       WIN32 

     5

     ,    ,    
 ,    ,  .     
  ,    .   
   ?      ?  
  ? 
      ,    ,    
    .      , 
    Win32. 

       

     Win32       4 
.  32-       000000000 
 OxFFFFFFFF. ,  ,    4 294 967 296 
,       . 
     MS-DOS  16- Windows      
 .  ,       
    ,   ,  
  .   , ,  
    . , ,    
 ,   ,     
     .    
    . 
      Win32      ,    
   .      
- ,       ,   
 . ,   ,      
 . 
     Windows NT ,    ,  
   .  ,     ~ 
  .   Windows 95 , ,  ,   
,   ,      
 ,      .  -  
Windows 95,    Windows NT,         
  .  ,        
,      ,  16- Windows. 

    81 

    82 ______________________________Windows   

    ,    ,    .  
,          - 
    012345678,         
             
 .      012345678, ,  
  ,       . ,    
   ,    ,     
   .  ,      
        ,  . 
     ,         
,   , ,   
,   .  ,     
   . ,       - 
,    ,     
      . (   
  .) 
       Win32  4-  
     -. ,  
   Windows 95  Windows NT. 

     Windows 95      

     . 5-1 ,       
   Windows 95. 

      000000000  0003 FFFFF 

       4        
 Windows 95     MS-DOS  16- 
Windows. He      Win32-.   
           
  ,     Microsoft   
  4   .      4 
.            
      000000000  OxOOOOOFFF,  
  .     
     . 
       ,   ,   
 . ,       : 

    int* pnSomeInteger; 
    pnSomeInteger = (int*)malloc(sizeof(int)); 
    pnSomeInteger = 5: 

       malloc  NULL. .     
         000000000.   
 4   ~-  ,   
,    .     
    . 

      000400000  Ox/FFFFFFF 

        2 143 289 344  (2    4 ) 
  ()   .   
Win32-npoiiecc    

    _______________________ 5.    Win32 83 

    OxFFFFFFFF     ^ 

      1   VxD-,      
;    Win32-npoueccaMM (    
,      ) 

          
    OxBFFFFFFF     ^ 

      1      ,  Win32 DLL, 
16-     ;   
 Win32-np04eccaMH (    ) 

    080000000      
    Ox7FFFFFFF      

      2 143 289 344 ,     
\!32- (,   ) 

    000400000     ^ 
    OxOOSFFFFF      

      4 1 90 208  (    ,   
   ) 

    000001000      
    OxOOOOOFFF     T 

      4096   MS-DOS  16- Windows (, 
   ) 

    000000000      

    . 5-1. \32-  Windows 95 

        ,    '.  
 ,  Wm32-npoueccy,   .  
32-     ,     
 . 

      080000000  OxBFFFFFFF 

        1    ,   
\32-.  , , 1_>: KERNEL32.DLL, 
USER32.DLL, GDI32.DLL  ADVAPI32.DLL.   DLL   
 \32-,         
   .  ,        
  (  .  8). 
    1.  Win32       (ReadProcessMemory 
 WriteProcessMemory),       
     ,     
 . 

    84 ______________________________Windows   


        OxFFFFFFFF 

        1     ,   
    ,    
   .     ,   
   Win32-npouec.  ,       
\32-       - ,   
    . 

     Windows NT      

     . 5-2 ,       
   Windows NT. 

    OxFFFFFFFF     'k 
      2     () 
    080000000 
    Ox7FFFFFFF      
      64        () 
    Ox7FFFOOOO     ^ 
    Ox7FFEFFFF     *k 
      2 147 352 576 ,     
Win32-npoueccaM (,   ) 
    000010000 
    OxOOOOFFFF 
      64      () 
    000000000       

    . 5-2. Win32-pa3Qenbi  Windows NT 


    _____________________ 5.    Win32 85 


      000000000  OxOOOOFFFF 

      ( 64 )      
  Windows NT,      
   ,     4    Windows 95.  
           . 

      000010000  Ox7FFEFFFF 

        2 147 352 576  (2    64    
64 )     .   
   000400000  Ox7FFFFFFF B_Wmdows_95^                    
   "     ~"~ 
      Win32-nponeccy     DLL: 
KERNEL32.DLL, USER32.DLL, GDI32.DLL  ADVAPI32.DLL.     DLL 
  .          
  .  ,       
   ,   . 

