Physical Memory Limits in Crash Dump files for Windows 7 and using RamMap to find out

This post has a quick look at Physical Memory Limits in Crash Dump files for Windows 7 and using the Sysinternals tool RamMap, which can be used to determine the number of physical memory ranges on a system.

All Windows operating systems are configured to capture information about its state, in the event of a stop error or system crash, and save them as .dmp crash dump files. There are 3 types of dumps that can be captured in case of a system crashe: Complete Memory Dump, Kernel Memory Dump and Small Memory Dump.

The crash dump format has a limit of 42 (64-bit) and 86 (32-bit) physical address ranges. On certain systems, the BIOS firmware memory map may contain more than this number of non-contiguous regions. When a dump file is generated on this system, only the first 42 (64-bit) or 86 (32-bit) memory regions will be saved to the file. Kernel and Complete memory dumps from a Windows system may not contain all the memory from the system.

On occasions, when opening a memory dump file generated on certain systems using the Debugging Tools for Windows (windbg.exe), you may receive an error message:

WARNING: Dump header physical memory block has been truncated. Some valid physical pages may be inaccessible.

To prevent the issue, the OEM of the affected system would need to modify the firmware memory map to ensure the number of physical contiguous physical memory regions exposed to the Operating System does not exceed the limits previously noted, states KB2510168.

The Sysinternals tool RamMap can be used to determine the number of physical memory ranges on a system. After downloading and executing RamMap.exe, click the Physical Ranges tab. Counting the number of ranges listed will verify the number of physical ranges on a particular system.

RAMMap is an advanced physical memory usage analysis utility for Windows Vista and higher. It presents usage information in different ways on its several different tabs:

* Use Counts: usage summary by type and paging list
* Processes: process working set sizes
* Priority Summary: prioritized standby list sizes
* Physical Pages: per-page use for all physical memory
* Physical Ranges: physical memory addresses
* File Summary: file data in RAM by file
* File Details: individual physical pages by file
* Use RAMMap to gain understanding of the way Windows manages memory, to analyze application memory usage, or to answer specific questions about how RAM is being allocated.

[attachment=0:3hd2dmme]rammap1-600x367.jpg[/attachment:3hd2dmme]

RAmMap will tell how Windows is assigning physical memory, how much file data is cached in RAM, or how much RAM is used by the kernel and device drivers.

https://technet.microsoft.com/en-us/s.../ff700229.aspx