sessions on a single Windows system. In order to implement this feature,
Microsoft has made the Win32 memory space “session private,” so that
the system can essentially load multiple instances of the Win32 subsys-
tem. In the kernel, each instance is loaded into the same virtual address,
but in a different session space. The session space contains the
WIN32K.SYSexecutable, and various data structures required by the
Win32 subsystem. There is also a special session pool, which is essentially
a session private paged pool that also resides in this region.
Page Tables and Hyper Space These two regions contain process-specific
data that defines the current process’s address space. The page-table
area is simply a virtual memory mapping of the currently active page
tables. The Hyper Space is used for several things, but primarily for
mapping the current process’s working set.
System Working Set The system working set is a system-global data
structure that manages the system’s physical memory use (for pageable
memory only). It is needed because large parts of the contents of the ker-
nel memory address space are pageable, so the system must have a way
of keeping track of the pages that are currently in use. The two largest
memory regions that are managed by this data structure are the paged
pool and the system cache.
System Page-Table Entries (PTE) This is a large region that is used for
large kernel allocations of any kind. This is not a heap, but rather just a
virtual memory space that can be used by the kernel and by drivers
whenever they need a large chunk of virtual memory, for any purpose.
Internally, the kernel uses the System PTE space for mapping device dri-
ver executables and for storing kernel stacks (there is one for each thread
in the system). Device drivers can allocate System PTE regions by calling
the MmAllocateMappingAddresskernel API.Section Objects
The section object is a key element of the Windows memory manager. Gener-
ally speaking a section object is a special chunk of memory that is managed by
the operating system. Before the contents of a section object can be accessed,
the object must be mapped. Mapping a section object means that a virtual
address range is allocated for the object and that it then becomes accessible
through that address range.
One of the key properties of section objects is that they can be mapped to
more than one place. This makes section objects a convenient tool for applica-
tions to share memory between them. The system also uses section objects to
share memory between the kernel and user-mode processes. This is done by
Windows Fundamentals 77