Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <ol> <li><p>Generally speaking, all applications in the Windows operating systems work with virtual memory. Virtual memory is feature that heavy rely to the hardware support from the processor side. Once this feature will be enabled, processor will handle all memory accesses by address translation according to the information in page tables defined by kernel. But on the other hand we can claim that all applications in Windows works with physical memory, because processor can execute the code and handle the data only if they resides in the RAM, also called physical memory.</p> <p>Virtual memory is just a feature that allows flrxible manipulation on the memory address translation. The kernel mode application differ from the user mode application only in that kernel mode application have access to the page tables and by this can influence to the memory access address translation into the natural physical memory address. In contrast, User mode application haven't this rights, because it will broke all system reliability and securety.</p></li> <li><p>According to the Windows design all application processes (including IE) share the same address space layout, where:</p> <ul> <li>Some small portion of the low virtual addresses is reserved for catching NULL pointer dereferencing. Attempt to access this region will lead to the access violation error.</li> <li>Some huge portion of high addresses is reserved for the kernel mode code. That region isn't accesible from the user mode application and shared by all processes in the system.</li> <li>Part in the middle targeted to the application code and data. And each process in the system has its own layout of that region that implicitly use its own physical memory.</li> </ul> <p>If the small portion in the start is looks like have a constant size of 64 Kb. The border between application and kernel parts of address space can resides in two locations. The first one is widespread default border that assign 2Gb of addresses on the top of address space to the kernel. But the Windows kernel can be launched with special parameter that reduces the size of the kernel part of address space to 1Gb. This kernel config typically used on the servers that runs databases, because bdatabase application want to have as big as possible address space part due to the performance reasons.</p></li> <li><p>Layout of the Application part of the process address space seems to be relatively stable. It can slightly change in dependence of the application config and application activities. This is true for the all Windows systems up to the Vista. Starting from Windows Vista Microsoft applies the ASLR (Address Space Layout Randomization). The purpoce of that feature is to broke described above similarity of the address space of all processes that execute the same application. This feature applied due to the security reasons.</p></li> <li><p>To get the process memory layout use already mentioned by other guys WinAPI system calls:</p> <ul> <li><code>GetSystemInfo()</code> - To get information about application part of address spaces boundaries.</li> <li><code>VirtualQueryEx()</code> - To get the general informtion about address space layout.</li> <li>Other functions of WinAPI to get more detailed information about address space regions in dependence of its types. Look in MSDN for details.</li> </ul></li> </ol>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload