Querying Paged Memory

[Greg_Lindor]

I have a driver that needs to query some memory of my process then read and compare its entire memory space. I am filtering using ZwQueryVirtualMemory and checking that memory regions are in a committed state and not page guarded (or marked no access). The problem lies in that this querying and reading seems to be paging in memory that was not resident, blowing up the targets working set.
MmCopyMemory is being used to read the memory if this helps.

Is this the intended behavior of reading memory? Will the Memory Manager step back in to page these regions out again? finally, is there are a way to accomplish this task without forcing memory to be paged in?

And just a bonus question. Will just Querying a region of memory cause it to be paged in?

[Tim_Roberts]

You should be able to answer this question using common sense. The only data you can read is data that is in memory. The processor does not have access to anything else.

[Greg_Lindor]

Thanks. I figured as much

[Peter_Viscarola_OSR]

@Greg_Lindor

Will the Memory Manager step back in to page these regions out again?

It will not FORCE these regions out, if that's what you're asking. You had a block of memory that was paged out. You referenced an address within that block. That causes a page fault, and MM loaded the page (and some number of pages around that page) into memory. In the fullness of time, MM will apply its normal algos to page out those pages that aren't needed, based on (a whole long list of factors including) memory pressure and when the page(s) were last used.

Will just Querying a region of memory cause it to be paged in?

No, I don't expect that it would. But, to be clear, that's my expectation... I haven't looked at the sources, nor un-assembled the function.

[Greg_Lindor]

@Peter_Viscarola_OSR

It will not FORCE these regions out, if that's what you're asking. You had a block of memory that was paged out. You referenced an address within that block. That causes a page fault, and MM loaded the page (and some number of pages around that page) into memory. In the fullness of time, MM will apply its normal algos to page out those pages that aren't needed, based on (a whole long list of factors including) memory pressure and when the page(s) were last used.

Thanks for this, considering the Mm is a complex system I was wondering if it was safe to assume that at some point those regions would eventually be paged out if they weren't originally being used by the application after some time. Is that an acceptable understanding of part of what the Mm is for?

@Peter_Viscarola_OSR

No, I don't expect that it would. But, to be clear, that's my expectation... I haven't looked at the sources, nor un-assembled the function.

You're right. Was able to confirm in the sys internals book.

[Peter_Viscarola_OSR]

@Greg_Lindor

I was wondering if it was safe to assume that at some point those regions would eventually be paged out if they weren't originally being used by the application after some time. Is that an acceptable understanding of part of what the Mm is for?

Yes. MM frees pages (by paging them out of they are dirty, or just "freeing" them if they are RO) based on the system's overall demand for physical memory, the process working set parameters, and the age/use status of the pages.