[Autogenerated] we can now look at the process,
address space in some greater detail,
introduce some important concepts as they relate to committed and
reserved memory and of course free as well.
Let me go back to a VM app and open some 64-bit process such as the explorer.
Explorer is a natural choice is being a very big process in terms
of its address use and it has many threats.
So it's always interesting to see what's going on in an explorer instance.
Let me talk about the VM app tool in some greater
detail we have three pieces to VM app.
The first one here has some statistics about the process,
we have the process,
executable name and the process and then we have the committed here.
So this is about the committed memory in the process,
the entire committed memory in the process currently that's 546
megabytes roughly being used by Explorer at that point in time when
I captured the snapshot using VM app.
Now these colors represent the type of memory that is being used by Explorer
here and the types are discussed here in the second part,
which we'll get to in a moment and then we have private bytes private bytes
represents the private committed memory in the process.
What is private memory?
So we have two types of memory in terms of how they're used,
we have shared memory and private memory,
shared memory is memory that can be shared and usually is
shared with other processes such as code.
So DLL code is shared between processes.
Same goes for the executable code itself.
However, some other information usually data is not usually shared,
so this is going to be part of the private memory of the process.
So committed here says the entire memory being used in the
process including private and shared memory.
Private bytes represents only the private memory.
So you can see that Explorer only uses 65 megabytes roughly of private memory,
which means that the rest of that memory going up
to 546 megabytes here is shared.
Memory is shared with other processes or at least can
be shared with other processes.
And then the last counter here is the working set.
Working set means around or very close to meaning run,
we'll discuss exactly what working set means later on in this course.
But essentially it means that the memory that I can access right
now without having to incur any page fault.
So that's memory that is being mapped to physical memory.
That's the simplest way to view working set.
So this is the full working set that includes shared and private memory,
some of which is in RAM.
And this is the part that is shown in the working set and the
other parts are not in RAM somewhere else.
Maybe in the page five,
maybe somewhere else will discuss what somewhere else means in a later module.
So, currently with all these 500 and something megabytes of committed memory.
Only 177 MB roughly are actually being mapped to physical memory right now.
And this is usually based on the usage of memory by the
process and the process touches memory.
That memory is brought back to Ram if it's not already there.
So that's some statistics we have here in terms of memory usage in the process.
And then the second part here indicates the usage of memories.
So,
VMs tries to figure out what the memory chunks are used
for in practice because memory at the end of the day is
just a bunch of bytes somewhere,
but it's interesting to know what the various memory is used for in the process,
at least in broad strokes.
So first we have total here.
Just aggregate everything that we see here at the bottom
which provides the details on the page, granularity of course,
because everything has to be a multiple of a page.
You can see the addresses here, always end with three zeroes,
three zeroes is 12 bits, which is four kilobytes,
which is the standard size of a page.
So let's look at some of the types of memory here to get
a better sense of what we see here.
So first we have image, let's examine image first.
Once I select one of these items,
we can see the bottom view is filtered to just show these items.
So images about images.
Pe images, that is which means DLS and executable itself.
This is where all these things are being mapped in the process address space.
So obviously explorers using many DLS it has its own executable of course.
So here's the executable itself.
If we open up one of these chunks we'll see something like this.
We have the breakdown of the chunks in this process.
And so the in this range of addresses and this breakdown is
based on the proper of these pages and of course everything
has to be at least one page in size.
So for example, the first page here is exactly a single page.
We have a protection of read and in fact VMs is smart enough to
perform some kind of passing for the pE behind the scenes and it
identifies this as being the p header and the p header is mapped
with the read protection.
Read only protection because there's no need to change that or
to run anything that is just read only data.
On the other hand, the second piece here is protected using eggs and read,
which means we're talking about code here.
In fact dot text section is the classic name for a code
section generated by by the linker.
If you're familiar with the layout of API Some of
these names might be familiar to you.
So text or dot text is where the code is and that's why this is
mapped into memory using an execute and re protection.
