1024programmer Asp.Net The last reflection on the .NET program’s 2G virtual address nervousness and crash

The last reflection on the .NET program’s 2G virtual address nervousness and crash

The last reflection on the nervous collapse of 2G virtual address of .NET program

one: background

1. Storytelling

Recently, I have encountered several cases of program crashes caused by 2G virtual address shortage. Basically 90% of them are concentrated in the medical industry. I am really speechless. They all use some ancient XP. Windows7 x86, I also know that it is difficult and basically impossible for technical people to promote the upgrade of hardware systems and equipment. This contains a huge amount of human sophistication.

The purpose of writing this article is to systematically organize how to configure the 3G switch to allow the program to use more memory, so that the program crashes less frequently, and how to verify whether it is successfully turned on!

Two: 32-bit operating systems

1. Test code

First of all, everyone must have a concept: programs running on 32bit systems can only use 2G of memory by default, because this involves fairness. The user state eats 2G and the kernel state eats 2G. To facilitate the demonstration, stuff it into a List. Enter a 5000W string, which takes up about 2G of memory, and then run the program on the Windows7 32bit operating system.

         static void Main(string[] args)
             var list = new List();

             for (int i = 0; i < 50000000; i++)

                 if (i % 10000 == 0) { Console.WriteLine($"i={i}"); }


From the picture, you can clearly see that when the memory reaches 631M, it can no longer hold it. Some friends may be curious as to why it can’t hold it at this small amount. This is because the bottom layer of List is 2 times expansion, so the memory will probably increase to 0.63G + 1.2G = 1.83G.

Some friends may ask, isn’t this not yet 2G? Generally speaking, when the memory reaches 1.2G+, the risk of crash will increase sharply. This should be kept in mind!

2. How to solve

As I said just now, the current situation of the medical industry can only be promoted through human connections. So is there really nowhere to put this 2G data? At this time, you can only turn on the 3G switch, so how to turn it on?

  1. Enable program-level Large Address Aware

This Large Address Aware field is commonly known as Large Address. The way is to turn on a switch in the PE header to let the Windows loader decide whether to open the 3G green channel for the program.

Of course, there are many tools for viewing PE headers. For .NET programs, I personally feel that the best one is to use DnSpy, which concretizes the Characteristics field in the File Header. We select the Large Address Aware checkbox and save it. The screenshot is as follows :

  1. Enable machine-level 3G switch

It is very prudent for the operating system to allow user-mode programs to use 3G of memory on a 32-bit operating system. After all, it is very unfair to the kernel mode. The implication is to give up 1G of its own memory to the user mode. This You may get yourself into trouble if you perform frivolous operations. To be cautious, you need to manually turn on the 3G switch at the machine level. The command is as follows:

 bcdedit /set IncreaseUserVa 3072


After completing these two steps, continue to let the program run. The screenshot is as follows:

It can be clearly seen from the picture that it is finally promising.

For more operating system configuration, please refer to this article: https://www.autodesk.com.cn/support/technical/article/caas/sfdcarticles/sfdcarticles/CHS/How-to-enable-a-3GB -switch-on-Windows-Vista-Windows-7-or-Windows-XP-s.html?v=2018

3. How to verify whether 3G is turned on

This is indeed a good question. The easiest way is to use !address to observe the address space.

 0:000> !address

   BaseAddr EndAddr+1 RgnSize Type State Protect Usage
 --------------------------------------------------  ----------------------------------------
 + bffde000 bffdf000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~0; aa4.fb8]
 + bffdf000 bffe0000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PEB [aa4]
 + bffe0000 bfff0000 10000 MEM_PRIVATE MEM_RESERVE PAGE_NOACCESS 

 0:000> ? bfff0000/0x100000
 Evaluate expression: 3071 = 00000bff


The bfff0000 in the hexagram above is converted to 3G. If you see this value, congratulations!

If anyone wants to ask how to verify whether the dump program has enabled large addresses, you can use windbg to provide this.!dh command provided.

 start end module name
 001e0000 001e8000 ConsoleApp4 C (pdb symbols) D:\code\MyApplication\ConsoleApp4\obj\x86\Debug\ConsoleApp4.pdb
 66dd0000 678c8000 mscorlib_ni (deferred)
 678d0000 67e61000 mscorwks (deferred)
 6c7a0000 6c83b000 msvcr80 (deferred)
 0:000> !dh ConsoleApp4

      14C machine (i386)
        3 number of sections
 EDB20AC7 time date stamp
        0 file pointer to symbol table
        0 number of symbols
       E0 size of optional header
      122 characteristics
             App can handle >2gb addresses
             32 bit word machine


If you see the words App can handle >2gb addresses in the hexagram above, it means you have successfully opened it!

Three: 64-bit operating systems

1. How to eat more memory

It is much more convenient on the x64 system. You only need to do the first step to turn on Large Address Aware. After all, the virtual address space of the x64 system should not be too sufficient. It is on the 48-root address bus. 2 to the 48th power, so after turning on the large address, it will give the x32 program 4G of addressing space, which is 2 to the 32nd power.

Next, directly move the ConsoleApp4.exe program from Windows 7 x86 to Windows 10 x64 system, and then use windbg to run it additionally. After running, use !address to view it.

 0:007> !address

   BaseAddr EndAddr+1 RgnSize Type State Protect Usage
 --------------------------------------------------  ----------------------------------------
 + 0 c60000 c60000 MEM_FREE PAGE_NOACCESS Free
 + ff671000 ff680000 f000 MEM_FREE PAGE_NOACCESS Free
 + ff680000 ff6b3000 33000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [NLS Tables]
 + ff6b3000 ffff0000 93d000 MEM_FREE PAGE_NOACCESS Free

 Evaluate expression: 4095 = 00000fff


If you also see the above ffff0000 in your hexagram, congratulations, the memory addressing space of your program has been expanded to 4G.

Three: Summary

I have said so much in this article. In fact, they are all things that have to be done. It is very sad. Many things in this world cannot be solved by technology, but more by human relationships!

Picture name

This article is from the internet and does not represent1024programmerPosition, please indicate the source when reprinting:https://www.1024programmer.com/808576

author: admin

Previous article
Next article

Leave a Reply

Your email address will not be published. Required fields are marked *

Contact Us

Contact us


Online consultation: QQ交谈

E-mail: [email protected]

Working hours: Monday to Friday, 9:00-17:30, holidays off

Follow wechat
Scan wechat and follow us

Scan wechat and follow us

Follow Weibo
Back to top