4.3 User Space and Kernel Space

4 nuTTber of sections

4A5BBF10 time date stamp Mon Jul 13 16:11:12 2009

0 file pointer to symbol table

0 number of symbols

EO size of optional header

122 characteristics

Executable

Application can handle large (>2GB) addresses

32 hi t word machi ne

Note: Addresses in the vicinity of the 2-GB boundary are normally consumed by system

DLLs. Therefore, a 32-bit process cannot allocate more than 2 GB of contiguous memory,

even if the entire 4-GB address space is available.

To Each His Own

Though the range of linear addresses is the same for each process (0x00000000

- Ox7FFFFFFF), the bookkeeping conventions implemented by IA-32 hardware

and Windows guarantee that the physical addresses mapped to this range are

different for each proccss. In other words, even though two programs might

access the same linear address, each program will end up accessing a differ¬

ent physical address. Each proccss has its own private user space.

This is why the !vtop kernel debugger command requires you to provide the

physical base address of a page directory (in PFN format). For example, I

could take the linear address 0x00020001 and, using two different page direc¬

tories (one residing at physical address 0x06e83000 and the other residing at

physical address 0x014b60GG), come up with two different results.

kd> Ivtop 5e83 20001

Pdi 0 Pti 20

00020001 0db74000 pfn[0db74)

kd> Ivtop 14b5 20001

Pdi 0 Pti 20

00020001 1894f000 pfn(l894f)

In the previous output, the first command indicates that the linear address

0x00020001 resolves to a byte located in physical memory in a page whose

PFN is 0x0db74. The second command indicates that this same linear ad¬

dress resolves to a byte located in physical memory in a page whose PFN is

Oxl894f.

Parti I 131