Addendum

Virtual Memory Concept

Virtual memory is a memory management technique that provides applications with the illusion of a contiguous block of memory, even when physical memory is fragmented. This is achieved using the Memory Management Unit (MMU) in the CPU, which translates virtual addresses to physical memory addresses.

Address Translation

In 64-bit Windows, address translation uses a four-level page table structure:

• PML4 (Page Map Level 4)
• PDPT (Page Directory Pointer Table)
• PD (Page Directory)
• PT (Page Table)

The base of the PML4 (a physical address) is stored in the CR3 register and is unique for each process.

Each virtual address in x64 is composed of: - Four 9-bit indices (for PML4, PDPT, PD, PT) - One 12-bit offset (within the physical memory page)

This structure allows for efficient and hierarchical mapping of virtual to physical memory.

source: Windows Internals 7, part 1

Page Table Entry (PTE)

A Page Table Entry (PTE) in x64 Windows contains various flags and information about a memory page. Key fields include:

• Valid (V): 1 = page is present in memory.
• Writable (W): 1 = page can be written to.
• Owner (O): 1 = user-mode accessible; 0 = kernel-mode only.
• Write-Through (Wt): Controls write-through caching.
• Cache Disabled (Cd): Disables caching for this page.
• Accessed (A): Set when the page is read.
• Dirty (D): Set when the page is written.
• Large Page (L): 1 = page is large (2MB); 0 = 4KB page.
• Global (G): Global pages stay in TLB across CR3 changes.
• NX (No Execute): 1 = execution not allowed.
• Page Frame Number (PFN): Physical page number.
• Software-reserved bits: Used internally by the OS.

source: Windows Internals 7, part 1

• Valid (V): 1 = page is present in memory.
• Writable (W): 1 = page can be written to.
• Owner (O): 1 = user-mode accessible; 0 = kernel-mode only.
• Write-Through (Wt): Controls write-through caching.
• Cache Disabled (Cd): Disables caching for this page.
• Accessed (A): Set when the page is read.
• Dirty (D): Set when the page is written.
• Large Page (L): 1 = page is large (2MB); 0 = 4KB page.
• Global (G): Global pages stay in TLB across CR3 changes.
• NX (No Execute): 1 = execution not allowed.
• Page Frame Number (PFN): Physical page number.
• Software-reserved bits: Used internally by the OS.