看了firelong寫的C#會重蹈覆轍嗎？系列之2：反射及元數據的性能問題, Ivony寫的C#囈語：誰說程序都要加載到內存？和後面的很多評論後，覺得需要寫點來表達一些觀點。希望能同大家一起探討。
firelong在C#會重蹈覆轍嗎？系列之2：反射及元數據的性能問題中提及:
" 程序（EXE/DLL）最後都是要加載到內存中運行的，不是光放在硬盤上的——這也是爲什麼.NET程序佔用內存都超多"
有幾位園友在評論中指出這句是錯誤的或者質疑firelong的結論。如:
Jeffray Zhao: "不用，不JIT的話，是不會把整個dll加載到內存中的，而是用多少加載多少，這點已經討論了很多遍了"
道法自然:".NET類加載器，在一個方法一個方法循環調用時，僅是在一個方法調用前，纔會加載這個方法使用的類型。這一個是類型加載的時機。另一個問題，類型加載時，包含了什麼內容？也就是說，加載類型時，都加載了什麼樣的元數據？"
1. 關於.net程序集加載
雖然在.net方面工作過幾年,但是說實話在此文之前我並沒有對.net程序集加載有一個清晰的概念。這些個園友都是些有經驗的人，爲什麼他們說的觀點相反。到底.net程序集加載是整個地加載？還是如Jeffray Zhao等所說"用多少加載多少", "用到那個類型就加載該類型"。剛好最近在看<CLR via c#> 第三版英文版，試圖在書中找到答案。但是有點失望的是，書中並沒有很詳細地說。只是有一段提及了.net程序集加載，然後就不再深入說了。Jefferay Zhao等幾位所持的觀點沒有辦法在書中得到驗證。只好自己來驗證。剛好Ivony寫了C#囈語：誰說程序都要加載到內存？，我就接着他的例子去做一下吧。Ivony的文章結論是沒有用到的metadata是不會加載到內存。我可以重複一下Ivony的實驗，看看我是否也得出同樣的結論(有點象物理化學的實驗, 是不是?)。
我首先照Ivony說的過程重複了一下他做過的步驟，產生了一個巨大的Test.cs文件，裏面包含100個類，100個方法，100個屬性，發現確實如他所說：在任務管理器裏面看那個ConsoleApplication1.exe佔用只有1MB 多一點的內存空間。而編譯出來的ConsoleApplication1.exe有10MB。初步看起來，Console1Application1.exe沒有全部加載進內存，也即100個類的metadata沒有加載進內存。
此後兩天我都在想爲什麼呢？真如他們幾位所說，那麼CLR具體是如何在內存裏面組織這些metadata，類型，是如何JIT編譯方法的。想不透，只好祭出強大的工具: Windbg來找找答案。這回有一些不同的發現：
0:000> lmu
start end module name
00040000 00ac4000 ConsoleApplication1 (deferred)
634b0000 63fa8000 mscorlib_ni (deferred)
64ab0000 65040000 mscorwks (deferred)
6b040000 6b0a6000 mscoreei (deferred)
6e2a0000 6e2fb000 mscorjit (deferred)
6e570000 6e5ba000 mscoree (deferred)
73950000 739eb000 MSVCR80 (deferred)
74db0000 74f4e000 comctl32 (deferred)
76640000 766ea000 msvcrt (deferred)
766f0000 7673b000 GDI32 (deferred)
76740000 7681c000 KERNEL32 (deferred)
76820000 76879000 SHLWAPI (deferred)
76880000 76946000 ADVAPI32 (deferred)
769a0000 76a3d000 USER32 (deferred)
76a40000 76b03000 RPCRT4 (deferred)
76b10000 77620000 shell32 (deferred)
777b0000 77878000 MSCTF (deferred)
77880000 779c5000 ole32 (deferred)
779d0000 77a4d000 USP10 (deferred)
77b40000 77c67000 ntdll (export symbols) C:/Windows/system32/ntdll.dll
77c90000 77c99000 LPK (deferred)
77cb0000 77cce000 IMM32 (deferred)
0:000> !DumpDomain
--------------------------------------
System Domain: 64ffd058
LowFrequencyHeap: 64ffd07c
HighFrequencyHeap: 64ffd0c8
StubHeap: 64ffd114
Stage: OPEN
Name: None
--------------------------------------
Shared Domain: 64ffc9a8
LowFrequencyHeap: 64ffc9cc
HighFrequencyHeap: 64ffca18
StubHeap: 64ffca64
Stage: OPEN
Name: None
Assembly: 00d867a8
--------------------------------------
Domain 1: 00d41bd8
LowFrequencyHeap: 00d41bfc
