How to get page reference sequence?

NTDEV
1

Hi everyone,

I’m interested in collecting data on the sequences of pages referenced
during an application’s run. Is there a way to hook into NT’s
Virtual Memory Manager to get a callback whenever the pages being
referenced is changed?

Alternatively, I was thinking of mimicking the hook into VMM by
the following procedure:

  1. call SetProcessWorkingSet() of the process running the application
    program to set the working set to be extremely small
  2. write a kernel device driver to set the Working-set related
    system control variables (described on page 282 of Inside Windows
    NT) to prevent OS from increasing the working set
  3. add hook into the NT page fault handler

Using the above procedure, I could probably obtain a sequence of
page references by an application run. But depending on the
minimum working set size settable by SetProcessWorkingSet(), it’s
probably not possible to obtain the exact page references.

Does anyone know if there is a hook into the NT’s VMM to get
information on page reference sequence in an application run?

Thanks in advance for any help.
Dave

Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com