Finding physical memory ranges from a kernel debugger


The SysInternals RamMap tool has the capability to display the physical memory ranges on a system as shown in the following screenshot.

RamMap displaying physcial memory ranges

The same information can be obtained from a kernel debugger.

First obtain the number of discrete physical memory runs.

kd> dt poi(nt!MmPhysicalMemoryBlock)  nt!_PHYSICAL_MEMORY_DESCRIPTOR
   +0x000 NumberOfRuns     : 3
   +0x004 NumberOfPages    : 0x3ff8d
   +0x008 Run              : [1] _PHYSICAL_MEMORY_RUN

For every element in the array (PHYSICAL_MEMORY_DESCRIPTOR.Run[]) display the contents of the structure.

kd> dt poi(nt!MmPhysicalMemoryBlock)  nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[0].
   +0x008 Run     : [0] 
      +0x000 BasePage : 1
      +0x004 PageCount : 0x9e
kd> dt poi(nt!MmPhysicalMemoryBlock)  nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[1].
   +0x008 Run     : [1] 
      +0x000 BasePage : 0x100
      +0x004 PageCount : 2
kd> dt poi(nt!MmPhysicalMemoryBlock)  nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[2].
   +0x008 Run     : [2] 
      +0x000 BasePage : 0x103
      +0x004 PageCount : 0x3feed

The above runs match up with the information displayed by RamMap.

Add the page counts from all the ranges to obtain the total number of pages in the system

kd> ? 0x9e + 2 + 0x3feed 
Evaluate expression: 262029 = 0003ff8d

This matches the total amount of physical memory in the system, as shown below:

kd> !vm 1

*** Virtual Memory Usage ***
	Physical Memory:      262029 (   1048116 Kb)
	Page File: \??\C:\pagefile.sys
	  Current:   1310720 Kb  Free Space:   1167168 Kb
	  Minimum:   1310720 Kb  Maximum:      4194304 Kb
	Paging File Name paged out
	  Current:    262144 Kb  Free Space:    262136 Kb
	  Minimum:    262144 Kb  Maximum:      1572172 Kb
.
.
.