Windows Memory Layout

Question 1

The Kernel Land portion of memory is reserved for?

Answer 1

Reserved by the OS for device drivers, system cache, paged/non-paged pool, HAL, etc. There is no user access to this portion of memory.

Question 2

What is EPROCESS?

Answer 2

A Windows processes executive process

Question 3

What does EPROCESS contain?

Answer 3

Attributes and structures related to data structures

Question 4

What is PEB and what does it contain?

Answer 4

The Process Environment Block resides in user-accessible memory and contains various user-mode parameters about the running process.

Question 5

What do Symbol Files provide?

Answer 5

Provide useful, descriptive information for functions, variables, etc

Question 6

What is TEB and what does it contain?

Answer 6

The Thread Environment Block stores information for the image loader and various Windows DLLs, as well as the location for the exception handler list

Question 7

What resides in the process address space since user-mode components require writable access.

Answer 7

TEB

Question 8

What is a DLL?

Answer 8

Dynamic Link Library

Question 9

[Immunity] Shortcut for Executable Mode?

Answer 9

ALT+E

Question 10

In an x86 memory map, what are the relevant Low Memory Address space components?

Answer 10

Stack, Heap, Program Image, DLLs, TEB(s), PEB

Question 11

In an x86 memory map, where does the executable reside?

Answer 11

Program Image

Question 12

In the Program Image, where does the executable code/CPU instructions reside?

Answer 12

.text

Question 13

In the Program Image, where does the program’s global data reside?

Answer 13

.data

Question 14

In the Program Image, where does the program’s non-executable resources, including icons, images, and strings, reside?

Answer 14

.rsrc

Question 15

The dynamically allocated portion of the memory is also known as?

Answer 15

The Heap

Question 16

Unlike the stack, what component’s memory allocation must be managed by the application?

Answer 16

The Heap

Question 17

What is the stack used for?

Answer 17

The Stack is used to allocate short-term storage for local (function/method) variables in an ordered manner and that memory is subsequently freed at the termination of the given function

Question 18

The Stack is what kind of structure?

Answer 18

Last In First Out (LIFO), meaning the last item in is the first item out

Question 19

Each time a stack frame is created, a series of instructions executes to store arguments and the return address, save the base pointer of the current stack frame, and reserve space for any local variables of a what?

Answer 19

A function