      Ox7FFFOOOO  Ox7FFFFFFF 

      ( 64 )    000000000  
OxOOOOFFFF, . .          
  . Microsoft    , 
     . :  
   Win32-cpyHKUHio      ,   
(),     , ,    
. ,   : 

    BYTE bBuf[70000]: 
    DWORD dwNumBytesWritten; 
    BOOL WriteProcessMemory(hProcess, Ox7FFEEE90, bBuf, sizeof(bBuf), &dwNumBytesWritten); 

     ,     WriteProcessMemory  ,  
  ,  ,    ,  
          080000000.   
   ,  WriteProcessMemory,  , 
      ,     
 ,    .        
     , Microsoft  
   Ox7FFFOOOO  Ox7FFFFFFF,     
          . 

      080000000  OxFFFFFFFF 

       ( 2 )  Windows NT Executive,   
 .    Windows 95    
Windows NT  .        
     ,      
       .   
      .  16. 
    ,   ,    Windows NT   
    2   ,      
.    -  MIPS R4000,  
   . , Microsoft    
Win32  Windows NT    -,   (, -, 
 )       , 
  2     Win32  Windows NT. 

    86 ______________________________Windows   


        

     ,     ,  
  (). ,   - 
 ,      ,  \32- 
VirtualAlloc (  .  7).     
 (reserving). 
            
         
(allocation granularity).        
,      (86, MIPS, Alpha  PowerPC)  
   64 .     
  ,    ,    
,      ,   
       . 
        ,     
     .    
 ,     .   
  ,      . 
 ,   Win32   86, MIPS  PowerPC   4 
,   DEC Alpha  8 . 
          10 ,   
        .   
,    xS6, MIPS  PowerPC     
12 ,    Alpha  16 . 
        .     
   ,       . 
    (releasing)     
 VirtualFree. 

   /\ 
           
    , ,    
   (process environment block, ).  
    , ,    
  .    - 
    . 

     ,   ,      
,       (thread 
environment blocks, TEBs).        
       . 
     :         
 ,      .   
,   ,   -  -,  
  64 .         
 ,     . 

        

          
,          . 
      (committing physical 
storage).      ,  
      VirtualAlloc.    
,      . , ,  
  64      

    ______________________ 5.    Win32 87 

         .  . 5-3   
,      . :  
     . ,  . 5-3 
 ,        xS6, 
MIPS  PowerPC (  4 ),      DEC Alpha 
(  8 ). 
      ,   ,   
,  .       (decommitting 
physical storage)     VirtualFree. 

    86, MIPS  PowerPC      DEC Alpha 
    
     11-16        6-8 
    (24 576 )        (24 576 ) 
     10 
    '4()96'           5 
     9             (8192 ) 
    (4096 ) 
     8 
    (4096 )           4      64-  
    ~~~1        (8192 )       
     / "                 ' 
    (4096 ) 
     6 
    (4096 )          -       
    ___________         3 
     5 """"         (8192 ) 
    (4096 ) 
     4 
    ()           2 
     3             (8192 ) 
    (4096 ) 
     2 
    (4096 )          -,       , 
     1 
    !(8192 ) 
    (4096 ) ,                         v 
    I               ff _1_ 

    . 5-3.         


      

     16- Windows       
(random access memory, RAM),   .  ,   
  16   .      
,    16  .    
   16- Windows 

    88 ______________________________Windows   

        . >   
  ( )   ,     
  ,          
   ^   .    
        
   . 
     , 16- Windows   , 
     (swap files),    . 
      ,   
     .   16- Windows 
          
386  .      ,  
.     16   ,      
   20 ,  ,     
  36   . 
    , 36         .  
          
           
   .       
 ,  ,    16- Windows 
 .     ,   ,  
    ,    . 
     Windows 95  Windows NT      
  Windows 3.1.       
 ,         
 . 
       Win32-CHcreMax      
,          
 (paging files). ,      
-    ( VirtualAlloc),   
    ,    .  
      ,   
 ,  .     
   . 
     ,  ,       
      .     
 (. . 5-4).    ,    , 
   .       
   ,        . 
       ,    ,   
 ,   -   .    
    (page fault),     
     .    
      ;   , 
      .     
,   ;      
      .    
   ,      , 
        , , 
          
 . 
     :         
   ,         
   . ( , ,   
,            
  .)  ,    , 
            
 . 

    _______________________ 5.    Win32 89 


        j   ^^ 
                                \ 
                                                                r r' 
     \ 
     RAMS   ӗ>-    җ>-        1 
           '^<   (     \&^                            
 ^ 
    \ ^      )      \^ ^'                         "^          '' 
     
    \ 
                           ,, 
    tcTb                            RAM, 
     RAM ,  >-     
    ^-                        
                            V 
    v                                                 ^ 
                          5                       " 
         ^__________      -<  .  
                             _____       -^ 
 ^
                             RAM   "^|             '\ ^^^ 
     
    + 
    v                                                           
      \                                              _____      
      ^                                                           
    '"           "^                                                          
  
    
    . 5-4.       