HighFrequencyHeap: 00d41c48
StubHeap: 00d41c94
Stage: OPEN
SecurityDescriptor: 00d42f00
Name: ConsoleApplication1.exe
Assembly: 00d867a8 [C:/Windows/assembly/GAC_32/mscorlib/2.0.0.0__b77a5c561934e089/mscorlib.dll]
ClassLoader: 00d86828
SecurityDescriptor: 00d7a7b8
Module Name
634b1000 C:/Windows/assembly/GAC_32/mscorlib/2.0.0.0__b77a5c561934e089/mscorlib.dll
Assembly: 00d8fc60 [C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ConsoleApplication1.exe]
ClassLoader: 00d91680
SecurityDescriptor: 00d8fb60
Module Name
00d12c5c C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ConsoleApplication1.exe
0:000> !Dumpmodule 00d12c5c
No export Dumpmodule found
0:000> !DumpModule 00d12c5c
Name: C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ConsoleApplication1.exe
Attributes: PEFile
Assembly: 00d8fc60
LoaderHeap: 00000000
TypeDefToMethodTableMap: 022f0010
TypeRefToMethodTableMap: 022f07ec
MethodDefToDescMap: 022f083c
FieldDefToDescMap: 02352a98
MemberRefToDescMap: 02352aa4
FileReferencesMap: 02352af8
AssemblyReferencesMap: 02352afc
MetaData start address: 00073d94 (10797316 bytes)
0:000> db 00073d94 l 1000
00073d94 42 53 4a 42 01 00 01 00-00 00 00 00 0c 00 00 00 BSJB............
00073da4 76 32 2e 30 2e 35 30 37-32 37 00 00 00 00 05 00 v2.0.50727......
00073db4 6c 00 00 00 30 91 2c 00-23 7e 00 00 9c 91 2c 00 l...0.,.#~....,.
00073dc4 54 2e 78 00 23 53 74 72-69 6e 67 73 00 00 00 00 T.x.#Strings....
00073dd4 f0 bf a4 00 1c 00 00 00-23 55 53 00 0c c0 a4 00 ........#US.....
00073de4 10 00 00 00 23 47 55 49-44 00 00 00 1c c0 a4 00 ....#GUID.......
00073df4 e8 00 00 00 23 42 6c 6f-62 00 00 00 00 00 00 00 ....#Blob.......
00073e04 02 00 01 10 57 15 a2 01-09 00 00 00 00 fa 25 33 ....W.........%3
00073e14 00 16 00 00 01 00 00 00-13 00 00 00 f6 01 00 00 ................
00073e24 02 00 00 00 96 88 01 00-51 c3 00 00 13 00 00 00 ........Q.......
00073e34 0d 00 00 00 01 00 00 00-f4 01 00 00 50 c3 00 00 ............P...
00073e44 50 c3 00 00 01 00 00 00-01 00 00 00 00 00 0a 00 P...............
......省略很多
注意看我用黃色背景加亮的那些數字。前兩個數字是這個ConsoleApplication1.exe所在的地址。注意其長度。後兩個是metadata的起始地址及長度。注意其長度是大約10MB。
以上的Windbg記錄顯示我們的程序集雖然有10MB之巨，但是.net CLR還是將該程序集全部載入內存。metadata也隨該程序集一起被CLR載入內存。不管是用到了類型的metadata，還是沒有用到類型的metadata，都被載入了內存。這樣就很清晰了。至少firelong這半句話是對的: "程序（EXE/DLL）最後都是要加載到內存中運行的，不是光放在硬盤上的", 那麼爲什麼任務管理器顯示ConsoleApplication1.exe只佔用1MB左右的內存呢？這個問題有好幾天我都沒有辦法解釋。只到今天，我突然想起來用其他工具來查看進程的內存佔用。結果令我恍然大悟: 原來任務管理器統計的內存佔用不準確。那麼好了，結論就是程序集是整個地被加載進內存的，不是"用多少加載多少", "用到那個類型就加載該類型".
