AppDefend and Physical Memory Access...

[dja2k]

When appdefend asks for memory access from a specific program, everything freezes or slows down for a bit then allows you to press allow or block. Is that nromal? For instance, Ewido.

dja2k

[Jason_R0]

-{ Quote: "When appdefend asks for memory access from a specific program, everything freezes or slows down for a bit then allows you to press allow or block. Is that nromal? For instance, Ewido.

dja2k" }-

Hi Dja2k,

I don't think its normal for your system to slow down for no reason. However if you install software like Ewido (you will have to ask the authors themselves what it does) there is a chance that it can use CPU time and appear to slow down your system, simply by doing what it is designed to do.

The physical memory access alert from AppDefend however, is no different to any other alert and there is no reason why that in particular should slow down your system.

[Kegel]

-{ Quote: "Hi Dja2k,

I don't think its normal for your system to slow down for no reason. However if you install software like Ewido (you will have to ask the authors themselves what it does) there is a chance that it can use CPU time and appear to slow down your system, simply by doing what it is designed to do.

The physical memory access alert from AppDefend however, is no different to any other alert and there is no reason why that in particular should slow down your system." }-


When that alrert comes up it DOES slow down the system dramatically on ALL my PC's. Always has. AppDefend is PREVENTING this access until you allow it. If the program needs to access memory and you dont let it, common sense says there will be some negative effect, Agreed? All my games do this as well.

No offense man but come on.......dont send this guy on some wild goose chase looking for solutions when it is OBVIOUS APpDefend and the prevention of access to physical memory is the problem...maybe by design but it is a probelm nevertheless.

[Jason_R0]

-{ Quote: "When that alrert comes up it DOES slow down the system dramatically on ALL my PC's. Always has. AppDefend is PREVENTING this access until you allow it. If the program needs to access memory and you dont let it, common sense says there will be some negative effect, Agreed? All my games do this as well.

No offense man but come on.......dont send this guy on some wild goose chase looking for solutions when it is OBVIOUS APpDefend and the prevention of access to physical memory is the problem...maybe by design but it is a probelm nevertheless." }-

Hi Kegel,

It is impossible for AppDefend to cause the slowdown, because it suspends the operation in a NON cpu wasting way. As such the only waste cpu cycles must be coming from elsewhere.

Just because AppDefend makes the system exhibit a symptom doesn't mean the problem wasn't there to begin with.

[Kegel]

-{ Quote: "Hi Kegel,

It is impossible for AppDefend to cause the slowdown, because it suspends the operation in a NON cpu wasting way. As such the only waste cpu cycles must be coming from elsewhere.

Just because AppDefend makes the system exhibit a symptom doesn't mean the problem wasn't there to begin with." }-


It wasnt there to begin with and goes away when the program is disabled. PG displays the same behaviour. Trust me on this one man...its the app. Mostg Games will absolutely crash if you dont allow physical memory access BEFORE you launch the game as once you lauch it is usually too late....the mouse freezes or moves at like a pixel a minute....sometimes the game outright crashes. I dont use AD any longer because of this and have limited myself to RegDefend only. Its too cumbersome to have to add everything manually. I end up having to have almost every app I use in the exceptions list (lots of .net apps)...seems kind of counter productive.

[Jason_R0]

-{ Quote: "It wasnt there to begin with and goes away when the program is disabled. PG displays the same behaviour. Trust me on this one man...its the app. Mostg Games will absolutely crash if you dont allow physical memory access BEFORE you launch the game as once you lauch it is usually too late." }-

Hi Kegel,

Your problem and the original posters problems are two different things. DirectX or OpenGL applications seem to require physical memory access to work correctly, as you pointed out. And they don't seem to handle being blocked from doing so in a fashion which you would consider elegant. I have been looking into this for a future build to help games work better with AppDefend.

AppDefend is an advanced utility which ALTERS the way the system works, as such some applications which are hard-coded to work a certain way may not appreciate it being changed. It is up to me as the developer to work around these situations.

The original posters question was relating to slowdown in regards to a physical memory alert. I was just pointing out how it couldn't be AppDefend. If you want to start a new thread about physical memory access and directx/opengl applications then please feel free to do so.

