Hello and welcome back.
In this video lesson, we are going to study virtual memory computer systems have limited REM, yet
we are able to execute programs, processes, which takes up huge amounts of memory that is made possible
by using something called virtual memory.
Watch Your Memory allows a computer program to have huge amounts of memory beyond what the REM actual
memory, physical memory is.
Let's take a look at the concept in detail.
Now, this is a diagram showing how a computer program executes involves three main components.
The CPU, the RAM, which is your main memory.
Also known as a random access memory and the hard disk program is stored on a hard disk.
But for the CPU to be able to execute any instructions in the program, the operating system first loads
the program into ram memory and creates a process the CPU, then the reasoning instructions from RAM
and executes those instructions to the RAM is relatively inexpensive.
But in the earlier days it was quite expensive compared to hard disk.
What your memory is created to explain the available ram that is there.
So what?
Your memory creates an illusion to a process giving the illusion that there is a huge amount of ram
available exclusively for any process to use.
This is made possible by the concept of virtualization, which ran with your memory.
Now, in this diagram here.
You can see that the actual remote variable could be just one gigabyte, but because of visualization
or virtual memory, a process can access to four gigabytes or even more for a 64 bit operating system.
Not only that, multiple processors can be running almost in parallel, and each of them can be promised
up to four gigabytes, even though the actual physical room is only one gigabyte and they can execute
in parallel without interference from each other.
Now, how is that possible?
This is possible because the have this is used as a virtual memory.
So we had this combined with actual physical memory creates the ability to create virtual memory.
So whatever is not sufficient, you will use this to act as a virtual memory, which are the same.
So, for example, we have two processes.
Process one and process two.
Process one may have two pages of pages, just a chunk or block of memory.
So assuming process, one takes up one page in the physical memory and then page two is also another
day, but then comes close as to who needs to use one page.
The operating system was swap page two from the physical memory to the hard disk.
So Pejeta, which belongs to Process one, is still in virtual memory, but sort out the this this is
done so that process two can look speech into physical memory and then process to finish with its execution.
Pejeta is then sucked back into physical memory for Process One to continue resuming his execution.
Now, this is done so fast and seamlessly that the user does not notice it.
So this is what makes it possible to have virtual memory, which is far bigger than your actual physical
memory, you make use of the hard disk to create an illusion of huge amounts of available memory.
Now, let's do some practical go and download.
Yes.
If you are not going to sample that now, we are going to execute a sample phone and open it.
For inspection using.
Process Hecke.
Scrolling down to the bottom, you can see some, for one is in memory.
If you double click on it, we will get more detailed, detailed information about this process.
Now go and take a look, a memory.
This is you can see all the memory that's being used to watch your memory for this process.
Sample for one, Heikki.
Over here, you can see the base address.
And then in the second column, you can see whether it is met with its image of that private.
Again, and you see the size of each and every block.
And you can see the permission.
On the Fifth Column rewrite of Right.
All right, commit and execute and so on for each one of these, you can also examine and see the details
inside you.
Now, what is the meaning of this?
Private private means that this main relocation is not --.
He had a prosthesis.
For example, tax.
Sex, how the process starts, these local variables also like no sex itself.
He also uses private memory locations so Packers and Melrose will make use of private.
And also make use of the epical virtual halachic, so which API usually unpacks the program into private
memory location?
Images.
Images, those more use of the holiday program, for example, the executable and hosoda in the health
memory location, a court that executes as well as dynamically linked libraries, alcohol images, we
also have met sometimes parts of the files on this needs to be met into virtual memory for use by the
process.
So those parts of the movie contain such statements, I call it, and the process can modify the contents
of the file in her disk by directly modifying the metal contents in memory.
So is just the pointer to the hard disk so that when the process wants to assess something, it goes
to the many locations.
Washington references the hard disk.
That is the meaning of inside here.
If I expand on this memory block, you can see commit and some might have reserved and sometimes you
also see free.
Comic means that he Peche have got physical area in RAM allocated for Terracini, a comet.
If you see this, he means that he has not got the physical memory for it yet, but he is just being
reserved.
When the physical memory in RAM is actually allocated for this virtual memory, then it changes to become
comet.
And sometimes you see free.
Free means that those address in your memory, but has not been a sign hall make available to the process
yet.
And then here you will see under the protection column, go read, write and execute.
Which means that the contents of that memory can be read, but you can't write to these memory locations,
nor can you execute anything in this memory location, right?
Right.
Means that the contents of that memory location can be read as well as written to an ex.
Execute execute means that that location contains code that can be executed, can be run.
So when you see the X Day, it means that these are the locations where you can find code for running
the program.
Next, we take a look at string's in virtual memory, the memory of process.
Has a lot of data that is consumed by the process during execution, some of those data are human readable
strings like you are alse domain names, IP addresses, file names, names of tools and so on.
If you click on any of these memory blocks here, he will open the hex view, he will show you the raw
Vyse found in those location.
For example, in the book, Desilu points out this hex view.
And you can see this location here for followed by Xeros contains all these fights and the magic by
energy for the fire we should be looking at next.
So this tells you that this is her exact location because of this magic base, AMZI.
This column here shows you the ASCII interpretation of this base.
Sometimes we see young characters like this.
There is, because some of these are caught executable code and some are even string's for Zambesi Hallowes
is there.
The first column is the offset offset of the data from the start address of the memory block.
So when you see zero here, it means offset from the address four zero two triple zero.
If I went to this location and I and I opened the hex view zero one zero offset from this address,
four thousand and here is zero zero zero is offset from this address, four zero one two zero.
Now, the important thing to note is this column is going to string, even though some of these invites
are not really strings, but the viewer tries to translate it into human readable, human readable strings.
So you can actually string this way.
But there an easily.
You can use the strings button here.
You can specify the minimum length and so on.
And also search for strength in this region.
And then click OK, and then he would say for you all the strings, you can scroll down and look at
the strings here.
And you can filter out even so, using this technique, you can find a lot of information about the
malware.
Let's try it again.
And this time we're going to add image.
All right, so now he's found more strings.
And you can see as I scroll, I can see how they this memory address.
And then you can put out for dinner here.
Whatever you want to do, you can use a registry for regular expressions and so on and strings containing
what characters?
If you are looking for specific strings, sometimes you may want to look for TDP.
And here you can see some HDB.
And this might review some of the server that your process is trying to connect to.
So we can make use of things such as this and in like this to use against malware to what your memory,
as you can see and see, which a memory provides a lot of information.
For malware detection.
Just by analyzing like this can also show you whether this is America or not, you can also get information
about the malware name hacker, name tag destination's, you are Üç IP addresses and so on.
So this is an easy way to to detect and classify by.
So it is all for this lesson.
Thank you for watching.
I'll see you in the next.