RE: Flushing DLLs from memory

From: Kinsey, Robert (Robert.Kinsey@Veridian.com)
Date: 10/23/01 

Message-ID: <7408C3158945264B85D07250D7A2C801575530@satxmail.tds.com>
From: "Kinsey, Robert" <Robert.Kinsey@Veridian.com>
To: "'H C '" <keydet89@yahoo.com>, "'forensics@securityfocus.com '" <forensics@securityfocus.com>, "'focus-ms@securityfocus.com '" <focus-ms@securityfocus.com>
Subject: RE: Flushing DLLs from memory
Date: Tue, 23 Oct 2001 09:29:50 -0700

HC, & all:

---------snip-------------
I've been looking into 'live' forensics issues on
NT/2K, and one thing I'm not having any luck with is
how to flush DLLs from memory.

---------snip-------------

I've recently found two tools on the (may God forgive me) PC World download
site. They are freeware but both (i *think*) have a "pro" version for a few
$'s. One is called Clean System (???) which hunts down the dlls in the dll
cache and compares against the programs installed. Any DLL that is not
actively associated with an installed program is listed for you. Those
listed can be moved to a \backupdll dir on Win(dows/Nt)\system(32)\ dir.
The software cautions you against removing the files right away.

The other tool is a RAM mgmt tool that also removes any stale DLL out of the
cache/RAM. It is called CacheMan (there is another one called WinRAM
Turbo). Seems to perform as advertised - has a straight forward GUI -
allows you to adjust the amount of RAM optimized.

These sound like what you are looking for.

rk

Relevant Pages

  • Re: Memory limit reached with Windows Mobile
    ... I do understand what a test is, and I do understand how memory management ... ctacke: re-read Patrick's questions, ... 1- Load the same DLL over and over. ... Loading native DLLs takes at least 64k each. ...
    (microsoft.public.pocketpc.developer)
  • Re: Explicit loading does not work
    ... This utility just prints virtual memory layout for the application with XIP attributes if any. ... Application DLLs can not be loaded at the address where XIP dlls reside. ... when this space is out, HeapAlloc begins allocating virtual memory from the XIP ...
    (microsoft.public.windowsce.embedded.vc)
  • Re: Memory limit reached with Windows Mobile
    ... ctacke: re-read Patrick's questions, ... 1- Load the same DLL over and over. ... Loading native DLLs takes at least 64k each. ... good thing due to the 64k minimum virtual memory size each will take. ...
    (microsoft.public.pocketpc.developer)
  • Re: Memory limit reached with Windows Mobile
    ... That would explain the memory problem - you just can't do that. ... You have to load stuff when it's ... All native DLLs get loaded ...
    (microsoft.public.pocketpc.developer)
  • Memory limit reached with Windows Mobile
    ... We are currently having memory issues with our Pocket PC application. ... 2003 and the Compact Framework 1.0 SP3. ... If a process loads 4 Mb of DLLs, then 8 Mb of data, he can no ... longer load DLLs, ...
    (microsoft.public.pocketpc.developer)