[dja2k]

Sorry Jason, but it is AppDefend! Check out my other thread... http://www.wilderssecurity.com/showthread.php?t=104673&highlight=dja2k And actually no it is not just ewido. Winamp, WMP, Media Player Classic, Limewire, and some websites that use java routine like chat rooms do it too. They all cause the same thing, slowdown until you allow access to physical memory. Now the point is Process Guard used to do that too, not so much of a slowdown like AppDefend, but DiamondCS never found an explaination for it, so I thought maybe I was dealing with a new deck of cards with AppDefend.

dja2k

[Jason_R0]

-{ Quote: "Sorry Jason, but it is AppDefend! Check out my other thread... http://www.wilderssecurity.com/showthread.php?t=104673&highlight=dja2k And actually no it is not just ewido. Winamp, WMP, Media Player Classic, Limewire, and some websites that use java routine like chat rooms do it too. They all cause the same thing, slowdown until you allow access to physical memory. Now the point is Process Guard used to do that too, not so much of a slowdown like AppDefend, but DiamondCS never found an explaination for it, so I thought maybe I was dealing with a new deck of cards with AppDefend.

dja2k" }-

Hi Dja2k,

I know it seems like AppDefend, but it is just a symptom which AD happens to show you. There is better handling of physical memory for such applications in the next build.

[dja2k]

Thanks Jason, that is all I needed to hear....

dja2k

[nameless1]

I've received many alerts for programs trying to access Physical Memory. Without exception, each time the alert appeared, the system was almost 100% frozen. Even moving the mouse cursor is near impossible--each time, I have to guess where the cursor needs to go, because it doesn't move in real time, it freezes and them jumps suddenly after several seconds of a near-total system freeze.

This has happened to me with all sorts of applications, including Media Player Classic, BurnInTest Pro, Everest, the application I use to join video files, Firefox (yes, Firefox!), RivaTuner, Google Earth, javaw.exe (for Azureus), rundll32.exe, Virtual PC, and many more. I don't think that these are all OpenGL/DirectX-related applications.

[Rodehard]

If you can go through the speed tests here http://www.dslreports.com/stest without problems I will be surprised. I was getting the above described symptoms every time if IE was not set to "allow" for physical memory access prior to launching the test.

[dja2k]

-{ Quote: "I have to guess where the cursor needs to go, because it doesn't move in real time, it freezes and them jumps suddenly after several seconds of a near-total system freeze.
" }-

::) Thats the same thing I would do :D

dja2k

[Kegel]

It IS ApDefend that casuses this. End of question.

PG does the same thing.

[[suave]]

To all those who are having this problem. Can you please explain to me what exactly it is you are doing? I haven't experienced any of the symptoms you guys are talking about.

As a matter of fact, everything here is running very smoothly on my Windows XP Pro machine.

nameless1, you say it happens to you with firefox. I am using firefox right now with no problem. AD doesn't even mention anything about firefox wanting physical memory access.

dja2k, you say it happens while using Winamp, Windows Media Player, Media Player Classic, and Limewire. Well, I am using all four of them with not a single problem.

Strange...

[f3x]

here's what i think

First java is really strange, it need memory access and if that java file actually is an applet opened by the browser, the one who need memory access became the browser.

SO my guess 1 is java.
That cover ie / firefox memory acess ( and limewire )

My guess two is some king of codec
Winamp, Windows Media Player, Media Player Classic

are file that are use to encode or decode audio and video
maybee they need special memory acess.

[f3x]

If i am rigth about codec then i should see that some file does crash appdefend and other dont.

The kind of file that use mostly harmless codec would be uncompressed wav file. You can file alot of those in your C:\WINDOWS\Media folder

The worst kind of codec is mp3 protected by drm... especially when they bundle a rootkit ;)

but my guess is that this happened when you tryed to see a video.
Gspot is a really powerfull tool to indetify the codec used by an avi file
http://www.headbands.com/gspot/

[sukarof]

-{ Quote: "It IS ApDefend that casuses this. End of question.

