Process Explorer
(aka procexp
) require debug symbols to show kernel memory limits and a library that provide API for reading them. As I found, the symbols for currently running kernel (ntoskrln*
) only are required, and the variables MmSizeOfPagedPoolInBytes
and MmSizeOfNonPagedPoolInBytes
are read from it. It is possible to acquire them from the kernel directly.
So why the debug symbols are required? Do they contain some information that impossible to get from the OS itself?
↧
Why does Process Explorer require debug symbols to show kernel memory limits?
↧