> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/processes/memory.md).

# Memory

Every process has its own private virtual memory that it uses to store data during its runtime. The Windows memory manager transparently maps a process's virtual memory to physical memory, and may even page data to disk when needed.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/b11bcfcd782f25f005c9fcaa29b30306.png" alt=""><figcaption></figcaption></figure>

Memory management is performed on distinct chunks, called pages, of which there are two supported sizes: small and large. A small page is 4KB on x86, x64, and ARM CPUS; and a large page is 2MB on x64, and 4MB on ARM. Windows provides multiple APIs that can be used to allocate and free virtual memory in a process, of which rthere are three main families:&#x20;

* **Virtual APIs**\
  These are the lower level APIs that are used for general (de)allocations and include functions such as [VirtualAlloc](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc), [VirtualFree](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualfree), and [VirtualProtect](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualprotect). Even though these accept a 'size' argument.

* **Heap APIs**

  * These APIs include [HeapAlloc](https://learn.microsoft.com/en-us/windows/win32/api/heapapi/nf-heapapi-heapalloc), [HeapReAlloc](https://learn.microsoft.com/en-us/windows/win32/api/heapapi/nf-heapapi-heaprealloc), and [HeapFree](https://learn.microsoft.com/en-us/windows/win32/api/heapapi/nf-heapapi-heapfree), and are used to manage memory allocations that are smaller than a page. The heap manager can be thought of an abstraction over the aforementioned virtual APIs. It allocates pages of memory but optimizes its usage by managing smaller allocations within those pages.&#x20;

* **Memory-mapping APIs**&#x20;
  * These APIs are designed to map files into memory from disk, and even share those mapping across processes. These include [CreateFileMappingA](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createfilemappinga), [OpenFileMappingA](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-openfilemappinga), and [MapViewOfFile](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile).