space—every application is different. Still, it is important to understand how
applications use memory and how to detect different memory types.
Private Allocations Private allocations are the most basic type of mem-
ory allocation in a process. This is the simple case where an application
requests a memory block using the VirtualAllocWin32 API. This is
the most primitive type of memory allocation, because it can only allo-
cate whole pages and nothing smaller than that. Private allocations are
typically used by the system for allocating stacks and heaps (see below).
Heaps Most Windows applications don’t directly call VirtualAlloc—
instead they allocate a heap block by calling a runtime library function
such as mallocor by calling a system heap API such as HeapAlloc. A
heap is a data structure that enables the creation of multiple variable-
sized blocks of memory within a larger block. Interally, a heap tries to
manage the available memory wisely so that applications can conve-
niently allocate and free variable-sized blocks as required. The operating
system offers its own heaps through the HeapAllocand HeapFree
Win32 APIs, but an application can also implement its own heaps by
directly allocating private blocks using the VirtualAllocAPI.
Stacks User-mode stacks are essentially regular private allocations, and
the system allocates a stack automatically for every thread while it is
being created.
Executables Another common allocation type is a mapped executable
allocation. The system runs application code by loading it into memory
as a memory-mapped file.
Mapped Views (Sections) Applications can create memory-mapped files
and map them into their address space. This is a convenient and com-
monly used method for sharing memory between two or more programs.Memory Management APIs
The Windows Virtual Memory Manager is accessible to application programs
using a set of Win32 APIs that can directly allocate and free memory blocks in
user-mode address spaces. The following are the popular Win32 low-level
memory management APIs.
VirtualAlloc This function allocates a private memory block within a
user-mode address space. This is a low-level memory block whose size
must be page-aligned; this is not a variable-sized heap block such as
those allocated by malloc(the C runtime library heap function). A
block can be either reserved or actually committed. Reserving a block
means that we simply reserve the address space but don’t actually useWindows Fundamentals 79