Mastering Reverse Engineering

Memory regions and the mapping of a process

In dynamic analysis, it is important to know what the memory looks like when a program gets loaded and then executed.

Since Windows and Linux are capable of multitasking, every process has its own Virtual Address Space (VAS). For a 32-bit operating system, the VAS has a size of 4 GB. Each VAS is mapped to the physical memory using its respective page table and is managed by the operating system's kernel. So how do multiple VASes fit in the physical memory? The operating system manages this using paging. The paging has a list of used and unused memory, including privilege flags. If the physical memory is not enough, then paging can use disk space as an form of extended physical memory. A process ...