Recently, I put together a Twitter thread ranting about my experience with a memory leak in Windows 10. Since it’s gone, I figured I’d share the story.
Table of Contents
As I mentioned, I already told a short version of this story in a Twitter thread. In fact, I was so proud of myself, I couldn’t help but share with the three people that interact with my tweets.
Naturally, the complete story is below, but this one is definitely quicker to read.
Programmers Use Computers Too
One of the things I find interesting about being in tech is that there’s this hidden assumption that we know how computer work. Even someone like me who has a computer engineering degree has very limited knowledge of how computers work.
In general, my understanding of computers and computer architecture comes from my understanding of digital logic. In other words, I’m familiar with logic gates and simple circuits like adders.
In addition, I’m familiar with all of the major pieces of hardware that go into building a computer—think processors, graphics cards, RAM, etc. In fact, I built my own over three years ago.
In some cases, I’m even aware of how these components work at a high level. For example, I know about pipelining in processors. I’m also familiar with the memory hierarchy in processors (e.g. L1, L2, L3 caches). Hell, I’m aware of some of the data synchronization challenges associated with multicore processing.
On the other end of the spectrum, I’m obviously very familiar with programming. For example, most of the content I write about is Python appreciation content. As a result, I’m familiar with the high-level software ecosystem and how programming languages interface with the processor.
Despite all this knowledge, at no point would I consider myself “good” with computers. The reality is that I can be very aware of how computers work but lack the expertise to navigate the systems that we build with them. This is especially true for operating systems and applications
As a result, I run into the same sort of issues that most folks do when they use a computer. For example, I forget my passwords just like anyone else. That’s why I use a password manager. Likewise, I find certain interfaces difficult to use.
Cleaning Up Windows
Recently, I ran into an issue where my computer was slowing down. Having built it to stand the test of time, I had assumed I would have gotten more than 3 years out of it—especially given the price tag. Yet, it was very slow.
If I was younger, I might have formatted the harddrive and started fresh. These days I don’t really have that kind of time. As a result, I usually try to run the typical diagnostics. For example, I might use CCleaner to remove junk from my PC. Likewise, I might defragment my hard drive. Hell, I’d probably even run a virus scan.
If things don’t shape up, I usually begin trimming fat. For example, I might go through old programs and start removing the ones I don’t use. Likewise, I usually go through the list of startup programs and disable the ones that add no value.
At this point, a lot of sites will recommend updating drivers. Of course, I don’t think updating drivers is a very intuitive process. For me, it involves opening up tools like MSI Live Update and NVidia GeForce Experience. That said, this differs for everyone. Ultimately, I will usually check Windows Update.
If things are particularly bad, I usually lean on the black magic of console commands. For example, I know the following commands are common ways of checking for and fixing corrupt files on windows:
sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth
In general, I assume these are healthy commands to run, but I always leave them as a last resort. Regardless, this is usually the process I follow.
When All Else Fails
Of course, recently, I ran into an issue where my computer was getting particularly slow, and none of these solutions were helping. I knew the issue was memory related, but Task Manager wasn’t giving me any clues. It would tell me that my memory was maxed out, but it wouldn’t tell me which process was eating it up.
That said, the problem was pretty easy to solve in the short term. All I had to do was restart my computer, and the issue would go away temporarily. With a solid state drive, I was barely even inconvenienced.
Over time, of course, this got a bit more annoying. In fact, it bothered me so much that I decided to buy more RAM. Again, this was my way of delaying the inevitable. Rather than actually solving the problem, I figured I could defer it long enough that it would be a nonissue.
Even with the extra RAM, I was noticing the same issue. While part of me felt like I threw away $70, I also knew that there was a surefire solution to this whole issue: format my hard drive.
There were basically two reasons why I held off on this for so long. First, I had this fear in the back of my mind that the issue wasn’t Windows related. In other words, I was worried that I would go through all of the effort to format my hard drive and install all my applications just to run into the same issue again.
