CODEWITHSUNDEEP
windowsmemoryprocessvirtual-memorylow-level
Moses
Moses

Reputation: 31

How virtual memory looks like when a process is created [Windows]?

Someone asked me this question a few days ago, and I couldn't find in the internet a detailed image, showing how the virtual memory looks like when a process is being created.

Let's say the process "program.exe" has been created.

How would you describe the memory layout, using the embedded image?

Can you please show and describe where is the "program.exe" itself in this layout, where are the imported DLLs, where is the heap, the stack, what's going on in the kernel, and etc.

I'll be glad for as much detailed image as you can.

Clear memory layout:

Memory layout Partially filled memory layout (order doesn't really matter):

Partially filled memory layout

Upvotes: 2

Views: 2298

Answers (1)

Yosef Arbiv
Yosef Arbiv

Reputation: 400

See the following diagram from this article: process memory layout

The kernel memory is not related to the new process.

In contrast to user space memory, where each process has its own mapping, kernel space memory has only one mapping. When a thread runs in kernel mode it always sees the same address space, regardless of the process it belongs to.

Upvotes: 4

Related Questions