How to know how much physical Ram allocates imdisk to a ramdisk

Question

Lately I'm using imdisk http://www.ltr-data.se/opencode.html/#ImDisk I am making a 1 GB ramdisk with this command: imdisk.exe -a -t vm -m V: -s 1024M -p "/fs:NTFS /q /y /v:Name /c" I want to know how much physical Ram takes this ramdisk. But it seems that it depends on how the ramdisk is filled with files. It starts with a few MB then it increases with each file I copy. If I then remove those files, the amount of physical Ram that it takes doesn't decrease. So I can't use GetDiskFreeSpaceEx to get the amount of physical Ram because it will not show correctly. Also I can't see the programs's driver as a normal program so I could measure its size.

I talked to the author and he says:

Okay, you were talking about physical memory. I was talking about kernel address space. ImDisk allocates all memory at once in one single address block for ram disks so there is no dynamic allocation or anything like that.

I would think that the only way to determine how much physical memory this address space uses at one particular moment would be if there is some undocumented API that reports commit/physical values for a particular memory block. I don't know of any such API however.

But maybe someone knows a way... I mean to get that number in a program, not just visually.

Answer 1

Looking through the source code, it appears that ImDisk allocates memory in the context of the System process. Take a look at the working set for System (using Process Explorer for example) - within that should be the physical memory usage of ImDisk.

My original answer which I wrote before I looked at the source code (may still be of use if my guess is wrong):

For processes you could simply take a look at the working set values - they indicate physical memory usage for that process. However, for kernel-mode code not specific to any process it's a bit harder. What you need is something like RAMMap. I say "something like" because in the Use Counts and Physical Pages tabs it's going to be almost impossible to tell where the pages are actually coming from (who allocated them).

Edit:

Sorry, I didn't realize you wanted to do this programmatically. If you want to get the working set size of a process, call GetProcessMemoryInfo. So just open the System process (PID 4) and call that function.

What I meant by the second part is that I'm not aware of any tracking/tracing done by the kernel for any of the kernel-mode memory allocation APIs, at least for viewing the physical memory usage of a particular driver. How the kernel manages physical pages is not really something user-mode or kernel-mode programmers worry about.

However, I did miss something here, since ImDisk doesn't use those APIs - it uses ZwAllocateVirtualMemory. If you know the address range of the block allocated by the driver, you can call QueryWorkingSet on the System process and do some calculations to get the exact size.