Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1

memory that is only accessible while the processor is in privileged mode. User
mode is the nonprivileged mode: when the system is in user mode, it can only
run user-mode code and can only access user-mode memory.


Paging

Paging is a process whereby memory regions are temporarily flushed to the
hard drive when they are not in use. The idea is simple: because physical
memory is much faster and much more expensive than hard drive space, it
makes sense to use a file for backing up memory areas when they are not in
use. Think of a system that’s running many applications. When some of these
applications are not in use, instead of keeping the entire applications in phys-
ical memory, the virtual memory architecture enables the system to dump all
of that memory to a file and simply load it back as soon as it is needed. This
process is entirely transparent to the application.
Internally, paging is easy to implement on virtual memory systems. The sys-
tem must maintain some kind of measurement on when a page was last
accessed (the processor helps out with this) and use that information to locate
pages that haven’t been used in a while. Once such pages are located, the sys-
tem can flush their contents to a file and invalidate their page-table entries.
The contents of these pages in physical memory can then be discarded and the
space can be used for other purposes.
Later, when the flushed pages are accessed, the processor will generate page
fault (because their page-table entries are invalid), and the system will know
that they have been paged out. At this point the operating system will access
the paging file(which is where all paged-out memory resides), and read the
data back into memory.
One of the powerful side effects of this design is that applications can actu-
ally use more memory than is physically available, because the system can use
the hard drive for secondary storage whenever there is not enough physical
memory. In reality, this only works when applications don’t actively use more
memory than is physically available, because in such cases the system would
have to move data back and forth between physical memory and the hard
drive. Because hard drives are generally about 1,000 times slower than physi-
cal memory, such situations can cause systems to run incredibly slowly.


Page Faults

From the processor’s perspective, a page fault is generated whenever a mem-
ory address is accessed that doesn’t have a valid page-table entry. As end
users, we’ve grown accustomed to the thought that a page-fault equals bad
news. That’s akin to saying that a bacterium equals bad news to the human


Windows Fundamentals 73
Free download pdf