    VwiNDowsy NT 

    Windows NT     , ,    
    ,     
,        . 
     ,  Control Panel,  
  System,   Performance    Virtual 
Memory    Change. 

           

      , ,  , ,    
        , 
    ,       
        , 
   ,   

    90 ______________________________Windows   

           (   ) 
  ,    . 
        ,       
      .      : 
          
    .     
  ,   ,    ,  
 -. -, :   -   
     ,   (image) 
-      . 
     ,    
   . 
       (. . -  DLL-),    
            
,      (memory-mapped file). 
    DLL      
      .  ,   
(   \32-)      
   . (         8.) 

    /^ 
     -  DLL-   , Windows 95  Windows NT 
       .     
        ;     
      . ,  
,  ,    . 

          ,   
  ,      
 .    -   
-  DLL-  ,    ,  , 
. ,          
 ,           
 .          
  ,    . 
           ,   
   (CD-ROM   ),    
      /SWAPRUN:CD  /SWAPRUN:NET. 

      

       ,    
VirtualAlloc,     : 

                     

    PAGE_NOACCESS               ,    
       . 
    PAGE_READONLY                   
     . 
    PAGE_READWRITE                  
   . 
    . . . 

    _____________________ 5.    Win32 91 

     

                     

    PAGE_EXECUTE                       
     . 
    PAGE_EXECUTE_READ                . 
    PAGE_EXECUTE_READWRITE       . 
    PAGE_WRITECOPY                    
      .      ,   
      . 
    PAGE_EXECUTE_WRITECOPY        .    
      ,       
  . 
    ^^ 86, MIPS, PowerPC  Alpha  PAGE_EXECUTE  
-, ^,       Win32   
.        
  .     PAGE_EXECUTE  
 ,          .  
     ,    Windows NT  
       . 

    VWINDOWS/ 
     Windows 95       3  
: PAGE_NOACCESS, PAGE_READONLY  PAGE_READWRITE. 


         

     ,    ,  , 
  : PAGE_WRITECOPY  PAGE_EXECUTE_WRITECOPY.  
        
   . Win32  ,    
        .     
         . ,  
   ,         
       ! 
       ,     
       (copy-on-write).  
     -     ,  
     : 
    1.       . 
    2.     . 
    3.    ,       
 ,     ,    2. 
    4.           
 . 
        ,      
 .          
       8. 

    92 ______________________________Windows   

     ,       
   VirtualAlloc    PAGE_WRITECOPY 
 PAGE_EXECUTE_WRITECOPY.   VirtualAlloc  , a 
GetLastError   ERROR_INVALID_PARAMETER.   ,    
   ,     
 -  DLL-. 

    XWINDOWS/ 
    Windows 95       .  
    . Windows 95     ,  
   .. 


        

       ,     
: GE_NOCACHE  PAGE_GUARD.      
 ( PAGE_NOACCESS)   OR. 
     PAGE_NOCACHE    .  , 
    ;      
   ,     . 
     PAGE_GUARD      . Windows NT 
     .     .  
     7. 
    
    XWINDOWS/ 
    Windows 95     PAGE_NOCACHE  GE_GUARD. 


      

          , , 
,      .      
  ,       
    .      
VMMAP.EXE   6.         
,     ,       
 VMMap   Windows NT.     
     . 5-5.      
Windows NT  Windows 95    . 

                                     () 
                                 
    00000000     Free           65536 
    00010000     Private         4096    1        -RW
    00011000     Free           61440 
    00020000     Private         4096    1        -RW
    00021000     Free           61440 
    00030000     Private      1048576    3        -RW-      
    00130000     Private         4096    1        -RW
    00131000     Free           61440 
    00140000     Private      1048576    2        -RW-       
    . . cmf 

    . 5-5.       Windows NT 


    ______________________ 5.    Win32 93 


    . 5-5 () 

     () 

          

