1.3.3 Program In Memory

In the previous section, we examined the structure of the executable on the disk. Let's try to understand what happens when an executable is loaded into the memory. When the executable is double-clicked, a process memory is allocated by the operating system, and the executable is loaded into the allocated memory by the operating system loader. The following simplified memory layout should help you to visualize the concept; note that the structure of the executable on the disk is similar to the structure of the executable in the memory:

In the preceding diagram, the heap is used for dynamic memory allocation during program ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.