Otherwise this code cannot really execute and the various columns here
provide more details as to some parts that are shared,
some parts that are private in this case we expect most of the things to be uh
to be shared but there's some private memory here as well.
And that sometimes is used because of uh of data that's being um perhaps
getting its own copy for every process using that data.
And that's why we see read right here as protection.
You can also see ws you for working sets which parts
are in the working center right now, which part in RAM?
Right now if at all some might be RAMmed, some might not be in RAM and so on.
So every one of these images has a very similar layout.
We can see the various chunks here,
the header is always going to be mapped with read only then we
have the code map and executed and some other sections here
which are not going to dwell on.
Um and some of these may be familiar to you if you have some knowledge about
the P5 format in any case all these purplish color is about images and
images represent mostly shared memory and that's why we see the committed
size here shows a big chunk of purple and in fact in the private bytes
there's very small chunk of purple,
which means that we have a lot of shared memory here.
Let's now examine other parts.
So here's another one called hip.
So he represents data and so heap memory is never shared.
You can see here that the committed size and the private bytes the orange
is orange like color here represents the same size which is the same size
which means that all the heap memory is in fact private and hips are used
for small memory allocations will discuss hips later on in the sky course
but again you can see some details here as to the various chunks here some
chunks are made of committed memory some chunks might be made of reserved
memory and we'll see that very soon in some other cases but even here you
can see a chunk where we have some reserved part which means that the hip
can grow perhaps to this size as well as required.
So when we see something which doesn't have a particular protection it
means that's reserved because there's really nothing there but it is part
of that reserved range here which has this committed bits in it but
there's some reserved parts as well.
And in the details column we see some information related to the hip I.
D.
And the type of the heap will discuss what the type of
the hip means later on in this course.
Next let's look at the mentorship mentorship represents .NET memory.
So if the process is using .NET memory will find some details here
as to the usage of .NET memory in the process.
However Explorer is unmanaged applications and unmanaged
application doesn't have any .NET code by default.
So we see nothing by the way.
You might see some here in your case because Explorer is able to
use various extensions and these extensions are DLS and some of
these dealers could be written with .NET and so you might see
something here if you know the different process like Visual Studio
see lots of .NET memory,
lots of stuff in the management because we just really
uses a lot of .NET within its process.
Next let's look at a map file.
Met file is very similar to images in the sense that we're talking about
files being mapped into the address space of the process.
The difference that the map files represent data,
so they're not being mapped as pes,
even if they are actually PS but in most cases there will be joy
just data files that are being mapped to memory in order to have
easier access to that data in those files.
And this is done using something called memory mapped files
which will also discuss later on in the course.
So you can see here they actually mapped file here and again,
we can open up these things but of course in this case we mostly
will see stuff that is committed because it is mapped into the
other space of the process by the way this,
M E Y files,
the multiple user interface files actually piece but they're mapped here
as data because we don't expect any code to be here.
In fact there is no code is just the resources.
So map files are considered shareable and can be shared as you can see here in
terms of private bytes we see nothing with this color here,
but the committed bytes do have this color,
which means that this is shared memory rather than private memory.
Moving on, we have something called stack.
This is something we've seen in the previous course when we
talked about threats and this shows the thread stacks for this
process and because we have many threats,
we have many chunks of stack and this is where result memory is clearly visible.
We can see here there's the committed size that is
currently being used by the thread.
There's a guard page or pages used to know when to trigger a stock extension
and then there's the rest of the memory here which has nothing in it but
it's possible to extend the stack as required.
This is reserve mint, which means again it costs nothing.
And so it's possible to increase the threat stack size here
because the stack has to be contagious in virtual memory in
the virtual address space.
And so again, if you open any one of these threats,
you see the same kind of pattern repeating itself.
That's the high address,
that's the lower address and and this is because the stack
grows down on intern MD architectures.
Another chunk we have here is called shareable.
