CODEWITHSUNDEEP
windowsmultithreadingmemory-managementprocessstack
gal
gal

Reputation: 486

Where are threads stored in memory relative to other process structures during execution on a windows x86 system

So a process is:

------DOS header/PE header

------executable code and statically linked libraries

------slack space?

------some dynamically linked libraries

------start of heap

------slack space

------top of stack

------bottom of stack

I am unsure of where the kernel mode stack and user mode stacks are relative to eachother in the virtual memory allocated for the process stack - also, when a new thread is spawned by a multithreaded process, where is the virtual memory allocated for it?

Thanks!

Upvotes: 1

Views: 1583

Answers (1)

JosephH
JosephH

Reputation: 8815

On x86 Windows, the kernel-mode modules are located in the (virtual) memory space from 0x80000000, which is not accessible from a user mode process, and all the user-mode modules are located in the memory space before 0x80000000.

When a new (user-mode) thread gets spawned, a new memory page is allocated for its stack in both the user-mode memory space (accessible from both user-mode and kernel-mode) and kernel-mode memory space (accessible only from the kernel mode). Note that there are some system threads that do not have a user mode context (thus no stack allocated in any of the user-mode processes). These threads purely run in the kernel and do not run under user-mode.

Upvotes: 1

Related Questions