Windows Grey Dev - Memory

[1.303]

Virtual Memory & Paging
Windows uses virtual memory addresses that map to physical memory (RAM) or disk storage. Memory is divided into 4KB "pages" to optimize resource usage and allow multiple processes to share physical addresses safely.
 

 
Page States
Pages in a process's virtual address space exist in three states:

• Free: Not accessible, available for allocation
  
• Reserved: Reserved for future use but not accessible
  
• Committed: Allocated from RAM/paging files and accessible
  

 
Memory Protection
Key protection constants include:

• PAGE_NOACCESS: No access allowed
  
• PAGE_READONLY: Read-only access
  
• PAGE_EXECUTE_READWRITE: Read/write/execute (major red flag!)
  

 
Built-in Protections

• DEP (Data Execution Prevention): Prevents code execution in read-only regions
  
• ASLR (Address Space Layout Randomization): Randomizes memory layout to prevent exploitation
  

 
Memory Allocation in C

Code:

PVOID pAddress = malloc(100);                           // Method 1
PVOID pAddress = HeapAlloc(GetProcessHeap(), 0, 100);   // Method 2
PVOID pAddress = LocalAlloc(LPTR, 100);                 // Method 3

 
Writing to Memory

Code:

PVOID pAddress = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 100);
CHAR* cString = "Hello World";
memcpy(pAddress, cString, strlen(cString));

 
Memory Cleanup
Always free allocated memory to prevent leaks:

• malloc() → free()
  
• HeapAlloc() → HeapFree()
  
• LocalAlloc() → LocalFree()
  

 
Architecture Differences

• x86: 4GB memory space (0xFFFFFFFF)
  
• x64: 128TB memory space (0xFFFFFFFFFFFFFFFF)
  

 
If theres anything I forgot please put it in the comments

My Contact Info:
@crashoutadmin (Telegram)
._.fishi (Discord)

[4.366]

Cool

 NEED MONEY? 
START MAKING MONEY WITH SILENT MINER MALWARES

 

Join the Discussion - Join StellarHub public chat