Windows 8 Memory Management

Since Windows 8, there are now two Swapfiles: pagefile.sys and swapfile.sys.


Until today, this file was at least as big as your physical memory. Per default, windows sized this file like RAM*1.5. This also was to reserve enough space for the per default enabled kernel memory dump (system properties -> advanced -> startup and recovery).

On Windows 8 there’s a new option to configure the memory dump called “automatic memory dump”. Automatic means if there’s enough space at the moment of the crash, it’ll do a full dump; if not, Windows just writes a small dump.




swapfile.sys is a system controller file, normally around 256MB. It’s used by Metro style applications that don’t fit the traditional paging characteristics (such as usage pattern, growth, space reservation) of pagefile.sys. One example of swapfile.sys usage is the suspend/resume of Metro-style applications; however, this is not the only use.

You’ll find more detailed technical description here:

About hiberfil.sys

This file was as huge as the total amount of RAM installed in your computer. Now it will be sized for 75% of the physical memory but only has 10-15% of that size of data in it. That’s because of two main things: (1) the traditional desktop only gets loaded after a user explicitly needs it. This reduces the Memory usage of the Kernel. And (2) Windows Quick-Boot (“clean slate”) closes User sessions before shutting the computer down.

To change the size of hiberfil.sys use this command:

powercfg /hibernate /size

To “full”-shutdown the computer:

shutdown /s /full /t 0

Memory Deduplication

As explained in the MSDN Blog for Windows 8, the MS developers implemented a background job that searches for memory of Applications, that is allocated for future use and initialized with all the same value. As they noticed, applications may never actually use this memory because it’s there waiting to be used for a function that maybe never gets invoked. So if multiple applications are doing this, there’s redundant memory.

The technique’s called “Memory combining” and is already known on ESX servers where redundant copies of memory are combined once to save physical memory. VMware calls it “shared memory”. As soon as the only copy of memory gets modifies by an application, the modified data gets a private copy of it. As written in the Blog: “All of this happens under the covers in the memory manager, with no impact on applications.”


Other ways to reduce memory consumption

There’s a new Startup Mode for Windows Services called “start on demand”. Those services only get started if they’re triggered by the OS. An example for this could be a newly plugged in USB device.


32-bit Architektur

Ein 32-bit System hat einen Adressraum um Geräte zu adressieren. Dieser würde knapp ausreichen um ganze 4GB Ram zu adressieren, doch die restliche Hardware des Computers muss auch irgendwie angesprochen werden können.

Physical Adress Extension (PAE)

Durch diese Gegebenheit ist eine “Physical Adress Extension” nötig, welche es ermöglicht einen grösseren Adressraum als nur 32-bit zu verwenden. Bei verwendung der Option “/pae” werden insgesamt 36-bit eingesetzt, dies ermöglicht eine Adressierung von bis zu 64GB Ram.

Data Execution Protection (DEP)

PAE wird auf einem Computer welcher DEP unterstützt und auf welchem ein 32-bit OS läuft automatisch aktiviert. In der boot.ini wird DEP mit der Option “/noexecute” gesteuert.

DEP ausschalten, Windows XP

Wird DEP unter Windows XP ausgeschaltet, wird auch gleichzeitig PAE ausgeschaltet. Diese kann aber wieder durch angabe des Switches “/pae” aktiviert werden.

DEP deaktiviert:

“/noexecute=alwaysoff” entspricht automatisch “/noexecute=alwaysoff /nopae”

DEP deaktiviert, aber PAE aktiviert wäre somit:

“/noexecute=alwaysoff /pae”

DEP ausschalten, Windows 2003

Anders als bei Windows XP wird bei Server 2003 PAE nicht deaktiviert wenn “/noexecute=alwaysoff” gesetzt ist, selbst nicht bei Angabe des “/nopae” Parameters. Um hier beide Optionen wirklich auszuschalten muss der spezielle Parameter “/execute” verwendet werden (gültig ab Windows Server 2003 SP1).