    00240000 Mapped 65536 2 -RW
    00250000 Mapped 36864 1 -R-
    00259000 Free 28672 
    00260000 Mapped 139264 1 -R-
    00282000 Free 57344 
    00290000 Mapped 266240 1 -R-
    002D1000 Free 61440 
    002 Mapped 12288 1 -R-
    002 Free 53248 
    002FOOOO Mapped 819200 4 ER-
    8000 Free 32768 
     Mapped 143360 1 -R-
     Free 118784 
    00400000 Image 36864 5 ERWC C:\AdvWin\virimap. 06\dbg_x86\vmmap. exe 
    00409000 Free 28672 
    00410000 Mapped 3145728 2 ER-
    00710000 Private 4096 1 -RW
    00711000 Free 61440 
    00720000 Private 4096 1 -RW
    00721000 Free 61440 
    00730000 Private 4096 1 -RW
    00731000 Free 61440 
    00740000 Private 131072 2 -RW
    00760000 Private 65536 2 -RW
    00770000 Free 1999110144 
    779FOOOO Image 98304 5 ERWC D:\WINNT\system32\msvcrt40.dll 
    7708000 Free 32768 
    7710000 Image 253952 5 ERWC D:\WINNT\systeiTi32\msvcrt40. dll 
    774 Free 3612672 
    77DCOOOO Image 249856 6 ERWC 0:\WINNT\system32\advapi32.dll 
    770FDOOO Free 143360 
    77E20000 Image 299008 5 ERWC D:\WINNT\system32\rpcrt4.dll 
    77E69000 Free 28672 
    77E70000 Image 335872 5 ERWC D:\WINNT\system32\user32.dll 
    77EC2000 Free 57344 
    77EDOOOO Image 176128 5 ERWC D:\WINNT\system32\gdi32.dll 
    77EFBOOO Free 20480 
    77FOOOOO Image 372736 5 ERWC D:\WINNT\system32\kernel32.dll 
    77F5BOOO Free 20480 
    77F60000 Image 372736 8 ERWC 0:\WINNT\system32\ntdll.dll 
    77FBBOOO Free 123949056 
    7F5FOOOO Mapped 2097152 3 ER-
    7F7FOOOO Free 8126464 
    7FFBOOOO Mapped 147456 1 -R-
    7FFD4000 Free 40960 
    7FFDEOOO Private 4096 1 ERW
    7FFDFOOO Private 4096 1 ERW
    7FFEOOOO Private 65536 2 -R-


    94 ______________________________Windows   

      . 5-5  ,    
 .       ,  
     . 
      ( )     . 
,  ,         
  000000000       
,     Ox7FFEOOOO.   . 
         , 
 64 .         
.     - ,    
  ,  64 , ,     
    . 
         : free (), private 
(), image ()  mapped ().     : 

           

    Free        ;   
               
  . 
    Private         . 
    Image            - 
 DLL-. 
    Mapped          . 

          VMMap   
 .   .   , VMMAP.  
,         ,   Win32, 
 ,  ,     . 
         ,  
     .  
  . ,      
,   ,   VMMAP.EXE,    6. 
           . ,  
  USER32.DLL   7770000.    
    ,   335 872 .  
,        ,  
 ,     (4096   86). 
            . 
         , 
         (    
   ).       
 0,       . (   
       .)    
        1   ( 
      ). ,  , 
   7770000,   335 872 .   
   xS6 (   4096 ),  
      82 (335 872/4096);  ,   , 
   5 . 
          .    
:  = execute (), R = read (), W = write (),  
= copy-on-write (  ).        
  ,    .    
   .  ,  

    _____________________ 5.    Win32 95 

           (PAGE_GUARD  
PAGE_NOCACHE)        ,    
  .    
        , 
  . 
      ( )      
.      ,      
,    VMMAP.EXE   ,   
   .      
VMMAP.EXE   :       
(default process heap).     ,    
      PAGE_GUARD.     
,     ,   VMMAP.EXE    
.      (  .  9) VMMAP.EXE 
  :    ,    
,   GetProcessHeap. 
       image  VMMAP.EXE     
,    . (     
GetModuleFileName.)      mapped      
,       ,    
     . 

       

         (   
,    . 5-5). ,   . 5-6    
  ,    :    ,  
    . 

          ()                         

    00000000     Free           65536 
    00010000     Private         4096    1        -RW
    00010000 Private         4096    1        -RW
    00011000     Free           61440 
    00020000     Private         4096    1        -RW
    00020000 Private        4096    1        -RW
    00021000     Free           61440 
    00030000     Private      1048576    3        -RW-     
    00030000 Reserve      1036288             -RW
    0012DOOO Private        4096             -RW-   G
    0012 Private         8192             -RW
    00130000     Private         4096    1        -RW
    00130000 Private         4096    1        -RW
    00131000     Free           61440 
    00140000     Private      1048576    2        -RW-      
    00140000 Private        12288             -RW
    00143000 Reserve      1036288             -RW
    00240000     Mapped         65536    2        -RW
    00240000 Mapped          4096             -RW
    00241000 Reserve        61440             -RW
    . . . 

