Windows Memory and Stack

Question 1

PEB

Answer 1

Process Environment Block

Question 2

TEB

Answer 2

Thread Environment Block

Question 3

Program Image

Answer 3

The Program Image portion of memory is where the executable resides.

Question 4

.text section

Answer 4

containing the executable code/CPU instructions

Question 5

.data section

Answer 5

containing the program’s global data

Question 6

.rsrc section

Answer 6

contains non-executable resources, including icons, images, and strings

Question 7

heap

Answer 7

dynamically allocated (e.g. malloc( )) portion of memory a program uses to store global variables. Unlike the stack, heap memory allocation must be managed by the application. In other words, that memory will remain allocated until it is freed by the program or the program itself terminates.

Question 8

stack

Answer 8

the stack is used to allocate short-term storage for local (function/method) variables in an ordered manner and that memory is subsequently freed at the termination of the given function. Recall how a given process can have multiple threads. Each thread/function is allocated its own stack frame. The size of that stack frame is fixed after creation and the stack frame is deleted at the conclusion of the function.

Question 9

Stack structure

Answer 9

Last in First out

Question 10

Name three memory models

Answer 10

flat, segmented, real-address

Question 11

bss

Answer 11

un-initialized data