PG does the same thing.
" }-
-{ Quote: "']To all those who are having this problem. Can you please explain to me what exactly it is you are doing? I haven't experienced any of the symptoms you guys are talking about.
" }-

I use PG (ver. 3200) and Appdefend (ver 1.110) side by side and I, like suave, have no problems. Everything runs really smooth. But it is a well known fact that there is no program that is compatible with every computer configuration on earth. Some are bound to have problems, maybe you guys belongs to them?
Thats why "try before you buy" is such a great concept :)

[Kegel]

Once physical memory is allowed, there are no problems here either.

Just a logical question: IF a program needs to access physical memory to run properly, and IF a program blocks that access initially, is it logical to assume that there would be some kind of negative effect on that program? ....at least until you AALLOW the access? Im not saying ApDefend doesnt work as once you tweak it, it is pretty much there and you can forget about it. BUT...we are pointing this out so that POSSIBLY there can be a workaround for programs that need this access.

forget it.

[Paranoid2000]

-{ Quote: "Just a logical question: IF a program needs to access physical memory to run properly, and IF a program blocks that access initially, is it logical to assume that there would be some kind of negative effect on that program? ....at least until you AALLOW the access?" }-As Jason has noted above, AppDefend will suspend the process until you respond to its prompt so the program itself should not cause any problems. However there may be other processes linked to that program (mouse driver DLLs, other security software, etc) and it may be these that are causing the problems, especially if they are waiting on that program to complete an action (e.g. antivirus software trying to gain access to a resource held by that program in order to scan it).

I encountered absolutely no issues with PG and its Physical Memory control but did have system lockups with System Safety Monitor when it tried to prompt for programs attempting such access. Ultimately, how these features work will depend on your system configuration and software setup so if you are encountering problems and want to try to find a solution, try removing or disabling other software to see if you can identify the conflict.

[nameless1]

Instead of paying attention to smug "Haha, nanapoopoo, I have no problems, try before you buy :) :)" answers, and random guesses, I'll wait for Jason to give more insight.

[f3x]

-{ Quote: "Instead of paying attention to smug "Haha, nanapoopoo, I have no problems, try before you buy "" }-

Please refrain yourself from infantilising those who are trying to relp you.

-{ Quote: "I'll wait for Jason to give more insight." }-

I hardly see what jason can give more on that topic
Your application request for physical memory, the request is hold in a non cpu wating way until you accept it. ( this is what appdefend do)

As paranoid2k clearly explained this particular thread does not freeze cpu.
However, linked thread can be the problem and there is definitively some devlopment that can be done to minimise those situation.

In any cases just turn off that particular feature and wait until next beta

From Jason:
-{ Quote: "
I know it seems like AppDefend, but it is just a symptom which AD happens to show you. There is better handling of physical memory for such applications in the next build.
" }-


The other way to *debug* your problem is to identify what exactly conflict with appdefend in a more precise way. This will help both yourself and Jason to solve teh confict. And unfortunately this is pretty much trial and error, and this is where "random guess", as you call them, comme handy.

[sukarof]

Well put f3x.
-{ Quote: "Instead of paying attention to smug "Haha, nanapoopoo, I have no problems, try before you buy :) :)" answers, and random guesses, I'll wait for Jason to give more insight." }-
My comment was not meant to be bad in any way. I just thought that when I have particular problems, I do appriciate comments from people who do not have the same problem with whaeverprogram. Then I know that it is not the whateverprogram that is the problem.
I can then start looking at my setup trying to find what in my configuration it is that causes this particular problem since no one else or very few has the same problem.

Maybe I could have refrained myself from praising the shareware concept tho. point taken.

[nameless1]

-{ Quote: "Please refrain yourself from infantilising those who are trying to relp you." }--{ Quote: "Maybe I could have refrained myself from praising the shareware concept tho. point taken." }-Sorry, I took the comment as nose-thumbing, and every time I re-read it, I see the same thing. I apologize for being mistaken.
-{ Quote: "I just thought that when I have particular problems, I do appriciate comments from people who do not have the same problem with whaeverprogram. Then I know that it is not the whateverprogram that is the problem." }-But it doesn't always work that way. The fact that not everyone has this problem with AD does not mean that it isn't AD at fault, or at least partially at fault. It only means that there is probably some compatibility issue.

