I have a 32 Gigabyte dump file. !address -summary shows heap usage at 32.033 Gb but !heap -s shows all the heaps as small (2MB or less). Any ideas about the disparity between the two commands shown below?
ps. Windbg version 6.3.9600.16384 AMD64
0:018> !address -summary
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...
--- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
Free 167 7f7`f74c0000 ( 7.969 Tb) 99.61%
Heap 95 8`02223000 ( 32.033 Gb) 99.68% 0.39%
<unknown> 33 0`032f6000 ( 50.961 Mb) 0.15% 0.00%
Image 518 0`02f78000 ( 47.469 Mb) 0.14% 0.00%
Stack 57 0`004c0000 ( 4.750 Mb) 0.01% 0.00%
Other 15 0`001b8000 ( 1.719 Mb) 0.01% 0.00%
TEB 19 0`00026000 ( 152.000 kb) 0.00% 0.00%
PEB 1 0`00001000 ( 4.000 kb) 0.00% 0.00%
--- Type Summary (for busy) ------ RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_PRIVATE 187 8`03b5e000 ( 32.058 Gb) 99.76% 0.39%
MEM_IMAGE 519 0`02f79000 ( 47.473 Mb) 0.14% 0.00%
MEM_MAPPED 32 0`02059000 ( 32.348 Mb) 0.10% 0.00%
--- State Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_FREE 167 7f7`f74c0000 ( 7.969 Tb) 99.61%
MEM_COMMIT 672 8`04f16000 ( 32.077 Gb) 99.82% 0.39%
MEM_RESERVE 66 0`03c1a000 ( 60.102 Mb) 0.18% 0.00%
--- Protect Summary (for commit) - RgnCount ----------- Total Size -------- %ofBusy %ofTotal
PAGE_READWRITE 216 8`01672000 ( 32.022 Gb) 99.65% 0.39%
PAGE_READONLY 297 0`01dd2000 ( 29.820 Mb) 0.09% 0.00%
PAGE_EXECUTE_READ 98 0`0195b000 ( 25.355 Mb) 0.08% 0.00%
PAGE_WRITECOPY 41 0`00140000 ( 1.250 Mb) 0.00% 0.00%
PAGE_READWRITE|PAGE_GUARD 19 0`00036000 ( 216.000 kb) 0.00% 0.00%
PAGE_EXECUTE_READWRITE 1 0`00001000 ( 4.000 kb) 0.00% 0.00%
--- Largest Region by Usage ----------- Base Address -------- Region Size ----------
Free 9`80030000 7f5`6e4d0000 ( 7.959 Tb)
Heap 1`80030000 8`00000000 ( 32.000 Gb)
<unknown> 0`00939000 0`013f7000 ( 19.965 Mb)
Image 7fe`fe95a000 0`0089e000 ( 8.617 Mb)
Stack 0`03590000 0`00035000 ( 212.000 kb)
Other 0`007a0000 0`00181000 ( 1.504 Mb)
TEB 7ff`fff94000 0`00002000 ( 8.000 kb)
PEB 7ff`fffd6000 0`00001000 ( 4.000 kb)
0:018> !heap -s
LFH Key : 0x000000b22491393a
Termination on corruption : ENABLED
Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast
(k) (k) (k) (k) length blocks cont. heap
-------------------------------------------------------------------------------------
Virtual block: 00000000002f0000 - 00000000002f0000 (size 0000000000000000)
Virtual block: 0000000180030000 - 0000000180030000 (size 0000000000000000)
00000000001f0000 00000002 2048 1640 2048 18 29 2 2 0 LFH
0000000000010000 00008000 64 4 64 1 1 1 0 0
Virtual block: 00000000004e0000 - 00000000004e0000 (size 0000000000000000)
00000000004d0000 00001002 1088 212 1088 16 11 2 1 0 LFH
Virtual block: 0000000002100000 - 0000000002100000 (size 0000000000000000)
00000000022c0000 00001002 64 28 64 2 2 1 1 0 LFH
Virtual block: 00000000022d0000 - 00000000022d0000 (size 0000000000000000)
00000000004c0000 00001002 64 64 64 11 3 1 1 0 LFH
Virtual block: 0000000002400000 - 0000000002400000 (size 0000000000000000)
