Command or Utility Chosen:
VMMap is a process virtual and physical memory analysis utility. It shows a breakdown of a process's committed virtual memory types as well as the amount of physical memory (working set) assigned by the operating system to those types. Besides graphical representations of memory usage, VMMap also shows summary information and a detailed process memory map. Powerful filtering and refresh capabilities allow you to identify the sources of process memory usage and the memory cost of application features.
Besides flexible views for analyzing live processes, VMMap supports the export of data in multiple forms, including a native format that preserves all the information so that you can load back in. It also includes command-line options that enable scripting scenarios.
VMMap is the ideal tool for developers wanting to understand and optimize their application's memory resource usage. (Markruss, 2023)
Reference
Markruss. (n.d.). VMMAP - Sysinternals. VMMap - Sysinternals | Microsoft Learn. https://learn.microsoft.com/en- us/sysinternals/downloads/vmmap
Execution of Command/Utility:
VMMap v3.4
With this utility you can choose a process to analyize. I choose Notepad.exe that was in the taskbar of my PC.
Launching VMMap
-
Open VMMap.exe (from Sysinternals Suite).
-
Select the process you want to analyze (or drag/drop the process executable).
-
VMMap will generate a snapshot of that process’s memory usage.
- Understanding Virtual vs Physical Memory in VMMap
Virtual Memory (Commit/Reserved Space)
-
Definition: Virtual memory is the total address space allocated to the process, whether or not it is physically loaded into RAM.
-
Where to find it in VMMap:
-
In the Summary Table (top half), look under:
-
Committed column → shows the committed (allocated) virtual memory.
-
Reserved column → shows reserved address space not yet committed.
-
-
In the Type Breakdown Table (bottom half), “Virtual Size” also reflects the total virtual address space used by each memory type (Heap, Stack, Image, etc.).
-
Physical Memory (Working Set)
-
Definition: Physical memory represents the portions of the process’s virtual memory that are currently resident in RAM.
-
Where to find it in VMMap:
-
Look at the WS (Working Set) columns in the Summary Table.
-
Private WS – Pages of memory that are unique to this process (not shared).
-
Shareable WS – Pages that can be shared with other processes.
-
Shared WS – Pages that are actually shared with other processes.
-
-
The total of these columns represents the process’s physical memory footprint.
-
Color-Coded View
VMMap uses color-coding to make it easier to distinguish memory types:
-
Green → Heap (allocated memory)
-
Orange → Stack
-
Purple → Image (modules/DLLs)
-
Light blue → Mapped files
-
Gray → Free/unused virtual address space
This helps you quickly see which categories consume the most virtual and physical memory.
4. Comparing Virtual vs Physical Usage
-
Large Commit but Small WS: The process has allocated a lot of memory virtually but much of it is not actively in RAM.
-
Large WS: Indicates the process is actively using memory and much of its committed virtual memory is resident in physical RAM.(Microsoft, 2023)
Microsoft. (2023). VMMap v3.31 [Computer software]. Sysinternals, Microsoft. https://learn.microsoft.com/en-us/sysinternals/downloads/vmmap
Chosen Operating System:
Using “winver” in the command line will obtain a pop up image of the operating system on my workstation.