In any case, here is some of the other software I run, in case anyone else who purchased AppDefend impetuously sees a commonality:

WinXP
AnyDVD
NOD32
CommView
SpeedFan
Nero 6
RivaTuner
TrueCrypt
VMware Workstation
Virtual PC 2004

[f3x]

hi nameless1
i've been reporting *random* freezin for alot of reason ( not necerserly phisical memory ) Since then i did some cleaning, one of the thing i have removed is anyDVD, please give it a try. In my case my sistem is now stable.

I do not know if any of the two use a kernel driver,
CommView
SpeedFan

If they do, try disabling them temporaly

Have a nice holliday
hope this help

[nameless1]

-{ Quote: "i've been reporting *random* freezin for alot of reason ( not necerserly phisical memory ) Since then i did some cleaning, one of the thing i have removed is anyDVD, please give it a try. In my case my sistem is now stable." }-My system runs very well in all cases except during physical memory alerts from AD.
-{ Quote: "I do not know if any of the two use a kernel driver,
CommView
SpeedFan" }-They each use two kernel drivers! (For CommView, they are cv2k1 and ts_lb, and for SpeedFan, they are giveio and speedfan--though I have giveio disabled.)

If I get ambitious enough, I will go on a disable/test rampage.

[nick s]

-{ Quote: "...If I get ambitious enough, I will go on a disable/test rampage." }-Hi nameless1,

Scraped together a bit of ambition after a long day...ATM I am running GSS, Ewido, NOD32, Outpost, CommView, TrueCrypt (with an open volume), SpeedFan, AnyDVD, Nero, and VMware (with a Windows 98 guest host running). Had to pass on RivaTuner since I have an ATI card, and I don't have access to Virtual PC. Anyway, no hangs related to physical memory access. In fact, zero physical memory access alerts from GSS for any of these apps.

What's more interesting, though, is that I usually run VMware on my other desktop. There, VMware does generate physical memory alerts from GSS. One obvious difference between the two machines is that the other has NVIDIA graphics. Just speculating, but perhaps these hangs are related somehow to graphics hardware/memory/drivers.

Nick

[nameless1]

Thanks, and I can't believe you took all that time and trouble (thank you very much). RivaTuner does work with ATI cards, but I kind of doubt that RivaTuner is at fault with this problem.

The problem being described in this thread isn't unwanted physical memory access alerts, but rather near system freezes when the physical memory alerts do occur.

Some of the applications I listed don't generate physical memory alerts... They were just the applications I thought might be related to the problem, since they install drivers.

So to have any hope of reproducing the problem, you would have to generate a physical memory alert. If you have AD fully configured already, you would have to find an application rule that allows physical memory access, and set it back to "Default". Then you would run the application (and do whatever is needed) to make the alert be generated.

It makes no difference which application generates the alert...

For example, to reproduce the problem on my system, I can take any application rule in AD that I currently have set up to allow physical memory access (for example, ezmerge.exe from http://www.boilsoft.com ), and set it to Default, or "Ask User / Block", or "Ask User / Allow". Then I'd use ezmerge.exe to join video files. Bang, I get an alert, and the system comes to a standstill.

[nick s]

-{ Quote: "...For example, to reproduce the problem on my system, I can take any application rule in AD that I currently have set up to allow physical memory access (for example, ezmerge.exe from http://www.boilsoft.com ), and set it to Default, or "Ask User / Block", or "Ask User / Allow". Then I'd use ezmerge.exe to join video files. Bang, I get an alert, and the system comes to a standstill." }-Just tried that on both desktops using VMware as the app requiring permission to access physical memory. On the ATI (9200 Pro) desktop, no alerts (as before)...on the NVIDIA (6600 GT) desktop, I get alerts but no hanging. When I get a chance, I will test the remaining apps on the NVIDIA desktop as well.

Nick

Edit...I should mention that I have run every private and public AD beta and have never seen the access physical memory alert hang any of my systems. What's striking to me, though, is that I never see any physical memory alerts on my ATI-based desktop.

