Skip to main content

 none
WriteProcessMemory slowdown on Windows 10 RRS feed

  • Question

  • Hi,

    Windows 10 seems to have introduced a performance bug when using WriteProcessMemory.
    I prepared a simple repro here: https://gist.github.com/tivolo/26737684c38a2c409c95339cbd3cba5d

    The repro application is about 100x (!) slower on Windows 10 than on earlier versions of Windows.

    Is this a known bug?

    Tuesday, April 3, 2018 7:36 PM

All replies

  • The difference seems to be that WriteProcessMemory in KernelBase.dll calls NtQueryVirtualMemory under Win10, which is responsible for the slowdown I'm experiencing.
    Tuesday, April 3, 2018 8:51 PM
  • Hi,

    Thank you for posting here.

    Did you test the issue on other windows version?

    About windows 10 issue, you can try to use feed hub of windows 10 to submit issue.  According to your description, the issue seems to be windows SDK library, you can post the issue on windows sdk forum.

    I also test your demo. If I get new information, I will tell you

    Best Regards,

    Hart


    MSDN Community Support Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Wednesday, April 4, 2018 7:05 AM
    Moderator
  • Tested the repro on the following versions:

    Windows 10 Professional: ~2200ms

    Windows 10 Enterprise: ~4800ms

    Windows 8.1 Enterprise: ~20ms

    I don't have access to a Win7 machine at the moment.

    Wednesday, April 4, 2018 9:55 AM
  • @Stefan,

    I can reproduce this from my side. On windows 8.1 it is 73ms and on windows 10 which has the same setting it is 9780ms. I will try to see if I can consult this for you.

    Best regards,

    Barry


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Thursday, April 19, 2018 8:54 AM
  • This may be due to the defenses against the speculative execution bugs, "Meltdown" and "Spectre".  Those fixes change the access mechanisms from kernel code into user processes.

    Tim Roberts, Driver MVP Providenza & Boekelheide, Inc.

    Friday, April 20, 2018 11:34 PM