1

Someone asked me this question a few days ago, and I couldn't find in the internet a detailed image, showing how the virtual memory looks like when a process is being created.

Let's say the process "program.exe" has been created.

How would you describe the memory layout, using the embedded image?

Can you please show and describe where is the "program.exe" itself in this layout, where are the imported DLLs, where is the heap, the stack, what's going on in the kernel, and etc.

I'll be glad for as much detailed image as you can.


Clear memory layout:

Memory layout Partially filled memory layout (order doesn't really matter):

Partially filled memory layout

8
  • Start Program.exe and look with VMMap at its layout. That will give you the visual impression of it. learn.microsoft.com/en-us/sysinternals/downloads/vmmap. It will only show the user space of it because that is what the application will see since it is dealing with a Virtual Address Space which is virtualized by the OS for every application to isolate memory between processes. Oct 12, 2019 at 18:15
  • Thanks @AloisKraus. It doesn't answer my questions since it's not in the visual form I look for, and of course lacks of Kernel space. Can you try maybe using the questioned image in your answer?
    – Moses
    Oct 12, 2019 at 18:30
  • i be say question is unclear. what you mean under where ? exe, dll(s), heap, stack - all in user mode space.
    – RbMm
    Oct 12, 2019 at 18:42
  • @RbMm Yes but in which order? For example, the process and the DLLs are both in memory, but in different places. Ntdll.dll is in memory also. Kernel32.dll is there either. What else is there? Where would you place the Stack and the Heap in each process in memory? It was basically an open question to see how could I present the virtual memory in visual..
    – Moses
    Oct 12, 2019 at 18:50
  • @Moses - first mapped exe and ntdll.dll to process (of course first thread stack, teb, peb, etc) than loaded additional dlls.. anyway your question still unclear for me
    – RbMm
    Oct 12, 2019 at 18:54

1 Answer 1

3

See the following diagram from this article: process memory layout

The kernel memory is not related to the new process.

In contrast to user space memory, where each process has its own mapping, kernel space memory has only one mapping. When a thread runs in kernel mode it always sees the same address space, regardless of the process it belongs to.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.