what does <unclassified> mean in windbg !address output

问题:

Example:

0:074> !address -summary   --- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal Free                                  90919      7ec`34659000 (   7.923 Tb)           99.03% <unclassified>                        95426       12`3c3e9000 (  72.941 Gb)  92.12%    0.89% Heap                                    744        1`7ee50000 (   5.983 Gb)   7.56%    0.07% Image                                  4303        0`0f890000 ( 248.563 Mb)   0.31%    0.00% Stack                                   225        0`00de9000 (  13.910 Mb)   0.02%    0.00% TEB                                      75        0`00096000 ( 600.000 kb)   0.00%    0.00% ActivationContextData                    28        0`00025000 ( 148.000 kb)   0.00%    0.00% NlsTables                                 1        0`00023000 ( 140.000 kb)   0.00%    0.00% CsrSharedMemory                           1        0`00006000 (  24.000 kb)   0.00%    0.00% PEB                                       1        0`00001000 (   4.000 kb)   0.00%    0.00% 

回答1:

Hmmm, this is a wild guess, but things that can take up VA space that aren't on that list are directly calling VirtualAlloc, or memory-mapped files. VMMap might prove to be more helpful here.

回答2:

<unclassified> is for allocations that are not further traceable to other memory managers and thus is allocated via VirtualAlloc() from WinDbg's point of view. In newer versions of WinDbg, this is called <unknown>.

There are different reasons for memory classified that way:

• direct calls to VirtualAlloc() of course
• allocations via the Windows Heap Manager that are larger than 512 kb (see the statement by Sasha Goldshtein).
• allocations of the .NET runtime (which has its own heaps that are unknown to WinDbg until you use the special SOS extension)
• some versions of MSXML
• potential other memory managers, e.g. the heap manager from Java or Python (just a guess, I never verified)

文章来源: what does mean in windbg !address output