Second, formatting hard drives just take too much time. Well, the formatting part is quick, but reinstalling Windows is a huge pain. After all, you have to reinstall all of your programs, sign back into all your website and applications, etc. It’s not a fun time, and it takes away from being able to do what you want.
Of course, by not solving this issue, I would be doing myself a disservice. For example, if for some reason the issue got worse, I would be forced to reinstall Windows anyway. In other words, I could have just done that in the first place.
Diagnosing a Memory Leak
Today, the memory leak issue reached peak frustration for me. As a graduate student amidst a pandemic, I spend literally my entire day on Zoom. With each passing meeting, I could feel my system getting slower and slower.
By 5 o’clock, I turned my computer off and walked away. When I came back to it and fired it up, it was like I had never turned it off. When I opened Task Manager, it claimed Chrome and Backblaze had eaten up all my RAM with a grand total of maybe 2 GB worth of usage.
As I sat their, I decided to make the following search on Google:
windows claims all memory is in use
Honestly, I had no other way I could phrase it. Task Manager was claiming I was out of resources despite literally no active processes. In other words, either Windows is drunk or something in OS was just having a field day with my RAM.
Right away, the first article I skimmed mentioned network usage which seemed odd. That said, I took the advice of the first suggestion and checked my drivers; nothing needed updated.
Rather than jumping straight into the second solution which mentioned editing registry keys, I decided to continue searching. That’s when I found this forum post which referenced a tool called RAMMap for looking at how RAM is being used. When I use it now, it shows the following:
Of course, when I ran it previously, it basically showed an enormous brown bar filling up all the empty space. Mapping that to the key would indicate that we’re dealing with the nonpaged pool. At the time, I had no idea what the non-paged pool was, so I searched it directly: “nonpaged pool memory”.
Fixing a Memory Leak
Eventually, Google led me to yet another article which shared several solutions. If you take a peek, you’ll notice the first solution is exactly the same as the solution from the other article I already referenced. In other words, the solution was to disable Windows Network Data Usage Monitoring Driver.
Now to do this, I had to go into the registry and manually edit some value from 2 to 4. Obviously, these articles never explain how or why this works, but I was willing to risk it.
To my surprise, when I launched my computer, the issue was completely gone. No, seriously! Look at this:
This image captures the state of my computer while writing this article. Notice how the “Non-paged pool” memory is at a respectable 342 MB rather than the ridiculous number of GB it was sitting at previously. In addition, memory is chilling at a casual 26%. Like, I can hardly believe my eyes.
Even more importantly, my processor is running around 30C. No longer am I roasting my CPU because it’s forced to run to disk just to load a web page. This is seriously a dream come true!
Maximizing My New RAM
Now that the memory leak is gone, I can finally take advantage of my two monitors. One thing I was noticing was that I couldn’t play games and watch Twitch streams at the same time. For some people that might seem like overkill, but it really helps kill the queue times in Overwatch.
On top of that, I sometimes like to have notes open for my reading. Likewise, it wouldn’t be crazy for me to have a tab of Twitter open. Hell, I wouldn’t stray from entertaining a Discord call as well—which includes a little bit of streaming of my own.
And sure, I’m probably running too many applications, but I built my PC to handle it. Up until a few months ago, it was doing just that. Then, Windows decided to hit me with a nasty memory leak; one that I couldn’t track down easily.
Hopefully, this story helps some folks in the future. I know I had been searching around for notes on how to diagnose a memory leak in Windows, and none of them were as helpful as that forum post that led me to the RAMMap tool. Thank goodness I was able to finally figure it out!
If you found this helpful, I’d appreciate it if you showed your support. One way you can do that is by heading over to my list of ways to grow the site. Over there, you’ll find links to my Patreon as well as my YouTube channel and newsletter.
Otherwise, take care! Come back soon.
Kicking off a new series of reverse engineering content inspired by VirtualFlatCAD. Today, we're trying to roll our own uppercase function.
When it comes to capitalizing strings in Python, you have a few options. Use the tools Python provides or roll your own.