Windows 内存体系结构

虚拟地址空间的分区

• 空指针赋值分区
• 用户模式分区
• 64KB禁入分区
• 内核模式分区

空指针赋值分区

• 位于进程地址空间的0x00000000到0x0000FFFF
• 无法对此分区的内存进行读写与分配，会引发访问违规
  
  

用户模式分区

• 进程无法通过指针来访问其他进程的此分区的内存
• exe和Dll都被载入到这一区域
• 内存映射文件会映射到这一分区

在Windows x86 下得到更大的用户模式分区

• 打开 /LARGEADDRESSAWARE开关，VS2010中设置的方式为:项目->属性->链接器->系统->启用大地址(32位程序打开此开关，运行在64位系统下时，可获取接近4GB的用户模式分区)
• 设置3GB开关:在cmd中执行 bcdedit /set IncreaseUserVa 3072 然后再打开进程的 /LARGEADDRESSAWARE 开关，则对应进程可多访问1GB的用户虚拟地址空间
  bcdedit /enum 查看当前BCD各参数设置 bcdedit /deletevalue IncreaseUserVa 取消对于IncreaseUserVa的设置
• https://support.microsoft.com/en-us/help/294418/comparison-of-32-bit-and-64-bit-memory-architecture-for-64-bit-edition

内核模式分区

• 这一分区是操作系统代码的驻地，与线程调度、内存管理、文件系统支持、网络支持、设备驱动相关的代码都被载入到该分区。
• 此分区的任何东西都归所有进程共有
• 应用程序试图读取或写入位于此分区的内存地址，会引发访问违规
  
  

地址空间中的区域

地址空间的预定、调拨、释放

• 当系统创建一个进程的时候，其可用地址空间中的大部分都是闲置的或尚未分配的，为了使用这些地址空间，需要预定区域并为其调拨物理存储器
• 应用程序预定地址空间时，系统会保证区域的起始地址为分配粒度(一般为64KB)的整数倍，大小为系统页面大小(x86 x64均为4KB，IA-64为8KB)的整数倍
• 给预定的区域调拨物理存储器时，物理存储器始终以页面大小的整数倍进行调拨
• 利用VirtualAlloc VirtualFree来进行地址空间的预定、调拨与释放
  
  

物理存储器与页交换文件

• 进程能访问的内存 = 物理内存 + 磁盘上的页交换文件
• 虚拟地址转为物理存储器地址流程
• 系统需要在内存和页交换文件之间复制页面的频率越高，系统运行的越慢
  
  

页面保护属性

• 常用属性如下
  PAGE_NOACCESS
PAGE_READONLY
PAGE_READWRITE
PAGE_EXECUTE
PAGE_EXECUTE_READ
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE_WRITECOPY
PAGE_WRITECOPY

• 参考资料
  https://docs.microsoft.com/en-us/windows/desktop/Memory/memory-protection-constants
  

页面状态

State	Description
Free	The page is neither committed nor reserved. The page is not accessible to the process. It is available to be reserved, committed, or simultaneously(同时) reserved and committed. Attempting to read from or write to a free page results in an access violation(违反) exception. A process can use the VirtualFree or VirtualFreeEx function to release reserved or committed pages of its address space, returning them to the free state.
Reserved	The page has been reserved for future use. The range of addresses cannot be used by other allocation functions. The page is not accessible and has no physical storage associated with it. It is available to be committed. A process can use the VirtualAlloc or VirtualAllocEx function to reserve pages of its address space and later to commit the reserved pages. It can use VirtualFree or VirtualFreeEx to decommit committed pages and return them to the reserved state.
Committed	Memory charges have been allocated from the overall(全部) size of RAM and paging files on disk. The page is accessible and access is controlled by one of the memory protection constants. The system initializes and loads each committed page into physical memory only during the first attempt to read or write to that page. When the process terminates, the system releases the storage for committed pages. A process can use VirtualAlloc or VirtualAllocEx to commit physical pages from a reserved region. They can also simultaneously reserve and commit pages. The GlobalAlloc and LocalAlloc functions allocate committed pages with read/write access.