Does detours need huge extra memory?

[jizhideyu]

I use DetourCreateProcessWithDll to create my app process and find the process use 1.6g memory in win task-manager view. Normally, my app use 0.8g memory in win task-manager view.
It's confuse that i can only catch the 0.8g memory using (by hooking NtAllocateVirtualMemory and VirtualAlloc ) when use DetourCreateProcessWithDll.
I want to know what's the problem?

[dstd]

@jizhideyu if you use sucha formatting to force everybody to give up reading your message looks like you achieved your goal..

[jizhideyu]

@dstd I'm sorry. I have edited my comment.

[Arefu]

Not an expert by any means, but would this have something to do with it?

After the detour DLL has been loaded, it should reverse changes to the in-memory import table by calling DetourRestoreAfterWith. To facilitate reversing these changes, DetourCreateProcessWithDll copies relevant reversal data into a payload in the target process using the DetourCopyPayloadToProcess API. The loaded DLL should call the DetourRestoreAfterWith API to restores the contents of the import table.

[dtarditi]

@jizhideyu, did you ever figure out what was going on? No, Detours doesn't normally use huge amounts of extra memory. It could increase your virtual memory usage through its placement of the modified import tables. But it should not increase your physical memory usage significantly.