2. 關於firelong所說的這後半句話："這也是爲什麼.NET程序佔用內存都超多"
firelong認爲: 我們自己編譯出來的程序集, metadata佔太大比例的空間, 有50%以上。.net FCL本身的程序集metadata也佔比較大的空間. metadata對性能影響很大。 我給解釋一下:
我們自己編譯出來的程序集, metadata的大小取決於設計，開發者設計了很多類型，那metadata自然小不了。你想想有沒有過度設計，減少點設計複雜度，類型少一點，metadata的尺寸自然會小點。
.net FCL本身的程序集, 我們可以先說說mscorlib.dll, 它是每一個.net應用程序必引用的. 它大約就5M左右，它是運行每一個.net應用程序必須的負載(overhead), 你的機器不會連5M內存消耗都承受不起吧。 至於其他的.net FCL的程序集, 是用到了纔會加載，不是必須的。.net FCL設計已經相當精煉了。另外還有一個.net CLR提供的特性可以幫助減少.net 應用程序的內存消耗：domain neutral, 有domain neutral特性的程序集都是跨AppDomain共享的，那麼在一個進程的內存裏面只要一份mscorlib.dll的拷貝就行了。.net FCL的程序集都是domain neutal的。還有asp.net下我們的應用程序集也是domain neutral的. 通過這些手段， 微軟.net團隊已經大大減少了.net應用程序的內存負荷。
另外，大家可以注意一下你的應用程序裏面的線程，有時候線程多也是造成內存佔用大的原因。
總之firelong認爲metadata過大影響性能是站不住腳的，實際上那隻與你的設計有關。firelong將.net平臺, c#編程語言與c/c++相比，並不合適. 這些編程平臺各自有各自的特點，結合自己真實的需要纔是正確的。
2010.7.7.注:
在cnblogs帖出此文後，關注者不少。提出了質疑，我又再驗證，獲得了更多的信息（!address命令的輸出)：
BaseAddr EndAddr+1 RgnSize Type State Protect Usage
-------------------------------------------------------------------------------------------
* 0 10000 10000 MEM_FREE PAGE_NOACCESS Free
* 10000 20000 10000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE MemoryMappedFile "PageFile"
* 20000 21000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 21000 30000 f000 MEM_FREE PAGE_NOACCESS Free
* 30000 34000 4000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 34000 40000 c000 MEM_FREE PAGE_NOACCESS Free
* 40000 41000 1000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 41000 50000 f000 MEM_FREE PAGE_NOACCESS Free
* 50000 91000 41000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 91000 a0000 f000 MEM_FREE PAGE_NOACCESS Free
* a0000 e1000 41000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* e1000 f0000 f000 MEM_FREE PAGE_NOACCESS Free
* f0000 f1000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* f1000 100000 f000 MEM_FREE PAGE_NOACCESS Free
* 100000 103000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 103000 110000 d000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 110000 112000 2000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 112000 120000 e000 MEM_FREE PAGE_NOACCESS Free
* 120000 121000 1000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 121000 130000 f000 MEM_FREE PAGE_NOACCESS Free
* 130000 132000 2000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 132000 140000 e000 MEM_FREE PAGE_NOACCESS Free
* 140000 141000 1000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE MemoryMappedFile "PageFile"
* 141000 150000 f000 MEM_FREE PAGE_NOACCESS Free
* 150000 151000 1000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE MemoryMappedFile "PageFile"
* 151000 160000 f000 MEM_FREE PAGE_NOACCESS Free
* 160000 161000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 161000 254000 f3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 254000 255000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 255000 256000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD <unclassified>
|- 256000 259000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 259000 25b000 2000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD <unclassified>
|- 25b000 260000 5000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 260000 262000 2000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 262000 270000 e000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 270000 272000 2000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 272000 273000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 273000 27a000 7000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 27a000 27b000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 27b000 280000 5000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 280000 282000 2000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 282000 288000 6000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 288000 28c000 4000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 28c000 28d000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 28d000 290000 3000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 290000 291000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 291000 2d0000 3f000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 2d0000 2e0000 10000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 2e0000 2e1000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 2e1000 2f0000 f000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 2f0000 2f2000 2000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 2f2000 2f3000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 2f3000 2f7000 4000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 2f7000 2f8000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 2f8000 2fb000 3000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 2fb000 2fc000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 2fc000 300000 4000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 300000 302000 2000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 302000 310000 e000 MEM_FREE PAGE_NOACCESS Free