    . 5-6.      (  
  )  Windows NT 

    96 _____________________________Windows   

    . 5-6 () 

      ()      

    00250000 Mapped 36864 1 -R-
    00250000 Mapped 36864 -R-- -
    00259000 Free 28672 
    00260000 Mapped 139264 1 -R 
    00260000 Mapped 139264 -R-- -
    00282000 Free 57344 
    00290000 Mapped 266240 1 -R
    00290000 Mapped 266240 -R -
    002D1000 Free 61440 
    002 Mapped 12288 1 -R-
    002 Mapped 12288 -R-- -
    002 Free 53248 
    002FOOOO Mapped 819200 4 ER-
    002FOOOO Mapped 12288 ER-- -
    002F3000 Reserve 774144 ER-- -
     Mapped 4096 ER-- -
    10000 Reserve 28672 ER-- -
    8000 Free 32768 
     Mapped 143360 1 -R-
     Mapped 143360 -R -
     Free 118784 
    00400000 Image 36864 5 ERWC C:\AdvWin\vmmap.06\dbg_x86\vmmap.exe 
    00400000 Image 4096 -R-- -
    00401000 Image 12288 ER-- -
    00404000 Image 4096 -R-- -
    00405000 Image 8192 -RW- -
    00407000 Image 8192 -R-- -
    00409000 Free 28672 
    00410000 Mapped 3145728 2 . ER-
    00410000 Mapped 512000 ER-- -
    00480000 Reserve 2633728 ER -
    00710000 Private 4096 1 -RW
    00710000 Private 4096 -RW- -
    00711000 Free 61440 
    00720000 Private 4096 1 -RW
    00720000 Private 4096 -RW- -
    00721000 Free 61440 
    00730000 Private 4096 1 -RW
    00730000 Private 4096 -RW- -
    00731000 Free 61440 
    00740000 Private 131072 2 -RW
    00740000 Private 4096 -RW- -
    00741000 Reserve 126976 -RW- -
    00760000 Private 65536 2 -RW
    00760000 Private 8192 -RW- -
    00762000 Reserve 57344 -RW- -
    00770000 Free 1999110144 -RW- -
    . . . 


    ______________________ 5.    Win32 97 


    . 5-6 () 


     () 

          

    779FOOOO Image 98304 5 ERWC D:\WINNT\system32\insvcrt40. dll 
    779FOOOO Image 4096 -R" -
    779F1000 Image 32768 ER-- -
    779F9000 Image 49152 -R-- -
    77A05000 Image 4096 -RW- -
    77A06000 Image 8192 -R-- -
    77A08000 Free 32768 
    77A10000 Image 253952 5 ERWC D:\WINNT\system32\msvcrt.dll 
    77A10000 Image 4096 -R-- -
    77A11000 Image 184320 ER" -
    77A3EOOO Image 28672 -R" -
    77A45000 Image 20480 -RW- -
    77A4AOOO Image 16384 -R-- -
    77A4EOOO Free 3612672 
    77DCOOOO Image 249856 6 ERWC D:\WINNT\system32\advapi32. dll 
    77DCOOOO Image 4096 -R-- -
    77DC1000 Image 172032 ER--  
    77DEBOOO Image 36864 -R -
    77DF4000 Image 16384 -RWC -
    77DF8000 Image 4096 -RW- -
    77DF9000 Image 16384 -R -
    77DFDOOO Free 143360 
    77E20000 Image 299008 5 ERWC D:\WINNT\system32\rpcrt4.dll 
    77E20000 Image 4096 -R-- -
    77E21000 Image 241664 ER-- -
    77E5COOO Image 16384 -R-- -
    77E60000 Image 4096 -RW- -
    77E61000 Image 32768 -R-- -
    77E69000 Free 28672 
    77E70000 Image 335872 5 ERWC D:\WINNT\system32\user32.dll 
    77E70000 Image 4096 -R-- -
    77E71000 Image 258048 ER-- -
    77EBOOOO Image 32768 -R-- -
    77EB8000 Image 4096 -RW- -
    77EB9000 Image 36864 -R-- -
    77EC2000 Free 57344 
    77EDOOOO Image 176128 5 ERWC D:\WINNT\system32\gdi32.dll 
    77EDOOOO Image 4096 -R-- -
    77ED1000 Image 143360 ER-- -
    77EF4000 Image 4096 -R-- -
    77EF5000 Image 4096 -RW- -
    77EF6000 Image 20480 -R-- -
    77EFBOOO Free 20480 
    77FOOOOO Image 372736 5 ERWC D:\WINNT\system32\kernel32.dll 
    77FOOOOO Image 4096 -R-- -
    77F01000 Image 237568 ER-- -
    77F3BOOO Image 36864 -R-- -
    . . . 


