windows memory segmentation & Ollydbg -
a few questions windows memory segmentation.
every process in windows got own virtual memory. mean each each process has own task (i mean own task descriptor or task gate) ?
i opened simple exe ollydbg , saw each call intruction dll function taking me jumping table. jumping table had jumping instructions dlls 1 :
jmp dword ptr ds:[402058]
my question why uses data segment , not cs selector base address? if open memory map , find stored @ 402058 find containes resorces. if understand correctly addresses of dll function stored in ds ?
i noticed memory map organized owner. shouldn't organized segments code in cs data in ds etc ?
thank you
1. process has it's own virtual address space. not understand you're referring "task descriptor or task gate", windows operating system holds descriptor each process, called process control block, contains information process (such identification, access tokens, execution state, virtual memory mapping, etc).
a task logical unit can used manage single process, or multiple processes.
job -> tasks
task -> processes
process -> threads
2. in case mentioned, common compilers, program uses .data section store jump table after loading function addresses.
the reason why happens in first place because compiler cannot know dll base address @ compile-time, therefore address has fixed @ load-time point function. known relocation.
in order maintain jump table seperately code, compilers store in .data section. way, can give write permissions (usually .data segment has write permissions) , modify necessary without sacrificing stability , security.
3. each module loaded in process' virtual address space contains it's own sections - that's why see different set of .text, .data, .reloc etc each module. "owner" column module name.
p.s. please ask 1 question per post - way accesible other users after answered, , each question more accurate answers.
Comments
Post a Comment