* 310000 311000 1000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE MemoryMappedFile "PageFile"
* 311000 320000 f000 MEM_FREE PAGE_NOACCESS Free
* 320000 323000 3000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "/Device/HarddiskVolume1/Windows/System32/l_intl.nls"
* 323000 330000 d000 MEM_FREE PAGE_NOACCESS Free
* 330000 333000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 333000 340000 d000 MEM_FREE PAGE_NOACCESS Free
* 340000 341000 1000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 341000 350000 f000 MEM_FREE PAGE_NOACCESS Free
* 350000 360000 10000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 360000 363000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 363000 370000 d000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 370000 371000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 371000 380000 f000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 380000 390000 10000 MEM_FREE PAGE_NOACCESS Free
* 390000 391000 1000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READWRITE <unclassified>
|- 391000 3d0000 3f000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 3d0000 400000 30000 MEM_FREE PAGE_NOACCESS Free
* 400000 471000 71000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 471000 500000 8f000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 500000 880000 380000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "/Device/HarddiskVolume1/Windows/System32/loc2008.nls"
* 880000 888000 8000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
|- 888000 940000 b8000 MEM_MAPPED MEM_RESERVE MemoryMappedFile "PageFile"
|- 940000 943000 3000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
|- 943000 948000 5000 MEM_MAPPED MEM_RESERVE MemoryMappedFile "PageFile"
* 948000 9e0000 98000 MEM_FREE PAGE_NOACCESS Free
* 9e0000 9e3000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 9e3000 9f0000 d000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 9f0000 af3000 103000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* af3000 b00000 d000 MEM_FREE PAGE_NOACCESS Free
* b00000 ba0000 a0000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* ba0000 bc0000 20000 MEM_FREE PAGE_NOACCESS Free
* bc0000 bc3000 3000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- bc3000 bd0000 d000 MEM_PRIVATE MEM_RESERVE <unclassified>
* bd0000 c90000 c0000 MEM_FREE PAGE_NOACCESS Free
* c90000 c98000 8000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- c98000 ca0000 8000 MEM_PRIVATE MEM_RESERVE <unclassified>
* ca0000 dcd000 12d000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- dcd000 dd0000 3000 MEM_PRIVATE MEM_RESERVE <unclassified>
* dd0000 eb0000 e0000 MEM_FREE PAGE_NOACCESS Free
* eb0000 eb1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ConsoleApplication1.exe"
|- eb1000 eb2000 1000 MEM_IMAGE MEM_RESERVE Image "ConsoleApplication1.exe"
|- eb2000 eb3000 1000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "ConsoleApplication1.exe"
|- eb3000 eb4000 1000 MEM_IMAGE MEM_RESERVE Image "ConsoleApplication1.exe"
|- eb4000 eb5000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ConsoleApplication1.exe"
|- eb5000 eb6000 1000 MEM_IMAGE MEM_RESERVE Image "ConsoleApplication1.exe"
|- eb6000 eb7000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ConsoleApplication1.exe"
|- eb7000 eb8000 1000 MEM_IMAGE MEM_RESERVE Image "ConsoleApplication1.exe"
* eb8000 ec0000 8000 MEM_FREE PAGE_NOACCESS Free
* ec0000 f5d000 9d000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
|- f5d000 1ac0000 b63000 MEM_MAPPED MEM_RESERVE MemoryMappedFile "PageFile"
* 1ac0000 1e40000 380000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "/Device/HarddiskVolume1/Windows/System32/loc2008.nls"
* 1e40000 1eb0000 70000 MEM_FREE PAGE_NOACCESS Free
* 1eb0000 1eb1000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 1eb1000 1fac000 fb000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 1fac000 1fad000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 1fad000 1faf000 2000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD <unclassified>
|- 1faf000 1fb0000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 1fb0000 1fc2000 12000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 1fc2000 2fb0000 fee000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 2fb0000 2fc2000 12000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 2fc2000 3fb0000 fee000 MEM_PRIVATE MEM_RESERVE <unclassified>
* 3fb0000 3fb1000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 3fb1000 40ac000 fb000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
|- 40ac000 40ad000 1000 MEM_PRIVATE MEM_RESERVE <unclassified>
|- 40ad000 40af000 2000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD <unclassified>
|- 40af000 40b0000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unclassified>
