This will require a little explanation, so stick with me here.
Firstly, this topic is a confusing swamp of conflicting terms, so please throw away all the concepts that you have about "virtual memory", something related to disks.
- Physical memory is the memory stored on a physical device. This usually refers to system RAM, but can also be disk buffers, NIC buffers, VRAM graphics cards, etc.
- Virtual memory is a set of ranges of physical addresses mapped to user (virtual) address ranges so that memory access can be secure and shared.
A quick note on why we do this: if we were passing direct memory addresses, we could (possibly) have only one memory store. This is inconvenient and bad for performance. When the virtual address is converted to a physical address outside the range of system memory (RAM), the processor generates a page error. This is signaled by the OS interrupt handler, which can then delegate the memory access operation to another device. Useful!
On a 32-bit Windows system, the maximum amount of virtual memory that a process can process at any given time is 2 GB. This can be increased up to 3 GB using AWE or 4 GB using /4GT and AWE. This does not mean that the process can only allocate 2 GB (or 3 GB / 4 GB depending on the previously discussed settings) memory. It just means that it cannot have simultaneous access to more than that.
For example, if you open a file with a memory map of 1 GB, the use of your virtual memory will increase by 1 GB. You do not touch RAM and disk, but you have allocated a block of virtual address space for your process. If then you want to allocate 1.1 GB of RAM simultaneously with the presence of this file with a memory map, you will not be able to. You must cancel the file from your process first. Remember that memory can still be allocated and filled with data, but not actually mapped in your process. If your computer has 8 GB of RAM, you can fill 6 GB with data and map 2 GB to your process. When you need to use another section of this memory, you must unlock the existing block and display another section.
So, for the difference you see:
Private bytes tell you how many bytes of virtual device memory are mapped in your process, excluding virtual memory shared by other processes (e.g. mapped files, global heap, etc.).
The working set tells you how many bytes of physical memory you are actively using. This includes physical memory, device buffers, and associated files. This is a rather strange figure, since it is equivalent to touching a physical memory + a mapped virtual non-system memory. In general, you should completely ignore this figure. This is practically useless for debugging memory leaks.
Virtual bytes are the total amount of virtual memory that you have mapped.
The difference is that you have mapped shared virtual memory, such as a bunch of DLL files or a global heap block, into your process. The difference indicates that the total size of these shared mappings is approximately 1 GB.
Keep in mind that none of this has anything to do with sharing, that is, transferring pages of system memory to disk (the so-called “swap file”) to increase the availability of fast system resources (RAM). The naming of this file did not end the confusion in this area of Windows, and I will be delighted when Microsoft finally decides to call it "swap" rather than "virtual memory" or "page file".