Shareable is kind of interesting because if you
notice the size here is gigantic.
In fact it is roughly two terabytes in size,
but this is the entire size that Really includes,
not just committed member but reserved.
Also.
In fact we can sort here by size.
We can see there's a large chunk here of uh,
of memory,
this is roughly uh close to that particular number and if you open that up or
even before opening up you can see the committed sizes.
14 men bytes only,
which means that most of these adverse space consists of reserve memory,
which means that it's very cheap and there's mostly nothing there.
If I open that up, you can see there's a large chunk here,
in fact multiple chunks that are very big,
but they consist of reserving, which means they don't cost anything,
which means that they're they're not something we're actually using.
But that range is reserved for a particular purpose.
And of course the question is perhaps why do we have this large,
crazy big chunk of roughly two terabytes of addresses?
I mean that's really big.
Why do we you need that kind of thing?
So this is in fact used as a security feature called control
control flow guard or C f g soc f G is built around something
called the C F G beat map and perhaps I'll describe some some
aspects of C f G at the last module for this course and we
understand better what we're seeing here,
but in general we have a big chunk of reserved memory and
we have these kind of holes if you will of committed
memory within that address space.
So I'll discuss what C f G is in the last module for the
course just to make it um more understandable,
but clearly you can see here a case where most of the adverse
space here is actually reserved and again,
you can also make this comparison here.
We have another chunk here,
like called private data here and that's four gigabytes in size but
still only 13 megabytes here are actually committed.
So most of that stuff is actually reserved.
On the other hand with mapped files,
you can see these sizes are the same meaning all that memory is committed,
nothing is reserved, it's fully committed.
Same goals for images.
So what is private data really?
So private data is just all the other kind of memory that
VMs has no idea what it's used for.
It's just memory location using the virtual I'll KPI which we will also
discuss later on in this course and some of that we'll discuss later in
this module and this just shows all the chunks which might be reserved or
some of that might be committed.
The only thing that does make some sense to provide some extra details is a
bunch of threat environment blocks here for the threads.
So we know that every thread has a data structure called threat
environment block or TB which is part of user space.
And so you can see here the addresses of all these
tbs and the corresponding thread I.
D.
Now there's a bug in VMs that shows threat environment
block here without any good reason.
There's nothing here.
Obviously the memory is reserved, so obviously there's no tv here for sure.
There's nothing here.
Only the chunks that are mapped with read,
write and have a threat idea associated with them are actually tbs.
All the rest are just bugs in VMs that hopefully will
be fixed sometime in the future.
So what are we left with?
We have unusable here.
Unusable represents chunks of memory or address space
that is less than 64 kilobytes in size.
And that's because of one of the rules for the mutual Hallock function.
When you call that function for allocating a new chunk,
you always get back an address which is a multiple of
something called the location granularity,
which is always 64 kilobytes.
And so if you have smaller chunks there will never
be returned by future I'll Excel.
They're essentially unusable at this point in time,
maybe if an adjacent block would be free,
then the block would become bigger than 60 64 kilobytes or bigger and
then that could be used for a future allocation.
So this is what unusable means here.
The larger chunk by far the largest one is free.
Obviously this is all the parts that have nothing in there.
That's the free state.
You can see that most of the address space has are
the most of the other spaces free.
There's just nothing there because we know that 128 terabytes is such
a large or huge address space That we can't really use that today in
a very useful way for most processes.
The biggest chunk obviously is here in the shareable area.
That's two terabytes roughly.
But then the rest of that almost 106 terabytes are
here somewhere within this size.
So free.
Just means there's nothing there as we discussed already.
So Vietnam can be used to look at any process except for
protected process to see what their address space looks
like and how they're using memory.
This tool doesn't refresh automatically.
So what we have here is what we captured at the time that we
capture that process address space state.
If you want to actually um refresh that you have to press a five.
We use the refresh menu here in order to get the updates.
If the process while we're looking at it has made changes to its address space