On Win32, the .EXE load address is [0x004000 in virtual storage for that process].This number is determined by the size of the x86 architecture Virtual Memory Protection Organization page and the implementation of Virtual 86 mode to ensure Win95 compatibility with MS-DOS.
On Linux/FreeBSD, the same numbers are used because the situation is the same on x86.
I mean,
- Virtual addresses are defined again for each process
- In the process foo, the virtual address 0x00400000 is where foo.EXE starts loading.
- In the process bar, the virtual address 0x00400000 is where bar.EXE starts loading.
- In the process baz, the virtual address 0x00400000 is where baz.EXE starts loading.
Therefore, it is quite common for different processes to use the same virtual address value.
Of course, the physical memory loaded on foo and bar is different.
So there's no point in just bringing the virtual address "without identifying the process."
I think the correspondence table between virtual and physical addresses is meaningful.
- Even if you get a 4-gigabyte table on a 32-bit OS, it's too big to be used.
- Furthermore, 64-bit OS will be more meaningless in terra units
- Process locations on physical memory can be arbitrarily relocated at any time, and past findings are more likely not to match now
Depending on the circumstances, I don't think it will taste good even if I can check it out.
If you know the real motivation behind this question, you may get another answer.
581 PHP ssh2_scp_send fails to send files as intended
609 GDB gets version error when attempting to debug with the Presense SDK (IDE)
571 rails db:create error: Could not find mysql2-0.5.4 in any of the sources
910 When building Fast API+Uvicorn environment with PyInstaller, console=False results in an error
572 Who developed the "avformat-59.dll" that comes with FFmpeg?
© 2024 OneMinuteCode. All rights reserved.