    98 _____________________________Windows   


    . 5-6 () 

        ()                         

    77F44000 Image          8192             -RW- -
    77F46000 Image          86016             -R-- -
    77F5BOOO     Free           20480 
    77F60000     Image         372736    8        ERWC   D:\WINNT\system32\ntdll.dll 
    77F60000 Image          4096             -R" -
    77F61000 Image         233472             ER-- -
    77F9AOOO Image          32768             -R-- -
    77FA2000 Image           4096             -RW- -
    77FA3000 Image           4096             -RWC -
    77FA4000 Image           8192             -RW- -
    77FA6000 Image           4096             -RWC -
    77FA7000 Image          81920             -R-- -
    77FBBOOO     Free       123949056 
    7F5FOOOO     Mapped       2097152    3        ER-
    7F5FOOOO Reserve      1048576             ER-- -
    7F6FOOOO Mapped         28672             ER-- -
    7F5F7000 Reserve      1019904             ER-- -
    7F7FOOOO     Free         8126464 
    7FFBOOOO     Mapped        147456    1        -R-
    7FFBOOOO Mapped        147456             -R-- -
    7FFD4000     Free           40960 
    7FFDEOOO     Private         4096    1        ERW
    7FFDEOOO Private         4096             ERW- -
    7FFOFOOO     Private         4096    1        ERW
    7FFOFOOO Private        4096             ERW- -
    7FFEOOOO     Private        65536    2        -R-
    7FFEOOOO Private         4096             -R" -
    7FFE1000 Reserve       61440             -R-- -
    
    ,     ,     
  .          . 
               
 . ,   Ox779FOOOO   
 (4096 )     ,  
 .    Ox779F1000    8  (32 
768 )    ,   ,  
.       ,     
,            9 
 (36 864 ). 
          ,     
 ,     .   
   5  : free (), private (), 
mapped (), image ()  reserve ().   
   ,        
 ,  ,  -  DLL-.    
   reserve,       ,  
      . 
               
.       ,    

    ______________________ 5.    Win32 99 

      . ,  ,   ,  
   -  DLL-.    -   
         PAGE_WRITECOPY  
PAGE_EXECUTE_WRITECOPY,      , 
   ,     .    
   ,   ,        . 
         .      
,        . 
              
 .       , 
  .      ,     
;  ,      PAGE_GUARD  
PAGE_NOCACHE,   . 

        Windows 95 

     . 5-7         
  VMMAP.EXE,     Windows 95. 

          ()                            

    00000000     Free         4194304 
    00400000     Private        65536    4        ----          C:\ADVWIN3\REL_X86\VMMAP.EXE 
    00400000 Private        12288             -R-- -
    00403000 Private         8192             -RW- -
    00405000 Private         8192             -R-- -
    00407000 Reserve        36864             ---- -
    00410000     Private      1114112    4        ----             
    00410000 Private        4096             -RW- -
    00410000 Reserve       104480             ---- -
    00410000 Private         4096             -RW- -
    00410000 Reserve        61440             ---- -
    00520000     Private        65535    2        -RW
    00520000 Private         4096             -RW- -
    00521000 Reserve       61440             -RW- -
    00530000     Private      1179648    6        ----            
    00530000 Reserve      1077248             ---- -
    00637000 Private        4096             -RW- -
    00638000 Reserve        24576             --  
    0063 Private         4096             ---- -
    0063FOOO Private        4096             -RW- -
    00640000 Reserve        65536             ---- -
    00650000     Private      1114112    4        ---
    00650000 Private        4096             -RW- -
    00650000 Reserve      1044480             ---- -
    00650000 Private         4096             -RW- -
    00650000 Reserve        61440             ---- -
    00760000     Private      4194304    2        -RW
    00760000 Private        65536             -RW- 
    . . . 

