Windows Memory Management

Introduction

Memory management is one of the most critical functions of the operating system. It allows each process to believe it has all the memory to itself while sharing the physical RAM among all processes.

Fundamental Concepts

Physical vs Virtual Memory

Type	Description	Characteristics
Physical Memory (RAM)	Installed hardware memory	Limited, fast
Virtual Memory	Abstraction provided by the OS	Illusion of unlimited memory

Why virtual memory?

1. Process isolation: Each process has its own space
2. Protection: A process cannot access another's memory
3. Flexibility: More memory available than physical RAM
4. Simplification: Programs do not have to manage RAM directly

---

Virtual Address Space

32-bit vs 64-bit Architecture

Architecture	Total Space	User Space	Kernel Space
32 bits	4 GB	2 GB (or 3 GB with /3GB)	2 GB (or 1 GB)
64 bits	256 TB theoretical	128 TB	128 TB

Organization of a process's memory

High addresses
+------------------+
|   Kernel Space   |  <- Inaccessible in user mode
+------------------+
|      Stack       |  <- Stack (grows downward)
|        |         |
|        v         |
|                  |
|        ^         |
|        |         |
|       Heap       |  <- Heap (grows upward)
+------------------+
|   Data (BSS)     |  <- Uninitialized variables
+------------------+
|   Data (Init)    |  <- Initialized variables
+------------------+
|      Code        |  <- Executable instructions
+------------------+
|     Reserved     |  <- Protected area (NULL pointer)
+------------------+
Low addresses (0x0)

---

Paging

Concept

Paging divides memory into fixed-size blocks:

• Page: Block of virtual memory (4 KB by default on Windows)
• Frame: Corresponding block of physical memory
• Page Table: Structure that maps pages to frames

Operation

Virtual Address          Page Table          Physical Address
[Page Number|Offset]  -->  [Frame Number]  --> [Frame Number|Offset]

Page states

State	Description
Free	Unallocated, available
Reserved	Reserved but not committed
Committed	Allocated and usable
Shared	Shared between processes

---

Page File

What is the Page File?

When RAM is insufficient, Windows moves less-used pages to the disk in the pagefile.sys file.

Configuration

# View current configuration
Get-WmiObject Win32_PageFileUsage | Select-Object Name, CurrentUsage, PeakUsage

# View configured size
Get-WmiObject Win32_PageFileSetting | Select-Object Name, InitialSize, MaximumSize

Impact on performance

Situation	Performance
Page in RAM	Access: ~100 ns
Page on disk (SSD)	Access: ~100 us (1000x slower)
Page on disk (HDD)	Access: ~10 ms (100000x slower)

---

Types of Windows Memory

Working Set

The set of pages currently in RAM for a process.

# View the Working Set of processes
Get-Process | Sort-Object WorkingSet64 -Descending | 
    Select-Object -First 10 Name, @{N='WorkingSet(MB)';E={[math]::Round($_.WorkingSet64/1MB,2)}}

Private Bytes

Memory allocated exclusively to a process (non-shareable).

# View the Private Bytes
Get-Process | Sort-Object PrivateMemorySize64 -Descending |
    Select-Object -First 10 Name, @{N='PrivateBytes(MB)';E={[math]::Round($_.PrivateMemorySize64/1MB,2)}}

Virtual Bytes

Total size of the process's virtual address space.

Commit Charge

Total memory "promised" to all processes (can exceed physical RAM).

# View global Commit Charge
Get-CimInstance Win32_OperatingSystem | 
    Select-Object @{N='CommitTotal(GB)';E={[math]::Round($_.TotalVirtualMemorySize/1MB,2)}},
                  @{N='CommitUsed(GB)';E={[math]::Round(($_.TotalVirtualMemorySize - $_.FreeVirtualMemory)/1MB,2)}}

---

Memory-Mapped Files

Concept

Allows mapping a file directly into a process's address space.

Advantages

• Access the file as memory
• Efficient sharing between processes
• Automatic management by the OS

Usage in PowerShell

# Create a memory-mapped file
Add-Type -AssemblyName System.IO.MemoryMappedFiles

$mmf = [System.IO.MemoryMappedFiles.MemoryMappedFile]::CreateNew(
    "MyShare",  # Name
    1024           # Size in bytes
)

# Write data
$accessor = $mmf.CreateViewAccessor()
$accessor.Write(0, [byte]65)  # Write 'A' at position 0

# Read data
$value = $accessor.ReadByte(0)
Write-Host "Read value: $([char]$value)"

# Clean up
$accessor.Dispose()
$mmf.Dispose()

---

Heap

Concept

Memory area for dynamic allocation during execution.

Windows Heap Manager

Windows provides several types of heap:

• Process Heap: Default process heap
• Private Heap: Heap created by the application
• Low Fragmentation Heap (LFH): Optimized for small allocations

Visualizing heaps

# Use VMMap or Process Explorer to view a process's heaps
# Or via debugger

---

Stack

Concept

Memory area for local variables and function calls.

Characteristics

• Fixed size per thread (1 MB by default on Windows)
• Grows towards lower addresses
• Very fast access (LIFO)

Stack Overflow

Error when the stack exceeds its maximum size (infinite recursion, etc.).

---

Memory Analysis Tools

Task Manager

• Performance tab > Memory
• Details tab > Memory columns

Resource Monitor

resmon.exe

Memory tab for detailed view.

Process Explorer (Sysinternals)

procexp.exe

• View > Show Lower Pane
• View > Lower Pane View > DLLs or Handles

VMMap (Sysinternals)

vmmap.exe

Detailed analysis of a process's address space.

RAMMap (Sysinternals)

rammap.exe

Global view of physical RAM usage.

---

Windows Memory Protections

DEP (Data Execution Prevention)

Prevents code execution in data areas.

# Check DEP status
Get-CimInstance Win32_OperatingSystem | Select-Object DataExecutionPrevention_*

ASLR (Address Space Layout Randomization)

Randomizes loading addresses to complicate exploits.

CFG (Control Flow Guard)

Validates targets of indirect function calls.

Credential Guard

Isolates credentials in a virtualized environment.

# Check if Credential Guard is active
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object SecurityServicesRunning

---

Security Implications

Memory-related attacks

Attack	Description	Protection
Buffer Overflow	Buffer overflow	DEP, ASLR, canaries
Use-After-Free	Use after free	Safe heap
Memory Disclosure	Memory data leak	Initialization
Credential Dumping	Memory credential theft	Credential Guard

Memory forensics

Memory contains valuable information:

• Running processes
• Network connections
• Plaintext credentials (if unprotected)
• Command history
• Fileless malware

---

Exercises

1. Use Get-Process to list the top 10 memory-consuming processes
2. Open VMMap and analyze a process of your choice
3. Check your page file configuration
4. Identify if DEP and ASLR are active on your system

---

References

• Microsoft: Memory Management
• Windows Internals, 7th Edition
• Sysinternals Tools