Does Windows clear memory pages?

Question

I know that Windows has an option to clear the page file when it shuts down.

Does Windows do anything special with the actual physical/virtual memory when it goes in or out of scope?

For instance, let's say I run application A, which writes a recognizable string to a variable in memory, and then I close the application. Then I run application B. It allocates a large chunk of memory, leaves the contents uninitialized, and searches it for the known string written by application A.

Is there ANY possibility that application B will pick up the string written by application A? Or does Windows scrub the memory before making it available?

Answer 1

Windows does "scrub" the freed memory returned by a process before allocating it to other processes. There is a kernel thread specifically for this task alone.

The zero page thread runs at the lowest priority and is responsible for zeroing out free pages before moving them to the zeroed page list^[1].

---

Rather than worrying about retaining sensitive data in the paging file, you should be worried about continuing to retain it in memory (after use) in the first place. Clearing the page-file on shutdown is not the default behavior. Also a system crash dump will contain any sensitive info that you may have in "plain-text" in RAM.

Windows does NOT "scrub" the memory as long as it is allocated to a process (obviously). Rather it is left to the program(mer) to do so. For this very purpose one can use the SecureZeroMemory() function.

This function is defined as the RtlSecureZeroMemory() function ( see WinBase.h). The implementation of RtlSecureZeroMemory() is provided inline and can be used on any version of Windows ( see WinNT.h)

Use this function instead of ZeroMemory() when you want to ensure that your data will be overwritten promptly, as some C++ compilers can optimize a call to ZeroMemory() by removing it entirely.

WCHAR szPassword[MAX_PATH];

/* Obtain the password */
if (GetPasswordFromUser(szPassword, MAX_PATH))
{    
    UsePassword(szPassword);
}

/* Before continuing, clear the password from memory */
SecureZeroMemory(szPassword, sizeof(szPassword));

Don't forget to read this interesting article by Raymond Chen.