[Jason_R0]

-{ Quote: "Thanks, and I can't believe you took all that time and trouble (thank you very much). RivaTuner does work with ATI cards, but I kind of doubt that RivaTuner is at fault with this problem.

The problem being described in this thread isn't unwanted physical memory access alerts, but rather near system freezes when the physical memory alerts do occur.

Some of the applications I listed don't generate physical memory alerts... They were just the applications I thought might be related to the problem, since they install drivers.

So to have any hope of reproducing the problem, you would have to generate a physical memory alert. If you have AD fully configured already, you would have to find an application rule that allows physical memory access, and set it back to "Default". Then you would run the application (and do whatever is needed) to make the alert be generated.

It makes no difference which application generates the alert...

For example, to reproduce the problem on my system, I can take any application rule in AD that I currently have set up to allow physical memory access (for example, ezmerge.exe from http://www.boilsoft.com ), and set it to Default, or "Ask User / Block", or "Ask User / Allow". Then I'd use ezmerge.exe to join video files. Bang, I get an alert, and the system comes to a standstill." }-

Hi Nameless,

Have you tried running SDTRestore which requires physical memory access?
http://www.security.org.sg/code/sdtrestore.html

Its possible that all your alerts are related to one thing, but SDTRestore may be doing a physical memory alert which is different to the others and shouldn't hang your system. This would be a useful test to see if EVERY physical memory alert hangs your machine, or only the certain type probably caused by the NVIDIA drivers.

[nameless1]

Hah, thanks Jason, looks like you are onto something. I ran SDtrestore 0.2, and got numerous physical memory alerts, but no hanging. (Numerous, because I hit "Block Once" a few times.)

So it may be related to NVIDIA video drivers? I also run an NVIDIA nForce2-based mainboard.

In case it matters, I am running the version 81.98 WHQL GeForce drivers.

[Jason_R0]

-{ Quote: "Hah, thanks Jason, looks like you are onto something. I ran SDtrestore 0.2, and got numerous physical memory alerts, but no hanging. (Numerous, because I hit "Block Once" a few times.)

So it may be related to NVIDIA video drivers? I also run an NVIDIA nForce2-based mainboard.

In case it matters, I am running the version 81.98 WHQL GeForce drivers." }-

Hi nameless,

It doesn't really matter what the drivers are. Keep an eye out for the next beta which should have this issue resolved. Hopefully anyhow, as I cannot replicate it on my systems, though I have a pretty good idea what it is. :)

[f3x]

-{ Quote: "In any cases just turn off that particular feature and wait until next beta" }-

;) I told you everything would get fixed by this beta lol

Now Jason, you really should stop talking about that beta each two post you make now, or you'll see some angry impatient ppl that will spam your forum with the migthy question that start with "when" end end with "next beta ?"

The new year would be a great time isnt it ;)

[Jason_R0]

-{ Quote: ";) I told you everything would get fixed by this beta lol

Now Jason, you really should stop talking about that beta each two post you make now, or you'll see some angry impatient ppl that will spam your forum with the migthy question that start with "when" end end with "next beta ?"

The new year would be a great time isnt it ;)" }-

Hi f3x, the beta will be just around the corner. ;)

[f3x]

This solve the misterious third componment ;)

Ghost Security :
AppDefend - Protect your applications
RegDefend - Protect your registry
NfoDefend - Protect your informations*

* Now with the new desinformation center, fool your friend and viruses !

Now the very worst thing you can do is to talk about the imrpoved log tab ;)

[Bubba]

Post and attached pic removed. No politics please according to our TOS (http://www.wilderssecurity.com/TOS-Privacy.html).

Edit:
Off topic post removed.

[Trooper]

The only application I have noticed this problem with was Gaim, but it was the new beta version that they have available.

I don't think it's AppDefend but rather how the the problem application was built/coded.

In any event, Jason has said he is working on fixes for this in the next version which is good news. :)

[berng]

-{ Quote: "Hi f3x, the beta will be just around the corner. ;)" }-

Hi Jason,
Can you give us a hint on how far the corner is away?