Saturday, 31 August 2013

Windows: 4kB mapped memory chunks throughout every application's memory

Windows: 4kB mapped memory chunks throughout every application's memory

Note: I can't post images, nor more than two links because of my
reputation. If someone would be kind enough to put the images in place of
their respective placeholders, and then remove this notice, I'd be
grateful.
Inspecting Notepad++ with Process Hacker:
Image 1
Also:
Image 2
Image 3
Image 4
You can notice that every chunk has the same pattern. The first four bytes
are 00 00 xy 70, and the rest is nulled out.
Every application has these. You can it check for yourself. I even created
a program that does absolutely nothing, using NASM and TCC with the
-nostdlib flag, and it still has these chunks.
So, what's the purpose of these chunks of memory?

No comments:

Post a Comment