|
|
|
|
|
|
|
Windows内核调试
帖子发起人: Thomson 发起时间: 2009-04-27 22:59 下午 回复: 6
|
帖子排序:
|
|
|
|
2009-04-27, 23:55 下午
|
MJ0011
注册: 2008-04-24
发 贴: 112
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
PF Usage(页面文件使用量)是通过ZwQuerySystemInformation(SystemPerformanceInformation)获取的
typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
LARGE_INTEGER IdleProcessTime;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG IoReadOperationCount;
ULONG IoWriteOperationCount;
ULONG IoOtherOperationCount;
ULONG AvailablePages;
SYSINF_PAGE_COUNT CommittedPages;
SYSINF_PAGE_COUNT CommitLimit;
SYSINF_PAGE_COUNT PeakCommitment;
ULONG PageFaultCount;
ULONG CopyOnWriteCount;
ULONG TransitionCount;
ULONG CacheTransitionCount;
ULONG DemandZeroCount;
ULONG PageReadCount;
ULONG PageReadIoCount;
ULONG CacheReadCount;
ULONG CacheIoCount;
ULONG DirtyPagesWriteCount;
ULONG DirtyWriteIoCount;
ULONG MappedPagesWriteCount;
ULONG MappedWriteIoCount;
ULONG PagedPoolPages;
ULONG NonPagedPoolPages;
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFrees;
ULONG FreeSystemPtes;
ULONG ResidentSystemCodePage;
ULONG TotalSystemDriverPages;
ULONG TotalSystemCodePages;
ULONG NonPagedPoolLookasideHits;
ULONG PagedPoolLookasideHits;
ULONG AvailablePagedPoolPages;
ULONG ResidentSystemCachePage;
ULONG ResidentPagedPoolPage;
ULONG ResidentSystemDriverPage;
ULONG CcFastReadNoWait;
ULONG CcFastReadWait;
ULONG CcFastReadResourceMiss;
ULONG CcFastReadNotPossible;
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadResourceMiss;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG ContextSwitches;
ULONG FirstLevelTbFills;
ULONG SecondLevelTbFills;
ULONG SystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
使用其中的CommittedPages * (内存页面大小/1024)计算出来的
实际就是系统中的提交页面数量
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
2009-04-28, 00:09 上午
|
MJ0011
注册: 2008-04-24
发 贴: 112
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
验证了一下~
HMODULE hlib = LoadLibrary("ntdll.dll");
PVOID p = GetProcAddress(hlib , "ZwQuerySystemInformation");
SYSTEM_PERFORMANCE_INFORMATION info ;
SYSTEM_BASIC_INFORMATION basinfo ;
ULONG cb = sizeof(info);
ULONG cb1 = sizeof(basinfo);
__asm
{
push 0
push cb1
lea eax ,basinfo
push eax
push 0 //SystemBasicInformation
call p
push 0
push cb
lea eax ,info
push eax
push 2 //SystemPerformanceInformation
call p
}
LONG mbs = info.CommittedPages * (basinfo.PageSize /1024) /1024;
printf("pf usage : %u MB(s)\n",mbs);
getchar();
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
2009-04-28, 12:40 下午
|
格蠹老雷
注册: 2005-12-19
发 贴: 1,303
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
2009-04-28, 13:42 下午
|
王宇
注册: 2007-05-08
发 贴: 306
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
嗯,应该就是这么计算的。
专门去找了一下实现 ( ..\private\windows\shell\taskman ),但是没找着...
在 shell 文件夹下,最多的就是计算内存大小,方法也类似:
// // Memory //
Status = NtQuerySystemInformation( SystemBasicInformation, &BasicInfo, sizeof(BasicInfo), NULL );
if (!NT_SUCCESS(Status)) {
return; }
dwTotalPhys = BasicInfo.NumberOfPhysicalPages * (BasicInfo.PageSize / 1024);
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
2009-04-28, 22:59 下午
|
Thomson
注册: 2008-07-03
发 贴: 211
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
谢谢MJ0011, 回答很精彩...
另外,关于PF usage的获得,NtQuerySystemInformation应该就是根据nt!MmTotalCommittedPages换算出来的,那么这个值里面都包括哪些内存呢? 直接commit的private类型的肯定算在里面,还包括其它的吗?有没有一个列表什么的.(最好是有一个什么公式可以计算出这个值)
我看到好多处都在改这个变量.
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
2009-04-29, 09:55 上午
|
王宇
注册: 2007-05-08
发 贴: 306
|
Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
下了个 ba 看了看,集中在几个函数:MiChargeCommitment、MiChargeCommitmentCantExpand 还有 MiInitializeLoadedModuleList。
其中以 ExAllocatePoolWithTag -> MiAllocatePoolPages -> MiChargeCommitmentCantExpand 分支最频繁。
MiInitializeLoadedModuleList 函数主要是从 PsLoadedModuleList 开始计算
CommittedPages += (DataTableEntry1->SizeOfImage >> PAGE_SHIFT);
MmTotalCommittedPages += CommittedPages;
需要啃代码了...
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
高端调试 » 软件调试 » Windows内核调试 » Re: Taskmgr里面的PF usage由哪些部分组成?
|
|
|
|
|
|