Finding physical memory ranges from a kernel debugger
The SysInternals RamMap tool has the capability to display the physical memory ranges on a system as shown in the following screenshot.
The same information can be obtained from a kernel debugger.
First obtain the number of discrete physical memory runs.
kd> dt poi(nt!MmPhysicalMemoryBlock) nt!_PHYSICAL_MEMORY_DESCRIPTOR +0x000 NumberOfRuns : 3 +0x004 NumberOfPages : 0x3ff8d +0x008 Run : [1] _PHYSICAL_MEMORY_RUN
For every element in the array (PHYSICAL_MEMORY_DESCRIPTOR.Run[]) display the contents of the structure.
kd> dt poi(nt!MmPhysicalMemoryBlock) nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[0].
+0x008 Run : [0]
+0x000 BasePage : 1
+0x004 PageCount : 0x9e
kd> dt poi(nt!MmPhysicalMemoryBlock) nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[1].
+0x008 Run : [1]
+0x000 BasePage : 0x100
+0x004 PageCount : 2
kd> dt poi(nt!MmPhysicalMemoryBlock) nt!_PHYSICAL_MEMORY_DESCRIPTOR -a Run[2].
+0x008 Run : [2]
+0x000 BasePage : 0x103
+0x004 PageCount : 0x3feed
The above runs match up with the information displayed by RamMap.
Add the page counts from all the ranges to obtain the total number of pages in the system
kd> ? 0x9e + 2 + 0x3feed Evaluate expression: 262029 = 0003ff8d
This matches the total amount of physical memory in the system, as shown below:
kd> !vm 1 *** Virtual Memory Usage *** Physical Memory: 262029 ( 1048116 Kb) Page File: \??\C:\pagefile.sys Current: 1310720 Kb Free Space: 1167168 Kb Minimum: 1310720 Kb Maximum: 4194304 Kb Paging File Name paged out Current: 262144 Kb Free Space: 262136 Kb Minimum: 262144 Kb Maximum: 1572172 Kb . . .