* 40b0000 40b1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ClassLibrary1.dll"
|- 40b1000 40b2000 1000 MEM_IMAGE MEM_RESERVE Image "ClassLibrary1.dll"
|- 40b2000 5b98000 1ae6000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "ClassLibrary1.dll"
|- 5b98000 5b99000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ClassLibrary1.dll"
|- 5b99000 5b9a000 1000 MEM_IMAGE MEM_RESERVE Image "ClassLibrary1.dll"
|- 5b9a000 5b9b000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ClassLibrary1.dll"
|- 5b9b000 5b9c000 1000 MEM_IMAGE MEM_RESERVE Image "ClassLibrary1.dll"
* 5b9c000 62a70000 5ced4000 MEM_FREE PAGE_NOACCESS Free
* 62a70000 62a71000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-62a71000 62a72000 1000 MEM_IMAGE MEM_RESERVE Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-62a72000 64558000 1ae6000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-64558000 64559000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-64559000 6455a000 1000 MEM_IMAGE MEM_RESERVE Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-6455a000 6455b000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
|-6455b000 6455c000 1000 MEM_IMAGE MEM_RESERVE Image "C:/Users/Administrator/Documents/Visual Studio 2010/Projects/ConsoleApplication1/ConsoleApplication1/bin/Release/ClassLibrary1.dll"
* 6455c000 66050000 1af4000 MEM_FREE PAGE_NOACCESS Free
* 66050000 66051000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66051000 66052000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66052000 66053000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66053000 66056000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66056000 66075000 1f000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66075000 66077000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66077000 6609f000 28000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-6609f000 660a1000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-660a1000 661d0000 12f000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-661d0000 661d3000 3000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READWRITE Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-661d3000 661ef000 1c000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_WRITECOPY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-661ef000 66ae3000 8f4000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
|-66ae3000 66b48000 65000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/assembly/NativeImages_v2.0.50727_32/mscorlib/894183c0c47bd4772fbfad4c1a7e3b71/mscorlib.ni.dll"
* 66b48000 67650000 b08000 MEM_FREE PAGE_NOACCESS Free
* 67650000 67651000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67651000 67652000 1000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67652000 67653000 1000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67653000 67b93000 540000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67b93000 67b9b000 8000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67b9b000 67b9c000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67b9c000 67b9f000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67b9f000 67ba3000 4000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67ba3000 67ba5000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67ba5000 67ba6000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67ba6000 67ba7000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
|-67ba7000 67be0000 39000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll"
* 67be0000 68970000 d90000 MEM_FREE PAGE_NOACCESS Free
* 68970000 68971000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorjit.dll"
|-68971000 689c7000 56000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorjit.dll"
|-689c7000 689c8000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorjit.dll"
|-689c8000 689cb000 3000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorjit.dll"
* 689cb000 6c790000 3dc5000 MEM_FREE PAGE_NOACCESS Free
* 6c790000 6c791000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscoreei.dll"
|-6c791000 6c7ec000 5b000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscoreei.dll"
|-6c7ec000 6c7ef000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscoreei.dll"
|-6c7ef000 6c7f0000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscoreei.dll"
|-6c7f0000 6c7f6000 6000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscoreei.dll"
* 6c7f6000 6d3b0000 bba000 MEM_FREE PAGE_NOACCESS Free
* 6d3b0000 6d3b1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/mscoree.dll"
|-6d3b1000 6d3f1000 40000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/mscoree.dll"
|-6d3f1000 6d3f5000 4000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/mscoree.dll"
|-6d3f5000 6d3fa000 5000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/mscoree.dll"
* 6d3fa000 731e0000 5de6000 MEM_FREE PAGE_NOACCESS Free
