Memory Page (Virtual Memory)

-

 



 

\>mp

\>mp kn                : Open this docement

\>mp code

 

\mp dec                : Display address value in decimal

\mpd

 

 

 

______________________________________________________________________________________

 

 

When you run a program, the operating system (Windows) allocates 4GB of memory (address)

for each program (process).

(in 64-bit environment, 256TB, 2^48, only 48 of the 64 bits are used for addressing)

 

This memory is virtual memory that mapped to actual physical memory.

 

 

Every time memory is accessed, the conversion to the actual physical address is not a matter of

concern for the process because the operating system and CPU take care of it through quite

cumbersome processes.

(It is implemented in collaboration between the OS and the CPU, such as the page table that

divides the virtual address into 4KB units (pages) and maps them to actual physical addresses, ...)

 

 

Windows manages the entire virtual address space of 4GB assigned to each process by dividing

it into several parts, the MemoryPage function shows the current state and assigned attributes of

each region of the entire virtual address space. 

 

 

 

_______________________________________________________________________________________

 

 


\>mp




~






\>mp dec : Display address value in decimal



~









cf>
Shows the virtual memory allocated to VirtualQuery.exe




______________________________________________________________________________

 

System Internals

System Internals (developer edition)

 



 

▪

Popular posts from this blog

CPU Architecture & Authority Control

-
Image
  General register designations.       ______________________________________________________________________________________________ Till physical address & authority control   ___________________________________________________________________________________________________   Segment Descriptor : 8 Byte size       Content      ___________________________________________________________________________________________________ Segment Descriptor Table       _asm  lgdt  [GDT]       GDTR       __________________________________________________________________________________________ x64    __________________________________________________________________________________________                     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ explains     Till RAM  & Authority control (of Intel Processor)             --------------------------------------------------------------------------------------------    Process  →   Segment Descriptor   →   Paging   →   RAM (physical address)          
Read more

Known DLLs

-
Image
Certain operating system-supplied DLLs get special treatment. These are called Known DLLs. Operating system always looks for them in the same directory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs _____________________________________________________________________ LoadLibrary(“abc”)      : search “abc.dll” (normal search rules) LoadLibrary(“abc.dll”)  : search KnownDLLs Registry, ValueName “abc”     LoadLibrary() and LoadLibraryEx(), If you are passing a DLL name that includes the .dll extension like "abc.dll", search KnownDLLS Registry ValueName "abc" If you are passing a DLL name without the .dll extension like "abc", search "abc.dll" using the normal search rule. Known DLLs     Shows the values in the registry key below   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\ KnownDLLs     __________________________________________________________________________________________________________
Read more

lua command (EnableLUA)

-
Image
Windows actually only grants limited privileges to administrator permission accounts.  You can remove these restrictions by opening the registry editor and specifying the EnableLUA value to 0. Even so, it doesn't seem like you're getting all the privileges  like a  Linux root account, but you can still use most of them. EnableLUA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System       If you type 'lua' in the System Internals command line, it shows the current value, If the current value is 1, you can enter 'lua off' to change it to 0. System Internals must be run with administrator privileges, and if the value changes, a reboot is requested. _____________________________________________________________________ lua off (0, false) :  set EnableLUA value to 0 lua on (1, true) :  set EnableLUA value to 1 lua code  :    code used lua kn  :    knowledge _____________________________________________________________________ cf) User Account C
Read more