1.1 Process Memory Components (User Space)

With an understanding of virtual memory, let us focus our attention on a part of the virtual memory called process memory. Process memory is the memory used by user applications. The following screenshot shows two processes and gives a high-level overview of the components which reside in the process memory. In the following screenshot, the kernel space is deliberately left blank for simplicity (we will fill in that blank in the next section). Keep in mind that processes share the same kernel space:

Process memory consists of the following major components:

  • Process executable: This region contains ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.