* 731e0000 731e1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-731e1000 73244000 63000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73244000 7326f000 2b000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-7326f000 73270000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73270000 73271000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73271000 73272000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73272000 73273000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73273000 73276000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
|-73276000 7327b000 5000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/WinSxS/x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4027_none_d08a21a2442db2dc/MSVCR80.dll"
* 7327b000 74640000 13c5000 MEM_FREE PAGE_NOACCESS Free
* 74640000 74641000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-74641000 74781000 140000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-74781000 74782000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-74782000 74783000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-74783000 74784000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-74784000 7478f000 b000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
|-7478f000 747de000 4f000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/WinSxS/x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0/comctl32.dll"
* 747de000 75a70000 1292000 MEM_FREE PAGE_NOACCESS Free
* 75a70000 75a71000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/LPK.DLL"
|-75a71000 75a76000 5000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/LPK.DLL"
|-75a76000 75a77000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/LPK.DLL"
|-75a77000 75a79000 2000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/LPK.DLL"
* 75a79000 75b10000 97000 MEM_FREE PAGE_NOACCESS Free
* 75b10000 75b11000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/KERNEL32.dll"
|-75b11000 75bde000 cd000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/KERNEL32.dll"
|-75bde000 75be1000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/KERNEL32.dll"
|-75be1000 75bec000 b000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/KERNEL32.dll"
* 75bec000 75cf0000 104000 MEM_FREE PAGE_NOACCESS Free
* 75cf0000 75cf1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/IMM32.DLL"
|-75cf1000 75d07000 16000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/IMM32.DLL"
|-75d07000 75d08000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/IMM32.DLL"
|-75d08000 75d0e000 6000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/IMM32.DLL"
* 75d0e000 75d10000 2000 MEM_FREE PAGE_NOACCESS Free
* 75d10000 75d11000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/MSCTF.dll"
|-75d11000 75d92000 81000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/MSCTF.dll"
|-75d92000 75d93000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/MSCTF.dll"
|-75d93000 75d94000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/MSCTF.dll"
|-75d94000 75dd8000 44000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/MSCTF.dll"
* 75dd8000 75de0000 8000 MEM_FREE PAGE_NOACCESS Free
* 75de0000 75de1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/GDI32.dll"
|-75de1000 75e26000 45000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/GDI32.dll"
|-75e26000 75e28000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/GDI32.dll"
|-75e28000 75e2b000 3000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/GDI32.dll"
* 75e2b000 76010000 1e5000 MEM_FREE PAGE_NOACCESS Free
* 76010000 76011000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/ole32.dll"
|-76011000 7613f000 12e000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/ole32.dll"
|-7613f000 76144000 5000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/ole32.dll"
|-76144000 76146000 2000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/ole32.dll"
|-76146000 76155000 f000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/ole32.dll"
* 76155000 76340000 1eb000 MEM_FREE PAGE_NOACCESS Free
* 76340000 76341000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/USP10.dll"
|-76341000 76397000 56000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/USP10.dll"
|-76397000 7639b000 4000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/USP10.dll"
|-7639b000 7639c000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/USP10.dll"
|-7639c000 763a7000 b000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/USP10.dll"
|-763a7000 763bd000 16000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/USP10.dll"
* 763bd000 763c0000 3000 MEM_FREE PAGE_NOACCESS Free
* 763c0000 763c1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/shell32.dll"
|-763c1000 76733000 372000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/shell32.dll"
|-76733000 7673b000 8000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/shell32.dll"
|-7673b000 76744000 9000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/shell32.dll"
|-76744000 76746000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/shell32.dll"
