阅读:1292回复:3
关于windows操作系统内存地址
以前看过一份资料列举了windows操作系统中的各个部分的地址范围。比如从a地址到b地址是内核地址范围等等,现在有找不到了 :(
哪位大姥可帮忙提供一下!不胜感激 :D |
|
沙发#
发布于:2003-12-17 10:47
是不是inside win2k啊
讲的比较详细的。 |
|
板凳#
发布于:2003-12-17 12:33
softice for 2K的帮助文件《Using softice》第11章有相关的内容。不过划分的不太精确,可以看一下。 :)
|
|
地板#
发布于:2003-12-17 17:15
Table 7-6 Windows 2000 User Process Address Space Layout
Range Size Function 0x0 through 0xFFFF 64 KB No-access region to aid programmers in avoiding incorrect pointer references; attempts to access an address within this range will cause an access violation. (Note that this range of addresses could be used―this is just a convention to assist in finding bugs.) 0x10000 through 0x7FFEFFFF 2 GB minus at least 192 KB The private process address space. 0x7FFDE000 through 0x7FFDEFFF 4 KB Thread environment block (TEB) for first thread. (See Chapter 6.) Additional TEBs are created at the page prior to this page (starting at address 0x7FFDD000 and working backward). 0x7FFDF000 through 0x7FFDFFFF 4 KB Process environment block (PEB). (See Chapter 6.) 0x7FFE0000 through 0x7FFE0FFF 4 KB Shared user data page. This read-only page is mapped to a page in system space that contains information such as system time, clock tick count, and version number. This page exists so that this data is directly readable from user mode without requiring a kernel-mode transition. 0x7FFE1000 through 0x7FFEFFFF 60 KB No-access region (remainder of 64-KB region following shared user data page). 0x7FFF0000 through 0x7FFFFFFF 64 KB No-access region that prevents threads from passing buffers that straddle the user/system space boundary. MmUserProbeAddress contains the start of this page. |
|