checksum: 0002C96E
73aa0000 73ab4000 mscms Timestamp: Tue Mar 25 04:43:12 2003 (3E8024B0) Checksum: 0001D328
73b30000 73b36000 dciman32 Timestamp: Tue Mar 25 04:43:12 2003 (3E8024B0) Checksum: 0000E248
744c0000 744e8000 msimtf Timestamp: Tue Mar 25 04:43:08 2003 (3E8024AC) Checksum: 000290E4
744f0000 7453b000 MSCTF Timestamp: Tue Mar 25 04:43:07 2003 (3E8024AB) Checksum: 00053F50
74540000 745d2000 mlang Timestamp: Tue Mar 25 04:43:06 2003 (3E8024AA) Checksum: 00091197
74a80000 74aaf000 OLEACC Timestamp: Tue Mar 25 04:43:05 2003 (3E8024A9) Checksum: 00036548
75970000 75a2a000 USERENV Timestamp: Tue Mar 25 04:42:58 2003 (3E8024A2) Checksum: 000C15AA
75da0000 75e5a000 SXS Timestamp: Tue Mar 25 04:42:57 2003 (3E8024A1) Checksum: 000C0304
75e60000 75e82000 appHelp Timestamp: Tue Mar 25 04:42:57 2003 (3E8024A1) Checksum: 0002A1FE
75eb0000 75fb6000 browseui Timestamp: Thu Jul 08 19:25:07 2004 (40EDE5E3) Checksum: 00106684
75fc0000 76048000 urlmon Timestamp: Thu Jul 08 19:25:08 2004 (40EDE5E4) Checksum: 000881F2
76260000 76270000 WINSTA Timestamp: Tue Mar 25 04:42:55 2003 (3E80249F) Checksum: 00016513
76290000 762ad000 imm32 Timestamp: Tue Mar 25 04:42:55 2003 (3E80249F) Checksum: 0002809C
762b0000 762f7000 comdlg32 Timestamp: Tue Mar 25 04:42:55 2003 (3E80249F) Checksum: 0004C19F
76300000 76514000 msi Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 002140A0
76520000 7653d000 CSCDLL Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 0001D865
76540000 76590000 cscui Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 00051C4C
765a0000 766a0000 SETUPAPI Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 000FE0F9
766d0000 766d9000 SHFOLDER Timestamp: Tue Mar 25 04:42:53 2003 (3E80249D) Checksum: 0000FE87
767a0000 767d5000 UNIDRVUI Timestamp: Tue Mar 25 04:42:53 2003 (3E80249D) Checksum: 000338C4
767e0000 76823000 UNIDRV Timestamp: Tue Mar 25 04:42:53 2003 (3E80249D) Checksum: 00048FF4
768e0000 768e8000 LINKINFO Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 0000C1C0
768f0000 76914000 ntshrui Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 0002A48F
76920000 76a77000 shdocvw Timestamp: Thu Jul 08 19:25:08 2004 (40EDE5E4) Checksum: 0015E185
76aa0000 76acc000 WINMM Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 000384CD
76f00000 76f08000 wtsapi32 Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 000053F6
76f50000 76f63000 Secur32 Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 0001508D
76f90000 7700e000 CLBCatQ Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000837A0
77010000 770d6000 COMRes Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 000C4402
770e0000 7715d000 OLEAUT32 Timestamp: Tue Mar 25 04:42:48 2003 (3E802498) Checksum: 0007D084
77160000 77285000 OLE32 Timestamp: Mon Mar 15 22:08:56 2004 (40566FC8) Checksum: 00129304
77290000 772d9000 SHLWAPI Timestamp: Thu Jul 08 19:25:08 2004 (40EDE5E4) Checksum: 000521B7
77380000 77b5e000 SHELL32 Timestamp: Wed May 12 19:07:37 2004 (40A2BC49) Checksum: 007CC594
77b70000 77b84000 MSACM32 Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 00013E94
77b90000 77b98000 VERSION Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0000CD51
77ba0000 77bf4000 msvcrt Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0005D4DB
77c00000 77c44000 GDI32 Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 00042EEA
77c50000 77cf5000 RPCRT4 Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000A240C
77d00000 77d8f000 USER32 Timestamp: Wed Aug 06 16:43:59 2003 (3F31769F) Checksum: 0008FBF9
77da0000 77e30000 ADVAPI32 Timestamp: Tue Mar 25 04:42:45 2003 (3E802495) Checksum: 00097775
77e40000 77f34000 kernel32 Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000F488C
77f40000 77ffa000 ntdll Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000B6DBA
780c0000 78121000 MSVCP60 Timestamp: Wed May 29 16:00:05 2002 (3CF54155) Checksum: 0006243E

Two dlls got rebased here, Apoint.dll and Vxdif.dll. Coincidentally, both were left at the 10000000 base address.

I really don't see where you are getting this idea that virtually process has lots and lots of rebased dlls.

re: Myth: The /3GB switch expands the user-mode address space of all programs

DrPizza — Tue, 17 Aug 2004 15:47:00 GMT

"That's a good enough reason for me. Feel free to do your own research if you don't agree, of course, but my own experience tells me that you're making a big deal out of nothing. "
Every (modern, at least) Windows version has rebased DLLs *out of the box*.

Your experience is *wrong* if it says that rebasing is at all rare.

The top 500-odd MB are off-limits due to system .dlls. The bottom 250 off-limits due to the application and its .dlls. Then we have things like Explorer's Shell/namespace extensions which load in a scattergun approach; Office, for example, loading at about 750 MB. "But why would they load into your application?" You ask. Simple, really--they get dragged into any process that uses a common file dialogue.

And now you've got less than 1 GiB contiguous address space available. It's not like Office is a niche application to have; it's *quite* widely used....

re: Myth: The /3GB switch expands the user-mode address space of all programs

Skywing — Tue, 17 Aug 2004 14:53:00 GMT

DrPizza: Well, in every single program on every Windows system I've debugged (and that's a lot, probably in the hundreds), what I've said has held true.

That's a good enough reason for me. Feel free to do your own research if you don't agree, of course, but my own experience tells me that you're making a big deal out of nothing.

re: Myth: The /3GB switch expands the user-mode address space of all programs

DrPizza — Tue, 17 Aug 2004 13:36:00 GMT

"Silly question, but why on earth are you specifying base addresses for DLLs anyway? That's what load-time is for."
Because people are vainly trying to avoid their DLLs being rebased, which is bad because Windows doesn't bother sharing the memory of rebased DLLs.

re: Myth: The /3GB switch expands the user-mode address space of all programs

AlisdairM — Tue, 17 Aug 2004 13:08:00 GMT

At a frequency of 1Hz, "1 in a million" is every 11.6 days, or roughly 3 times per month.

Next Tuesday is sounding closer all the time...