WriteProcessMemory slowdown on Windows 10

Question

Hi,

Windows 10 seems to have introduced a performance bug when using WriteProcessMemory.
I prepared a simple repro here: https://gist.github.com/tivolo/26737684c38a2c409c95339cbd3cba5d

The repro application is about 100x (!) slower on Windows 10 than on earlier versions of Windows.

Is this a known bug?

Answer 1

The difference seems to be that WriteProcessMemory in KernelBase.dll calls NtQueryVirtualMemory under Win10, which is responsible for the slowdown I'm experiencing.

Answer 2

Hi,

Thank you for posting here.

Did you test the issue on other windows version?

About windows 10 issue, you can try to use feed hub of windows 10 to submit issue.  According to your description, the issue seems to be windows SDK library, you can post the issue on windows sdk forum.

I also test your demo. If I get new information, I will tell you

Best Regards,

Hart

---

MSDN Community Support Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact [e-mail].

Answer 3

Tested the repro on the following versions:

Windows 10 Professional: ~2200ms

Windows 10 Enterprise: ~4800ms

Windows 8.1 Enterprise: ~20ms

I don't have access to a Win7 machine at the moment.

Answer 4

@Stefan,

I can reproduce this from my side. On windows 8.1 it is 73ms and on windows 10 which has the same setting it is 9780ms. I will try to see if I can consult this for you.

Best regards,

Barry

---

MSDN Community Support
Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact [e-mail].

Answer 5

This may be due to the defenses against the speculative execution bugs, "Meltdown" and "Spectre".  Those fixes change the access mechanisms from kernel code into user processes.

---

Tim Roberts, Driver MVP Providenza & Boekelheide, Inc.