Hot Add Memory and Physical Memory

Jul 08, 2015

Physical Memory is a very challenging target to support.

Basically, if we are too invasive we run the risk of having the subject computer crash. These crashes or Bluescreens (BSOD) are not only traumatizing to the end user, but often they can be quite bad for the computer itself. Simply put, not being able to safely shutdown can cause a myriad of different issues during the next boot.

As you would imagine, this means we go to great lengths to error on the side of caution when presenting Physical Memory. As such we use different mechanisms to review the physical memory and mark specific ranges as "off limits" based on the responses from the operating system.

We find this to be the safest path forward, however it does mean that from time to time F-Response avoids pages of memory that may contain useful content. This could be caused by any number of things, 3rd party drivers, hardware, and now, VM settings.

Essentially, virtual machines configured with Hot Add Memory support tend to create very large "off limit" ranges. Frequently the operating system itself is not using Hot Add memory features at all and it's a simple matter to disable it prior to the next reboot.

In VSphere simply select the Virtual Machine and open the settings dialog, you will find the option under Advanced->Memory/CPU Hotplug.

In VMWare Workstation and Fusion simply edit the .VMX file for the virtual machine and modify the mem.hotadd = "TRUE" to mem.hotadd = "FALSE"

Now, as you would imagine these aren't the only ways memory can be rendered hard to access by 3rd party drivers and software, but it is a great first step when troubleshooting a sparse memory image from a virtualized machine.

If you run into other systems where the memory images appear incomplete or are otherwise inaccessible we would love to hear from you. There are a few things we can try to help you get more data, but just as importantly it will give us an opportunity to get valuable information which may make its way into future F-Response releases.

Thanks!

Matthew Shannon, Principal
F-Response