0000000000490000 00001002 64 36 64 6 2 1 1 0 LFH
Virtual block: 0000000002530000 - 0000000002530000 (size 0000000000000000)
00000000026f0000 00001002 64 64 64 6 3 1 1 0 LFH
Virtual block: 0000000002700000 - 0000000002700000 (size 0000000000000000)
0000000002840000 00001002 64 36 64 6 2 1 1 0 LFH
Virtual block: 0000000002850000 - 0000000002850000 (size 0000000000000000)
00000000029d0000 00001002 64 28 64 2 2 1 1 0 LFH
Virtual block: 00000000029e0000 - 00000000029e0000 (size 0000000000000000)
0000000002b60000 00001002 64 32 64 3 2 1 1 0 LFH
Virtual block: 0000000002c00000 - 0000000002c00000 (size 0000000000000000)
0000000002bf0000 00001002 64 36 64 5 2 1 1 0 LFH
0000000002db0000 00001002 512 24 512 3 2 1 0 0
0000000002ea0000 00011002 512 8 512 2 1 1 0 0
Virtual block: 0000000002fc0000 - 0000000002fc0000 (size 0000000000000000)
Virtual block: 00000000037d0000 - 00000000037d0000 (size 0000000000000000)
0000000002f40000 00001002 512 204 512 66 7 1 2 0 LFH
0000000003270000 00001002 64 8 64 3 1 1 0 0
0000000003120000 00001002 512 8 512 2 2 1 0 0
0000000003750000 00001002 512 8 512 3 2 1 0 0
0000000003900000 00001002 512 8 512 3 1 1 0 0
0000000003740000 00001002 64 8 64 3 1 1 0 0
Virtual block: 0000000003980000 - 0000000003980000 (size 0000000000000000)
0000000003b60000 00001002 64 40 64 1 2 1 1 0 LFH
0000000003e40000 00001003 512 100 512 42 14 1 0 N/A
0000000003d20000 00001003 512 8 512 5 1 1 0 N/A
0000000004090000 00001003 512 8 512 5 1 1 0 N/A
00000000036b0000 00001003 512 8 512 5 1 1 0 N/A
0000000003f50000 00001003 512 8 512 5 1 1 0 N/A
0000000004160000 00001003 512 8 512 5 1 1 0 N/A
0000000004360000 00001003 512 8 512 5 1 1 0 N/A
00000000045a0000 00001003 512 8 512 5 1 1 0 N/A
00000000042d0000 00001003 512 8 512 5 1 1 0 N/A
0000000003ad0000 00001003 512 8 512 5 1 1 0 N/A
0000000004790000 00001003 512 8 512 5 1 1 0 N/A
0000000004010000 00001003 512 8 512 5 1 1 0 N/A
0000000004460000 00001003 512 8 512 5 1 1 0 N/A
00000000046c0000 00001003 512 8 512 5 1 1 0 N/A
0000000004990000 00001003 512 8 512 5 1 1 0 N/A
0000000004ba0000 00001003 512 8 512 5 1 1 0 N/A
0000000004b80000 00001003 1088 136 1088 69 2 2 0 N/A
Virtual block: 0000000005120000 - 0000000005120000 (size 0000000000000000)
00000000031d0000 00001002 1088 376 1088 12 3 2 1 0 LFH
Virtual block: 0000000005250000 - 0000000005250000 (size 0000000000000000)
0000000003d10000 00001002 64 36 64 7 2 1 1 0 LFH
-------------------------------------------------------------------------------------
It seems that the 32 GB are hidden behind the lines starting with Virtual block.
I created a sample program which alloces a 100 MB block of memory using the HeapAlloc() function.
In WinDbg 6.12.0002.633, 6.2.9200.16384 and 6.3.9600.16384, every time I allocate such a block, it shows up as an additional line Virtual block: <address> - <address> (size 00000000).
Unfortunately I have no idea of how to get the correct size.
来源：https://stackoverflow.com/questions/21444589/address-summary-and-heap-s-disagree-on-mem-leak