[Autogenerated] one way of looking at the user mode stack is
by using a Sysinternals tool called VM.
app VMs is a tool that allows us to view the address space
ranges in the process of our choosing.
It's a fairly powerful tool.
We'll discuss it in full detail or most details later on when we discuss memory,
but for now, when I launch it,
we get the opportunity to set the process of interest.
This can be anything really well except protected
processes which are inaccessible.
But let's grab an Explorer process because this
process typically have lots of threats.
And now VMs will perform some kind of analysis and try to provide some
breakdown as to how memory is used within the process.
As I said, we'll discuss these tool in greater detail when you look at memory.
But for now I'd like to focus on thread stacks and you notice there's a summary
here of the various usage types of memory in this process.
For example, there are images here.
If I click that, we can see it switches to show me images,
that is DLS and the executable itself mapped to virtual addresses here,
but there's also a portion here related to thread stacks.
So here goes when I click the stack button,
we can see a bunch of chunks of memory here and we have one for each thread in
the process and we know that Explorer typically has lots of threats and that's
why we see many of these stacks stacks here.
If I open up any one of them will see a pattern that tends to repeat.
And so we can see here.
There's a part which is protected by read and write.
This means this is committed memory.
This is memory that can be used right now by the thread.
Currently we can see here it's 56 kilobytes in size.
Some of that might be in physical memory,
sound, that might be out of physical memory,
but the total committed memory,
which means memory that is accessible without any kind of error is 56 kilobytes.
And then we have 12 kilobytes here.
That's three pages that have the God flag.
We don't have a single page.
There are three pages typically used by windows for more
optimized approach when the thread performs perhaps access
to larger chunks of memory.
So this is just an optimization.
But the idea I described earlier still applies and then you have 444
kilobyte left for the stack to grow if needed.
By this thread notice the protection is reserved,
meaning there's really nothing here.
This is just empty space but it is reserved for this purpose and will
not be used for any other purpose in this process.
You notice the addresses.
This is a high address.
This is the lower address and this is lower address still and that's
because the stack grows backwards on intern MD architectures.
So that's the high address.
It grows down getting to the guard pages here and then the
stock that is space that is still available.
You'll notice the entire chunk is only 512 kg biting size rather than the
default of one megabyte and mentioned the previous clip.
And that's because this thing can be set by changing linker linker options,
which I'll show you later on.
And so if you look at any one of these chunks here will see
essentially the same kind of pattern.
We have some kind of size which is currently being used.
We have guard pages and then the reserved part here.
The numbers seem to be always or at least in explore most of the time.
56 kilobytes here as committed memory.
This is definitely not a necessity.
In fact,
that's the default committed memory that is specified in
the p image for X as a show later on.
But you can have any number starting from a single page so some
threats might use more memory in this case,
I don't see any threat using more memory than that,
at least not in the current state of this process,
we can select a different process by going to select process here so you can
try something else that you might find more interesting.
Perhaps maybe VMs itself.
Let's go with the VM app.
The 64 bit version.
Of course we can use the 32 bit version as well and that will show us just 32
bit addresses here as we can see the addresses are smaller because the
address space for 32-bit processes is much smaller.
If I go ahead and look at the stacks,
you can see there are only two threads in this process right now.
In fact, it's just one thread and it has two stacks.
That's because um for 32-bit processes on a 64 bit system that actually have
two stacks in user space and yet another one in kernel space.
And the reason for that has to do with the Windows on
Windows 64 layer or wow 64 layer, which are not discussing in this course.
Anyway, if you open that up, we see exactly the same the same scheme.
We have a bunch of memory here, a chunk which is committed,
being used by that particular threat and then we have a guard
page or pages and the reserve size that remains,
that would allow this stuff to grow up to one megabyte here in size