|-76746000 7674a000 4000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/shell32.dll"
|-7674a000 76ed0000 786000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/shell32.dll"
* 76ed0000 76ed1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/USER32.dll"
|-76ed1000 76f39000 68000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/USER32.dll"
|-76f39000 76f3a000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/USER32.dll"
|-76f3a000 76f3b000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/USER32.dll"
|-76f3b000 76f6d000 32000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/USER32.dll"
* 76f6d000 76f70000 3000 MEM_FREE PAGE_NOACCESS Free
* 76f70000 76f71000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/SHLWAPI.dll"
|-76f71000 76fc3000 52000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/SHLWAPI.dll"
|-76fc3000 76fc5000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/SHLWAPI.dll"
|-76fc5000 76fc9000 4000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/SHLWAPI.dll"
* 76fc9000 77050000 87000 MEM_FREE PAGE_NOACCESS Free
* 77050000 77051000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/RPCRT4.dll"
|-77051000 77109000 b8000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/RPCRT4.dll"
|-77109000 7710a000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/RPCRT4.dll"
|-7710a000 77113000 9000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/RPCRT4.dll"
* 77113000 77120000 d000 MEM_FREE PAGE_NOACCESS Free
* 77120000 77121000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/msvcrt.dll"
|-77121000 771be000 9d000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/msvcrt.dll"
|-771be000 771bf000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/msvcrt.dll"
|-771bf000 771c0000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/msvcrt.dll"
|-771c0000 771c2000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/msvcrt.dll"
|-771c2000 771c5000 3000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/msvcrt.dll"
|-771c5000 771ca000 5000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/msvcrt.dll"
* 771ca000 773c0000 1f6000 MEM_FREE PAGE_NOACCESS Free
* 773c0000 773c1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ntdll.dll"
|-773c1000 77484000 c3000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "ntdll.dll"
|-77484000 77487000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "ntdll.dll"
|-77487000 77488000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "ntdll.dll"
|-77488000 7748a000 2000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "ntdll.dll"
|-7748a000 7748d000 3000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "ntdll.dll"
|-7748d000 7748e000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "ntdll.dll"
|-7748e000 7748f000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "ntdll.dll"
|-7748f000 774e7000 58000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "ntdll.dll"
* 774e7000 774f0000 9000 MEM_FREE PAGE_NOACCESS Free
* 774f0000 774f1000 1000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/ADVAPI32.dll"
|-774f1000 7758a000 99000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READ Image "C:/Windows/system32/ADVAPI32.dll"
|-7758a000 7758b000 1000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/ADVAPI32.dll"
|-7758b000 7758c000 1000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/ADVAPI32.dll"
|-7758c000 7758f000 3000 MEM_IMAGE MEM_COMMIT PAGE_READWRITE Image "C:/Windows/system32/ADVAPI32.dll"
|-7758f000 77599000 a000 MEM_IMAGE MEM_COMMIT PAGE_WRITECOPY Image "C:/Windows/system32/ADVAPI32.dll"
|-77599000 775b6000 1d000 MEM_IMAGE MEM_COMMIT PAGE_READONLY Image "C:/Windows/system32/ADVAPI32.dll"
* 775b6000 7f6f0000 813a000 MEM_FREE PAGE_NOACCESS Free
* 7f6f0000 7f6f6000 6000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
|-7f6f6000 7f7f0000 fa000 MEM_MAPPED MEM_RESERVE MemoryMappedFile "PageFile"
* 7f7f0000 7ffa0000 7b0000 MEM_FREE PAGE_NOACCESS Free
* 7ffa0000 7ffd3000 33000 MEM_MAPPED MEM_COMMIT PAGE_READONLY MemoryMappedFile "PageFile"
* 7ffd3000 7ffdc000 9000 MEM_FREE PAGE_NOACCESS Free
* 7ffdc000 7ffdd000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [fec.a6c; ~2]
* 7ffdd000 7ffde000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PEB [fec]
* 7ffde000 7ffdf000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [fec.830; ~1]
* 7ffdf000 7ffe0000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [fec.bd0; ~0]
* 7ffe0000 7ffe1000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READONLY <unclassified>
|-7ffe1000 7fff0000 f000 MEM_PRIVATE MEM_RESERVE PAGE_NOACCESS <unclassified>
MEM_COMMIT 說明該內容已經在物理內存裏面。
MEM_RESERVE 說明該內容尚未與物理內存聯繫起來。這段內存是虛擬的內存空間。
比較了一下這些EXE/DLL和內存裏面的映像，每一個.net PE文件都是這麼裝載進內存的。都是有3段4096字節的空隙。是CLR在內存裏面裝配.net PE文件時，固定按照這個格式來裝載。ClassLibrary1.dll長度爲28,207,104字節, 十六進制是1AE6800，仔細對比一下文件和內存(MEM_COMMIT的那些段)，我們可以看到它的文件已經全部讀進來了。最關鍵的就是長度爲1ae6000的這一段。