[Autogenerated] here is one way of looking at the shared code pages.
If I open process Explorer and select the process of my choosing,
let's say this sbc host process and I go to the DLL stab,
we can see the list of the L S loaded into the process address
space one of the columns is called base.
If you don't see that for whatever reason you can right click and
then select that column here from process Explorer,
select columns,
dialog and this indicate the address the DLL is loaded into in this process.
If you look for some DLL such as kernel 32 you'll find that kernel 32 is
loaded into this address in this particular process.
So if you remember that address we can look at other
processes like task manager is another example.
Look for the same DLL and you'll find the address is exact The same.
So they are mapped to the same virtual address.
And this is necessary because we're talking about code
and some code might not be relocated.
Ble it might be using values addresses which are absolute in in connection
to or in relation to the address space of that process.
And so they have to be the same in every process.
And that's why you'll find Kernel 32 to be mapped to the
same virtual address in every process,
which allows the sharing of the code in physical memory.
We don't see the physical memory here,
we don't see the addresses in physical memory but we
might be able to do that later on.
Once we get more insight into how memory is
translating from virtual to physical.