    . 5-7.      (  
  )  Windows 95 

    100 ______________________________Windows   


    . 5-7 () 

     ()       

    00770000 Reserve 4128768 -RW- -
    OOB60000 Free 2001338368 
    78000000 Private 327680 4 ---- C:\WINDOWS\SYSTEM\MSVCRT.DLL 
    78000000 Private 241664 -R-- -
    7803BOOO Private 28672 -RW- -
    78042000 Private 16384 -R-- -
    78046000 Reserve 40960 ---- -
    78050000 Free 133890048 
    80000000 Private 4096 1 ---
    80000000 Reserve 4096 ---- -
    80001000 Private 4096 1 ---
    80001000 Private 4096 -RW- -
    80002000 Private 4096 1 ---
    80002000 Private 4096 -RW- -
    80003000 Private 12288 1 
    80003000 Private 12288 -RW- -
    80006000 Private 8192 1 ---
    80006000 Private 8192 -RW- -
    80008000 Private 589824 1 ---
    80008000 Private 589824 -RW- -
    80098000 Private 65536 2 ---
    80098000 Private 12288 -RW- -
    8009 Reserve 53248 ---- -
    8008000 Private 4096 1 ---
    8008000 Private 4096 -RW- -
    8009000 Private 454656 1 ---
    8009000 Private 454656 -RW- -
    80118000 Private 196608 1 ---
    80118000 Private 196608 -RW- -
    80148000 Private 20971520 6 ---
    80148000 Private 331776 -RW- -
    80199000 Reserve 20480 ---- -
    8019 Private 16384 -RW- -
    8012000 Reserve 4096 ---- -
    801 Private 393216 -RW- -
    80203000 Reserve 20205568 ---- -
    81548000 Private 139264 3 ---
    81548000 Reserve 65536 ---- -
    81558000 Private 8192 -RW- -
    8155 Reserve 65536 ---- -
    8156 Private 1048576 3 ---
    8156 Private 53248 -RW- -
    81577000 Reserve 991232 ---- -
    81669000 Private 4096 -RW- -
    8166 Private 4194304 3 ---
    8166 Private 4096 -RW- -
    8166 Reserve 4186112 ---- -
    '. . . 


    ______________________  5.    Win32 101 


    . 5-7 () 

     ()       

    8169000 Private 4096 -RW- -
    816 Private 16384 2 ---
    816 Private 4096 -RW- -
    816 Reserve 12288 -RW- -
    81A6EOOO Private 16384 3 ---
    81A6EOOO .Private 4096 -RW- -
    81A6FOOO Reserve 8192 ---- -
    81A71000 Private 4096 -RW- -
    81A72000 Private 12288 1 ---
    81A72000 Private 12288 -R-- -
    81A75000 Private 12288 1 ---
    81A75000 Private 12288 -R-- -
    81A78000 Private 131072 1 ---
    81A78000 Private 131072 -R-- -
    81A98000 Private 36864 1 - 
    81A98000 Private 36864 -R-- -
    81AA1000 Private 4096 1 ---
    81AA1000 Private 4096 -RW- -
    81AA2000 Private 2228224 5 -RW
    81AA2000 Private 69632 -RW- -
    81AB3000 Reserve 61440 -RW- -
    81AC2000 Private 12288 -RW- -
    81AC5000 Reserve 2080768 -RW- -
    81CC1000 Private 4096 -RW- -
    81CC2000 Private 4096 1 ---
    81CC2000 Private 4096 -RW- -
    81CC3000 Private 524288 3 ---
    81CC3000 Private 8192 -RW- -
    81CC5000 Reserve 512000 ---- -
    81D42000 Private 4096 -RW- -
    81043000 Private 4096 1 ---
    81D43000 Private 4096 -RW- -
    81D44000 Private 4096 1 ---
    81044000 Private 4096 -RW- -
    81045000 Private 4096 1 ---
    81D45000 Private 4096 -RW- -
    81046000 Private 4096 1 - 
    81046000 Private 4096 -RW- -
    81D47000 Private 2228224 5 -RW
    81047000 Private 69632 -RW- -
    81058000 Reserve 61440 -RW- -
    81D67000 Private 12288 -RW- -
    8106 Reserve 2080768 -RW- -
    81F66000 Private 4096 -RW- -
    81F67000 Private 2162688 5 -RW
    81F67000 Private 4096 -RW- -
    81F68000 Reserve 61440 -RW- -
    . . . 


