Process Memory Map (Linux Windows)

Question

Can someone please point me to some documentation on the virtual memory maps used for Linux and Windows. By that I mean what virtual addresses, code, writable static data, the stack and the heap (along with other kernel bits) will normally be placed in, in a typical process?

Answer 1

Since the advent of ASLR, it's mostly on random virtual addresses.

Answer 2

Probably the best way to get the process memory map on Linux is to look at the /proc//maps file. One can clearly see that for each executable or shared object there are separate sections for executable, const static data, and writable static data. Each one of these sections exists in its own memory page which allows Linux to share sections between executables and even implement features like copy-on-write.

In addition to this there is a section dedicated to the stack and one dedicated to the heap. There also may be some anonymous sections as well.

Answer 3

The Wikipedia entry on Address Space Layout Randomisation (ALSR) describes how random allocation of address space protects against various attacks, and how the importance differs between data and code.

It describes both the Linux's default weak level of randomisation, and a patch you can use to strengthen it.

It also describes which versions of Windows offer it, and how it only applies to some code & executables.