OP 07 July, 2025 - 04:26 AM
Virtual Memory & Paging
Windows uses virtual memory addresses that map to physical memory (RAM) or disk storage. Memory is divided into 4KB "pages" to optimize resource usage and allow multiple processes to share physical addresses safely.
![[Image: virtual-memory.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fmaldevacademy.s3.amazonaws.com%2Fimages%2FBasic%2F5-windows-memory-management%2Fvirtual-memory.png)
Page States
Pages in a process's virtual address space exist in three states:
Memory Protection
Key protection constants include:
Built-in Protections
Memory Allocation in C
Writing to Memory
Memory Cleanup
Always free allocated memory to prevent leaks:
Architecture Differences
If theres anything I forgot please put it in the comments
Windows uses virtual memory addresses that map to physical memory (RAM) or disk storage. Memory is divided into 4KB "pages" to optimize resource usage and allow multiple processes to share physical addresses safely.
![[Image: virtual-memory.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fmaldevacademy.s3.amazonaws.com%2Fimages%2FBasic%2F5-windows-memory-management%2Fvirtual-memory.png)
Page States
Pages in a process's virtual address space exist in three states:
- Free: Not accessible, available for allocation
- Reserved: Reserved for future use but not accessible
- Committed: Allocated from RAM/paging files and accessible
Memory Protection
Key protection constants include:
- PAGE_NOACCESS: No access allowed
- PAGE_READONLY: Read-only access
- PAGE_EXECUTE_READWRITE: Read/write/execute (major red flag!)
Built-in Protections
- DEP (Data Execution Prevention): Prevents code execution in read-only regions
- ASLR (Address Space Layout Randomization): Randomizes memory layout to prevent exploitation
Memory Allocation in C
Code:
PVOID pAddress = malloc(100); // Method 1
PVOID pAddress = HeapAlloc(GetProcessHeap(), 0, 100); // Method 2
PVOID pAddress = LocalAlloc(LPTR, 100); // Method 3
Writing to Memory
Code:
PVOID pAddress = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 100);
CHAR* cString = "Hello World";
memcpy(pAddress, cString, strlen(cString));
Memory Cleanup
Always free allocated memory to prevent leaks:
- malloc() → free()
- HeapAlloc() → HeapFree()
- LocalAlloc() → LocalFree()
Architecture Differences
- x86: 4GB memory space (0xFFFFFFFF)
- x64: 128TB memory space (0xFFFFFFFFFFFFFFFF)
If theres anything I forgot please put it in the comments