    102 ______________________________Windows   


    . 5-7 () 

     ()       

    81F77000 Private 20480 -RW- -
    81F7COOO Reserve 2072576 -RW- -
    82176000 Private 4096 -RW- -
    82177000 Private 4096 1 ---
    82177000 Private 4096 -RW- -
    82178000 Private 20480 1 ---
    82178000 Private 20480 -RW- -
    8217DOOO Private 4096 1 ---
    8217DOOO Private 4096 -RW- -
    8217 Private 4096 1 ---
    8217 Private 4096 -RW- -
    8217FOOO Private 2097152 3 ---
    8217FOOO Private 4096 -RW- -
    82180000 Reserve 2088960 ---- -
    8237 Private 4096 -RW- -
    8237FOOO Private 4096 1 ---
    8237FOOO Private 4096 -RW- -
    82380000 Private 4096 1 ---
    82380000 Private 4096 -RW- -
    82381000 Private 4096 1 ---
    82381000 Private 4096 -RW- -
    82382000 Private 4096 1 ---
    82382000 Private 4096 -RW- -
    82383000 Private 4096 1 ---
    82383000 Private 4096 -RW- -
    82384000 Free 16384 
    82388000 Private 4096 1 ---
    82388000 Private 4096 -RW- -
    82389000 Free 172032 
    823 Private 4096 1 ---
    823 Private 4096 -RW- -
    8234000 Private 1048576 3 ---
    8234000 Private 28672 -RW- -
    823 Reserve 1015808 ---- -
    824 Private 4096 -RW- -
    8244000 Private 1056768 3 ---
    8244000 Private 4096 -RW- -
    8245000 Reserve 1048576 ---- -
    8255000 Private 4096 -RW- -
    8256000 Free 1030004736 
    BFCOOOOO Private 393216 5 ---
    BFCOOOOO Private 249856 -R-- -
    BFC3DOOO Private 4096 -RW- -
    BFC3EOOO Private 12288 -R-- -
    BFC41000 Private 4096 -RW- -
    . . . 


    ______________________ 5.    Win32 103 


    . 5-7 () 

         ()                             

    BFC42000 Private       122880             -R-- -
    BFC60000     Free         2031616 
    BFE50000     Private        45056    5        ---
    BFE50000 Private        24576             -R-- -
    BFE56000 Private         4096             -RW- -
    BFE57000 Private         4096             -R-- -
    BFE58000 Private         4096             -RW- -
    BFE59000 Private         8192             -R-- -
    BFE5BOOO     Free           20480 
    BFE60000     Private        65536    3        ---
    BFE60000 Private        40960             -R-- -
    BFE6AOOO Private         8192             -RW- -
    BFE6COOO Private        16384             -R-- -
    BFE70000     Free          393216 
    BFEDOOOO     Private        57344    3        ----          C:\WINDOWS\SYSTEM\ADVAPI32.DLL 
    BFEDOOOO Private        40960             -R-- -
    BFEDAOOO Private         8192             -RW- -
    BFEDCOOO Private         8192             -R-- -
    BFEDEOOO     Free          335872 
    BFF30000     Private       151552    5        ----          C:\WINDOWS\SYSTEM\GDI32.DLL 
    BFF30000 Private       110592             -R-- -
    BFF4BOOO Private        12288             -RW- -
    BFF4EOOO Private        12288             -R-- -
    BFF51000 Private         4096             -RW- -
    BFF52000 Private        12288             -R-- -
    BFF55000     Free           45056 
    BFF60000     Private        61440    3        ----          C:\WINDOWS\SYSTEM\USER32.DLL 
    BFF60000 Private        28672             -R-- -
    BFF67000 Private         4096             -RW- -
    BFF68000 Private        28672             -R-- -
    BFF6FOOO     Free            4096 
    BFF70000     Private       585728    5        ----          C:\WINDOWS\SYSTEM\KERNEL32.DLL 
    BFF70000 Private       303104             -R-- -
    BFFBAOOO Reserve         8192             ---- -
    BFFBCOOO Private        16384             -RW- -
    BFFCOOOO Private        98304             -R--' -
    BFFD8000 Reserve       159744        '    ---- -
    BFFFFOOO     Free            4096 

           ,   
 Windows 95    . ,  
     ,  ,   
.  ,      mapped  image, ; Windows 95 
    ,      
,            
    -  DLL-. 

    104 ______________________________Windows   

    ,  ,      64  ( 
    ).   , 
 ,      ,      
    .    
 ,       ,  64 . 
, ,     000520000,    2 
:       ,  
60   . 
     ,       ,  
     ,  Windows 95   
.  ,        (PAGE_GUARD  
PAGE_NOCACHE).   , ,  VMMAP.EXE  
   ,  ,     
   . 
     .  Windows 95 (   Windows NT)   
   OxSOOOOOOO-OxBFFPFFFF.  ,   
  ,    Wn'132-.   
 ,     4  DLL,     
 Win32-npoueccy. 