Viewing the actual data in !address REGionUsageIsVAD WinDBG

Question

I used the !address -RegionusageIsVAD and found an entry that is very huge in size.

How can i view who wrote this data and what data is in that specitic address?

Exmaple output:

099230000 : 099230000 - 01000000
                Type     00020000 MEM_PRIVATE
                Protect  00000004 PAGE_READWRITE
                State    00001000 MEM_COMMIT
                Usage    RegionUsageIsVAD

So i want to see what data is in this address and who allocated it.

Answer 1

High RegionUsageIsVAD typically comes from 2 reasons :

• this is a .NET application. In this case, the CLR allocates a block of memory and performs its own allocations inside it. You can troubleshoot this kind of issue with the sos WinDbg extension and see if you have many objects still alive.
• this is not a .NET application. In this case, the application calls VirtualAlloc to allocate a bloc of memory. Since it is not possible to record backtraces for this kind of allocation you can put a breakpoint on VirtualAlloc and dump the stack for each call (bp kernel32!VirtualAlloc "kb;gc;"). This may give you hints of where the call comes from.