Dude, where’s my RAM? (aka ShellExperienceHost steals my stuff)

So, there I was at my computer one night and I realized “wow, this thing is slow, wth”. No really, that’s what happened, scouts honor.

So I fired up TaskManager, my favorite level 1 triage tool.

taskman.png

And ZOINKS yo! (as Jay from Jay and Silent Bob fame is wont to say)

1.8GB of RAM. Not, like, stuff anywhere, but code in my RAM. Now granted, I have 24GB installed, but still. Why do bro?

So why is this happening? Let us discover why, on a vision quest-esque journey through Windows….

To find out what is going on, we need the PID, luckily for us, it’s right in front of us;

pid.png

Ok, so what are we going to do with that?

rammap1.png

We are going to check out the process and see what is going on here…

With VMMAP. Why? Dunno. Lets see.

heap.png

Ok so we attached VMMAP to the process, we see it’s all heap. The reason I did this, really, is because I had a pseudo-morbid curiosity that it might be META, but it’s heap. Okie, so spewage. Swell. Why? Dunno.

In comes Debug Diag 2.2

dd1.pngWhy yes Mr DebugDiag2.2, we want to analyze, (I hit cancel here btw)

dd2.png

Find the PID, create a dump for later perusal, why not.

dd3.png

Yay!

For fun I check strings on the process…w…t…h..strings.png

Apparently MeowMix took over my process….

whatevar.png

I right click, and tell DebugDiag to create a series of dumps on the process, start with a full, end with a full, make 8 dumps, 10 seconds apart. Ok? Ok!

working.png

Now we’re cookin with gas!

proof.png

Hey look, dumpage!

analysis.png

Now I fire up the easy button. Do you have an easy button? Mine is named “DebugDiag 2 Analysis”.

anal1.png

I check “PerfAnalysis” cause it’s a series of dumps, and leaktrack would not insert so it’s not present to track on.

anal2.png

Add the dumps, and start (assuming you have a valid symbol path, I do).

Ok, so why are we taking up 1.8 GB of ram for a suspended process in Windows?

I hate to say it, I really do. Cause I like these guys, but it looks like it might be Nvidia….

derp.png

DebugDiag’s report is a clarion call from on high. Update yo drivers sir!

Someone already bitched, and they bitched August 1st.

NVIDIA Drivers hanging Outlook

Someone did my work for me. They have the same stacks complaining, just different Thunks. Thunk!

You ain’t thunk, you ain’t nothin!

Anyway I was on 384.94 courtesy of WU, 385.28 released 8/14. A little behind. But still my problem persists….after updating.

 

Sigh… maybe someday I can has my RAM back?

nvwgf2umx_cfg!NVAPI_Thunk+9ce75
nvwgf2umx_cfg!NVAPI_Thunk+d001a
nvwgf2umx_cfg!NVAPI_Thunk+7b736d

kinda reads like a haiku….a haiku of eating my ram….or maybe Windows needs 2GB now to display the shell? The world may never know.

This post brought to you by the gram positive cocci that put me in the hospital last week.

Misadventures in BIOS updates

So I’m on a new-ish motherboard from ASUS that has an AM4 socket for my Ryzen 1700x processor. So far so good right? Well, ASUS released a new BIOS update that “Update AGESA to 1.0.0.6a”. This sounded awesome, or at least a fix, as BIOS 0803 updated to 1.0.0.6 and was noticeably no longer on the download page…

dudewheresmybios

So I updated. What could possibly go wrong?

So, the new bios 805 appears to have an issue with mixed DRAM configurations where it marks RAM bank B as present, but Windows sees it as hardware reserved and BIOS doesn’t account for it…

IMG_A

So above is the problem case, note memory is 16384, even though DRAM status sees all 4 sticks and they amount to 24GB…

vurt.png

It’s been my experience that computers are generally good at math, at least better than I am at it…so…yeah.

I dorked around, on a whim. I reboot, force D.O.C.P. config (whatever that is). We are now good after 1 reboot for D.O.C.P. to take effect. #becausesunspots

IMG_B.jpg

Yay!

Now, the bad part, when I do this it reboots (naturally), but then fails to post 3 times and recovers). I have to hit F1 (apparently D.O.C.P. means “OVERCLOCKME BADLY”. Since, well, it thinks my DDR4 RAM is capable of 2667 when it is capped at 2400. Whatever.

So I disable D.O.C.P., now I have my memory accounted for properly?!

IMG_C.jpg

Shrug.

Homophobic space nazis here on earth to buy remaindered furniture.

or something.